A webshell is a malicious script (PHP, JSP, ASPX, or Python) uploaded by an attacker that creates a persistent remote command execution backdoor through your web server. The most dangerous webshells are designed to look indistinguishable from legitimate framework cache or session files.
PHP in uploads = webshell. WordPress upload directories should never contain executable PHP files. Any PHP file in /wp-content/uploads/ is a webshell, no exceptions. Start here before running complex grep patterns.
Timestamp mismatch = suspicious. A PHP file with a modification date that does not match any deployment, plugin update, or core update you performed is your strongest signal. Use find -mtime -7 after a suspected compromise date.
Hash before you delete. Always run md5sum and sha256sum on a suspected webshell before removing it. The hash is your evidence β without it, you cannot confirm what you found or report it to a hosting provider.
Webshell Detection & Vulnerability Scanning Toolkit β https://ordinarymantrying.com/tools/toolkit/toolkit-webshell-vuln.html