ShapedPlugin - PHP Backdoor Modified by Unusual Process

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•2

Detects if 'install-persistent.php' or 'class-wc-subscription-diagnostics.php' files are modified by tools like powershell.exe, certutil.exe, or cmd.exe, indicating potential alternative persistence methods or backdoor installation.