ShapedPlugin - PHP Backdoor Hash Validation

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•5

This rule identifies newly created PHP files within specific WordPress plugin folders ("woocommerce-subscription" or "woocommerce-notification") that have a rare SHA256 hash count (less than 5 occurrences in the enterprise). This behavior is indicative of web shells or backdoored plugin files, potentially introduced via a supply chain compromise.