AES-256-CBC PHP webshell disguised as WP Settings Cache Layer

Arnold Chan@slaz

•updated Sep 5, 2026•1•0•4

Detects PHP scripts that masquerade as WordPress cache classes but contain functionality for decrypting commands using AES-256-CBC and executing them via shell_exec. The detection identifies the presence of hardcoded encryption keys, use of php://input, and common PHP obfuscation/encryption methods alongside shell execution functions.