Obfuscated PHP web shell dropped via Admin Menu Editor Pro plugin update

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•5

Detects obfuscated PHP code within the Admin Menu Editor Pro plugin, specifically targeting indicators associated with the supply chain compromise of versions 2.35 and 2.36. The rule searches for common PHP execution functions used in web shells within the context of the vulnerable plugin directory.