Trojanized Admin Menu Editor Pro plugin PHP web shell

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•4

Detects the presence of PHP web shell code within specific versions (2.35/2.36) of the Admin Menu Editor Pro plugin. This rule targets malicious files introduced via a supply chain compromise of the plugin's update distribution channel, specifically looking for common PHP obfuscation and execution functions associated with web shells.