Malware in PHP apps

PHP malware is unwanted PHP code that gives someone else control of your site. On our shared and VPS plans it often shows up as a webshell in uploads, a prepend line in .htaccess, an extra admin user, or a cron job that hits a .php file under /tmp. A clean scanner result only means no known signature matched. It does not prove the account is safe, especially after a stolen password.

Check users, cron, and .htaccess before files

Start with access paths that survive a single file delete. In WordPress, open the users list and look for an administrator you did not create. That account is often how they return after you remove a shell. Review crontab and the cPanel cron list for any curl or wget to a raw PHP URL. Open .htaccess for auto_prepend_file or a RewriteRule that points into uploads. Then review Imunify’s quarantine list. Only after that should you search for recently changed PHP under wp-content/uploads, which should not hold PHP at all.

Do not restore quarantined uploads/*.php because the site “needed them.” Those files were not part of your theme. If a plugin truly required PHP inside uploads, that plugin is part of the problem as well.

Stolen admin access is not a malware signature

Imunify catches many known payloads. A quiet login with a reused password leaves nothing for it to quarantine. Rotate cPanel, FTP, WordPress, database, registrar, mail, and any Git credentials. End active sessions. Then decide whether a JetBackup restore from a date before the odd admin appeared is safer than piecemeal edits. Reinstalling WordPress over the files alone misses wp-config, .htaccess, cron, and users, so that is not a full clean.

Clean up, then harden what they used

On a VPS, turn off services you do not use so the next foothold is smaller. On shared hosting, unused PHP in uploads is effectively a service you never meant to run. After cleanup, set directories to 755 and files to 644, disable xmlrpc if you do not need it, and turn on two-factor authentication where you can. A second scanner pass is useful. It still does not replace removing a stranger still listed in wp_users.

WP Toolkit’s WordPress Users list is faster than phpMyAdmin for spotting a random admin. Sort by registered date, remove the account you do not recognize, and still rotate the remaining admins in case they shared the same password. Check mu-plugins too. A dropped PHP file there loads on every request and is easy to miss when scans focus only on uploads.