PHP backdoors leave a hidden way back into a website.

A PHP backdoor is code planted on a website to preserve access after the first break-in. It can sit in a standalone webshell, a plugin, a theme or an injected WordPress hook, then act when a request, login or scheduled task reaches it.

compromised website
  -> planted PHP file, plugin or hook
  -> hidden request, login event or scheduled poll
  -> administrator session, credential log or file change
  -> backdoor remains in the site for the next request

Webshells and backdoor loaders

A webshell exposes a request-driven action through a PHP file. A backdoor loader can blend into WordPress and ask a controller for work. FleetSync reads its controller through eth_call, sends a site inventory and polls for tasks that execute supplied PHP or write files. Its ea_fleet_sync cron event keeps the polling routine scheduled, and its theme-writing task plants an autologin hook in functions.php. SC Backdoor reads controller addresses from Ethereum with selector 0x3bc5de30, generates administrator cookies and restores its plugin through planted files and database state.

SUGA Mini Uploader is a small upload webshell that prints CVE-UP and ALREADY markers above its form, which makes it easy to spot in a response.

The same habits reach servers that are not WordPress. A script run after gaining root on FreePBX servers adds several accounts with user ID 0, drops Base64-encoded PHP webshells, reinstalls itself from the root and asterisk crontabs and rc.local, stops fail2ban, turns off the FreePBX firewall with fwconsole firewall disable and fetches k.php from 111.223.32[.]50.

Small hooks can provide the same lasting access. FleetSync's // _ea_al snippet accepts ?al=true, selects an administrator or editor and grants a logged-in session. Another plugin creates an administrator, hides both the plugin and user, then sends the new credentials to a remote endpoint.

Hidden accounts and password logs

A hidden WordPress administrator can disappear from several views at once. The code we detect filters user queries, the REST API, XML-RPC, user sitemaps, the administrator list and the displayed account count. Checking only the Users screen can miss it.

We also match an authentication hook that records successful WordPress usernames and passwords in a file disguised as an image upload. The website can keep working normally while each valid login adds another line.

What we see across infected sites

Month	New sites
September	807
October	218
November so far	109

75% of the PHP-backdoor sites captured since 25 September run WordPress. Of those, 58% run WordPress 7.1. Of the 565 sites recaptured at least 25 days after their first match, 515 still served PHP-backdoor code (91%).

Finding and removing the planted code

Compare the entire site with trusted releases and a known-good deployment. Check:

• WordPress core, plugins, themes and must-use plugins for added PHP
• uploads for PHP files or files whose contents do not match their extension
• scheduled events such as ea_fleet_sync, theme files, wp-config.php and server configuration
• // _ea_al autologin hooks in every installed theme's functions.php
• administrator and capability records directly in the database
• plugins that disappear from the normal plugin list
• login hooks that write usernames or passwords into uploads
• unexpected PHP source printed into an HTML response

Remove every copy of the backdoor and restore changed files from trusted sources. Review site and hosting users, rotate WordPress and hosting credentials, invalidate active sessions, clear caches and inspect adjacent sites under the same hosting account.