How to protect your website from AI attacks (PHP2Shell)

You are a web security analyst. This folder is a copy of my [PLATFORM] website, version [PLATFORM VERSION], downloaded today. The server ran PHP [PHP VERSION]. It may have been attacked through PHP2Shell (CVE-2026-109618, CVE-2026-109619). Attacks were seen from 17 October 2026 and the flaw was known to researchers from 1 August 2026.

Read only. Do not change, delete or run any file in this folder. Put any notes or downloads outside it.

0. First compare every file with the official published checksums for this exact version of [PLATFORM] and of each plugin, theme or package, and treat a file that matches as official.

Find:
1. PHP files in folders that should only hold uploads, images, cache or temp files.
2. Hidden or scrambled code: eval, assert, base64_decode, gzinflate, gzuncompress, str_rot13, strrev, hex or char-code strings, preg_replace with /e, create_function, very long single lines of encoded text.
3. Code that runs system commands: system, exec, shell_exec, passthru, proc_open, popen, pcntl_exec, backticks.
4. Code that takes input from $_GET, $_POST, $_COOKIE, $_REQUEST, $_FILES or php://input and passes it to anything in 2 or 3, or writes it to a file.
5. Files changed on or after 1 August 2026, and files with names that imitate real files (wp-1ogin.php, index.php.bak, .cache.php).
6. Changes in .htaccess, .user.ini, php.ini, and any auto_prepend_file or auto_append_file setting.
7. Code that creates admin users, sends data to outside URLs, or adds scheduled tasks.

For each finding give: file path, line number, what the code does in plain English, risk (high, medium, low), and whether it is part of the official [PLATFORM] release.
End with: a list of files to delete, a list of files to replace with a fresh official copy, and what you could not check.

This WordPress site runs WooCommerce and takes payments. Also check:
1. Any JavaScript added to the checkout or cart pages, in theme files, plugin files or inline, that reads card fields or sends form data to a domain that is not my payment provider ([PROVIDER], e.g. Stripe or PayPal).
2. Any change in the payment gateway plugin files compared to the official release.
3. Code that copies orders, customer emails or addresses to a file or an outside URL.

Now check what is special to Joomla:
1. Compare the folders administrator, components, includes, libraries, modules and plugins with the official Joomla release of the same version. List every file that is added or different.
2. List every .php file inside images, media, tmp and cache. There should be none.
3. Read index.php of every template in templates/ for remote scripts or hidden code.
4. List every extension folder, with its version. Mark any that are not in the Joomla Extensions Directory.