Eradication: Remove the Webshell

A PHP webshell was uploaded to a site's uploads directory. Remove it — surgically. The web root /var/www/html holds legitimate application files (index.php, config.php, assets) that MUST survive; only the malicious upload gets deleted.

The webshell lives under /var/www/html/uploads and is the file whose PHP executes attacker-supplied input (eval/system on $_POST/$_GET/$_REQUEST). Find it, confirm it, and delete just that file.

grep -rIlE 'eval\s\(|system\s\(|\$_(POST|GET|REQUEST)' /var/www/html

Grading checks the webshell is gone AND the legitimate site is intact — a blanket wipe of the web root fails.