Guides
WordPress backdoor removal: a server-side checklist
Cleaning a hacked WordPress site from the host, in order: preserve evidence, contain, inventory, check the neighbours, patch, and prove it stayed clean.
Security research
Articles
Sourced writing on webshells, server-side malware and the operational reality of defending shared hosting. Every factual claim carries a link to its primary source.