A web shell is a malicious script placed on a web server that gives an attacker a way to run commands or manage files on that server through ordinary web requests. It is typically written in a language the server already supports, such as PHP, so it can look like any other page or script in the web root.
Attackers usually plant a web shell after gaining some initial foothold, for example through a vulnerability that allows file uploads or code execution. Its purpose is persistence: once it is in place, the attacker can come back later without needing to exploit the original flaw again. Depending on the permissions of the web server account, a web shell may be able to read application files, reach databases and credentials, and serve as a base for further activity.
Patching and compromise are separate questions. Installing a fix closes the vulnerability but does not remove a web shell that was already uploaded. Equally, running a vulnerable version is not proof that a web shell exists; only evidence found on the system, such as an unexpected script or suspicious log entries, can show that.
After patching, review web-accessible directories for unfamiliar or recently modified scripts, compare deployed files against a known-good copy or source repository, and check web server and application logs for unusual requests. Limit write access to web directories where practical. If a web shell is confirmed, treat the system as compromised: preserve evidence, rotate any credentials the server could access, and rebuild from clean sources rather than only deleting the file.