Regex Editor & Tester

Detects a specific obfuscated PHP web shell that hides within GIF89 image headers and uses chained encoding (base64, urldecode, htmlspecialchars_decode) to execute eval() payloads. Matches the characteristic pattern of a two-stage PHP payload with specific base64-encoded markers like 'ZXZhbCUyOCUyNyUzRiU' and 'P8v8EIsDAEOiuwNDEdcNDM'. Commonly found in backdoors injected into image uploads or PHP files.