When attackers exploit a vulnerability, they often drop a web shell — a hidden remote-control script that survives the patch. Here's what