What are shell.php and native.php file in Wordpres wp-includes folder

Some people get confused seeing these files under their website that are usually flagged by some Firewall or Scan software:

• /wp-includes/Text/Diff/Engine/shell.php
• /wp-includes/Text/Diff/Engine/native.php

How did those 2 files came?

Well, they came along with the WordPress installation. These files are included with WordPress and there is nothing to worry about. If you want to verify, just download WordPress installation file from its website and navigate to those directory and you will find them. You can match those files from your website and downloaded file for your satisfaction to make sure they are not modified. If it is different (unless you know it), then you can simply upload the downloaded one to replace current one.

What does Shell.php file do?

If you read the documentation, it clearly explains what it does:

Class used internally by Diff to actually compute the diffs. This class uses the Unix diff program via shell_exec to compute the differences between the two input arrays.

What about the Native.php file?

Here is the explanation for this one:

Class used internally by Text_Diff to actually compute the diffs. This class is implemented using native PHP code. The algorithm used here is mostly lifted from the perl module Algorithm::Diff (version 1.06) by Ned Konz, which is available at: http://www.perl.com/CPAN/authors/id/N/NE/NEDKONZ/Algorithm-Diff-1.06.zip

Hoping that makes some sense now and now you understand that your website is not hacked (that people usually think), but those are intentionally added by WordPress itself.