Comparisons
ClamAV alone is not enough for webshells
ClamAV says so itself. What the engine covers, where PHP webshell detection actually comes from, and what a layered stack on a hosting server looks like.
Security research
Articles
Sourced writing on webshells, server-side malware and the operational reality of defending shared hosting. Every factual claim carries a link to its primary source.
Comparisons
CXS alternatives in 2026: the honest field guide
ConfigServer closed on 31 August 2025. What replaced cxs, what the options cost as at 4 September 2026, and what runs on a stock CyberPanel host.
Analysis
CXS is gone: what CyberPanel operators should do next
Way to the Web closed on 31 August 2025. csf survived via GPLv3 forks, cxs did not. What that means for a stock CyberPanel host, plus a checklist.
Guides
CyberPanel malware scanner setup with Shelltrap
Install a host-level malware scanner on a stock CyberPanel server: requirements, signed packages, report-only first, and per-domain policies.
Analysis
CyberPanel's security history, and what it teaches operators
Three pre-auth RCEs, a ransomware wave, a quiet 2025 and a busy 2026. What is verified about CyberPanel's incidents, and what host-level defence adds.
Guides
False positives on WordPress core, and what to do
Which WordPress files trip generic malware heuristics, why entropy alone is a bad signal, and how to tune a host-level scanner without going blind.
Guides
fanotify vs inotify for file monitoring
Two kernel APIs, two very different guarantees. What the man pages actually say about recursion, races, permission events and the caveats nobody quotes.
Guides
Find webshells on a CyberPanel server manually
A root-level triage playbook with find, grep, YARA and clamscan for CyberPanel hosts, including the honest limits of every one of those commands.
Compliance
GDPR and data residency in malware scanning
If your scanner uploads customer files, your vendor is a processor. What Art. 28 and 32 require, what BSI says about cloud detection, and what to ask.
Guides
How the PHP upload gate works (auto_prepend_file)
Scanning an upload before the application accepts it: the auto_prepend_file adapter, the socket protocol, the decisions it returns and why it fails open.
Guides
How webshells get into WordPress uploads
Arbitrary file upload, polyglots and .htaccess handler abuse: the routes a PHP backdoor takes into wp-content/uploads, and how to close them.
Comparisons
Imunify360 vs Shelltrap on CyberPanel: a fair comparison
CloudLinux requirement, panel support, pricing checked 4 September 2026, and the data-handling question every buyer should put to both vendors in writing.