articles on Shelltrap

ClamAV alone is not enough for webshells

Fri, 04 Sep 2026 09:00:00 +0200

“We run ClamAV” is the most common answer to “what scans your customers’ files”, and it is a reasonable starting point. It is a poor finishing point, and the clearest statement of why comes from the ClamAV project itself.

ClamAV’s own framing

From the ClamAV documentation , verbatim:

CXS alternatives in 2026: the honest field guide

Fri, 04 Sep 2026 09:00:00 +0200

ConfigServer’s eXploit Scanner is the product most CyberPanel and cPanel operators used for this job, and it no longer exists. This is the field as it stands on 4 September 2026: what actually happened, what a stalled cxs installation means in practice, and what the replacements cost.

CXS is gone: what CyberPanel operators should do next

Fri, 04 Sep 2026 09:00:00 +0200

On 30 July 2025, Way to the Web Ltd published a short notice on its blog and on configserver.com. A month later the company was gone, and with it the commercial exploit scanner that a generation of hosting operators had installed as a matter of routine.

CyberPanel malware scanner setup with Shelltrap

Fri, 04 Sep 2026 09:00:00 +0200

CyberPanel ships no malware scanner of its own, and the documented alternatives all come with a condition. This guide is the practical path to a host-level scanner on a stock CyberPanel box, in the order we actually do it: nothing enforcing on day one, everything visible.

CyberPanel's security history, and what it teaches operators

Fri, 04 Sep 2026 09:00:00 +0200

CyberPanel is our beachhead, and it is also a product with a documented security history. Writing honestly about both is the only version of this article worth publishing — the panel is a distribution channel for us, not a target, and the operators reading this are the people who had to clean up after October 2024.

False positives on WordPress core, and what to do

Fri, 04 Sep 2026 09:00:00 +0200

Every discussion of malware scanners is about detection. Every actual deployment is about false positives, because that is the failure mode your customers experience. This article is about which files trip generic heuristics on a WordPress host, why that happens, and what the tuning path looks like.

fanotify vs inotify for file monitoring

Fri, 04 Sep 2026 09:00:00 +0200

If a scanner claims real-time detection, it is using one of two kernel interfaces, and the difference between them decides what it can promise. Both are documented in detail by the kernel’s own man pages, which is a pleasant change from a field where most architecture claims are marketing.

Find webshells on a CyberPanel server manually

Fri, 04 Sep 2026 09:00:00 +0200

This is the sweep we run before anything else when a CyberPanel host is suspected of hosting a webshell. Everything below uses tools that are already on the box. Everything below also has a limit, and the limits are the reason the article is longer than the command list.

GDPR and data residency in malware scanning

Fri, 04 Sep 2026 09:00:00 +0200

Buying a malware scanner is a data-protection decision as much as a security one, because the product’s job is to read every file your customers put on your server. Whether those bytes stay on the machine decides how much paperwork, and how much risk, comes with the purchase.

How the PHP upload gate works (auto_prepend_file)

Fri, 04 Sep 2026 09:00:00 +0200

The most useful moment to look at an uploaded file is before the application accepts it. At that point the file is still a temporary file, nothing has been moved into a document root, and refusing it costs one HTTP 403 instead of an incident.

How webshells get into WordPress uploads

Fri, 04 Sep 2026 09:00:00 +0200

Almost every webshell on a shared host arrives through the same short story: a plugin accepts a file it should have rejected, the file lands somewhere the web server will execute it, and an HTTP request turns it into a shell. The details are worth knowing, because each step has a different control.

Imunify360 vs Shelltrap on CyberPanel: a fair comparison

Fri, 04 Sep 2026 09:00:00 +0200

Both products scan a Linux hosting server for malware in real time. They are not the same purchase, and the differences that matter to a CyberPanel operator are not the ones on either vendor’s feature grid.

Linux Malware Detect (maldet) vs Shelltrap

Fri, 04 Sep 2026 09:00:00 +0200

Linux Malware Detect — maldet — is the default free answer to server-side malware scanning on Linux, and it deserves a fair hearing rather than a sales comparison. This article is mostly about the thing both products depend on and only one of them can control: the signature feed.

NIS2, GDPR and malware scanning for hosting providers

Fri, 04 Sep 2026 09:00:00 +0200

This article is not legal advice. It summarises published legal texts and official guidance with links to the primary sources so you can read them yourself. Whether any of it applies to your company, and what you must then do, is a question for your own counsel or data protection officer.

Quarantine or delete? Handling malware finds

Fri, 04 Sep 2026 09:00:00 +0200

Two buttons, one irreversible. The choice between quarantining and deleting a detected file looks like an operational preference and is actually a decision about evidence, about how you handle being wrong, and — in the EU — about what you will be able to put in an incident report.

Shared hosting: the cross-account risk

Fri, 04 Sep 2026 09:00:00 +0200

A customer reports a defaced site. You clean it, patch the plugin, rotate the passwords, and two days later it is back. The reason is usually not that you missed a file in that site. It is that you were looking at the wrong scope.

Shelltrap in report-only mode: the first week

Fri, 04 Sep 2026 09:00:00 +0200

This is what the first week with a host-level scanner actually looks like, taken from our own internal test stage on a production CyberPanel host on 3 September 2026 — not from a lab, and not from a slide.

Signed signature feeds explained

Fri, 04 Sep 2026 09:00:00 +0200

A signature feed is not data. It is a stream of matching logic that runs against every customer file on your server, and it arrives from outside your machine on a schedule. That makes it a supply chain, with the three failure modes every supply chain has: someone tampers with it, it silently stops, or a legitimate update turns out to be wrong.

The WordPress webshell wave, 2024–2026: what the data shows

Fri, 04 Sep 2026 09:00:00 +0200

WordPress runs 40.7% of all websites and 58.9% of sites whose CMS is known (W3Techs, checked 4 September 2026 — the two numbers are routinely conflated, so it is worth naming which one you mean). That share is why the file-upload bug in a form plugin is, from a hosting operator’s chair, an infrastructure problem rather than a customer problem — and why it landed on the desks of operators who had just lost their scanner, as we covered in what CXS operators should do next .

What is a webshell? A definition for hosting operators

Fri, 04 Sep 2026 09:00:00 +0200

Ask ten people what a webshell is and you get ten answers, most of them about a hacker in a hoodie. The useful definition is much more boring, and it comes from a neutral source: a webshell is a script placed in a directory your web server serves, which turns an HTTP request into a command on your machine.

What to ask a security vendor: DPA, EULA, exit

Fri, 04 Sep 2026 09:00:00 +0200

Buying a malware scanner used to be a technical decision with a purchase order attached. For a European hosting provider it is now a supply-chain decision with a documentation requirement attached, and the questions below are the ones we would want answered before signing — including about ourselves.

Why webshell detection belongs on the server, not the site

Fri, 04 Sep 2026 09:00:00 +0200

There is a dishonest version of this argument: plugin scanners are bad, buy a server scanner. A competent reader can dismantle it in a paragraph.

Wordfence vs a server-level scanner

Fri, 04 Sep 2026 09:00:00 +0200

This comparison has to start with a disclaimer, because the topic invites bad-faith versions of itself.

This is an architectural argument, not a quality one. Wordfence is a good product. It does things a server-side file scanner does not do at all: it filters requests with WordPress context, it maintains vulnerability intelligence about specific plugins, and it puts all of that in front of a site owner who has no shell access. Nothing below asserts that Wordfence does not work, and any comparison that did would be wrong.

WordPress backdoor removal: a server-side checklist

Fri, 04 Sep 2026 09:00:00 +0200

Most WordPress cleanups fail in one of two ways: the operator deletes the evidence before understanding it, or the operator cleans the site and not the account. This checklist is written for the host, where you can do both properly.