Shelltrap

Moving from CXS to Shelltrap

Mon, 01 Jan 0001 00:00:00 +0000

What actually changed

ConfigServer eXploit Scanner was, for a long time, the pragmatic answer for operators who wanted server-side malware scanning without a per-account enterprise licence. Its vendor, Way to the Web, has discontinued sales. It was sold as a one-time licence per server (configserver.org , checked 4 September 2026), which is exactly why so many hosts still have it installed and running.

Nothing breaks the day sales stop. That is the trap. A scanner that no longer receives new signatures does not go red — it goes on reporting clean, with steadily less right to. The decay is invisible until the day somebody else finds the shell for you.

Imprint

Mon, 01 Jan 0001 00:00:00 +0000

shelltrap.com and the Shelltrap software are operated and published by Panomity GmbH. The disclosure below applies to this website and to the Shelltrap product.

Information according to § 5 TMG

Panomity GmbH Seilergasse 34 D-85570 Markt Schwaben

Commercial register: HRB 264411 Register Court: Munich Local Court — Register Court —

Represented by: Sascha Endlicher, M.A.

Contact

Phone: +49 8121-7607887 Fax: +49 8121-7607920 E-mail: hallo@panomity.de

Security reports: security@shelltrap.com

Sales tax ID

Sales tax identification number according to §27 a sales tax law: DE324810080

Installation and first run

Mon, 01 Jan 0001 00:00:00 +0000

Requirements

Root access, or a package service account with full installation rights. The broker shelltrapd runs as root; the worker runs as shelltrap-scan, a system user without a login shell and without a home directory.
A supported CyberPanel operating system: Ubuntu 20.04, 22.04 or 24.04; AlmaLinux, RockyLinux or RHEL 8, 9 or 10; CloudLinux 8; CentOS 9. Debian is only third-party supported by CyberPanel and is not promised.
A Linux filesystem under the configured customer roots (/home by default), enough memory, and a kernel on which the installer can actually probe the fanotify and file-handle capabilities.
For the Full profile: at least 1.5 GiB of MemAvailable remaining after the measured reload reserve, which includes the observed clamd footprint plus a fixed safety margin. This measurement must not be replaced by a global sysctl change.
For ClamAV in the Full profile: a running or installable clamd and a Unix socket reachable by the shelltrap-scan user, /run/clamav/clamd.ctl by default. A socket readable only by root is not enough. If the service or the worker’s access is unavailable, the state becomes degraded and never clean.
For the PHP upload adapter: a supported lsphp/LSWS installation. The adapter needs only the local socket /run/shelltrap/upload.sock.
Tools: sha256sum, GnuPG and either curl or wget for the host installer; unzip in addition for the CyberPanel package. The native package manager resolves dependencies.

Host preflight

Before any download, the host installer prints read-only facts about the machine and changes nothing:

How real-time file detection works

Mon, 01 Jan 0001 00:00:00 +0000

The problem with scheduled scanning

A cron job that walks /home at three in the morning has one virtue: it is simple. Everything else about it is a compromise.

A webshell uploaded at 09:15 has eighteen hours to be used before anything notices. In those eighteen hours it can be used to send mail, host a phishing page, pivot to another account or install a second backdoor somewhere the next scan will not look. By the time the scan reports, the file it finds is often not the interesting one any more — it is the one the attacker left behind on purpose.

Configuration and policies

Mon, 01 Jan 0001 00:00:00 +0000

The policy model

Every setting that steers behaviour is a policy on three levels:

global — the whole host
account — one CyberPanel user
domain — one website or child domain

The more specific level wins, and each level may inherit or override individual keys. Inside a domain there can also be path rules using globs relative to the document root.

Assignment works through a document-root index the broker keeps from the CyberPanel database (website, child domain, document root, owner), refreshed on a timer and on panel changes. fanotify events are mapped to an account and a domain by the longest matching document-root prefix. The PHP adapter passes DOCUMENT_ROOT and SERVER_NAME; the document root decides and the server name is only used as a plausibility check. Files outside every document root — mail, backups, the home root — fall under the account policy.

Privacy statement

Mon, 01 Jan 0001 00:00:00 +0000

This statement covers two separate things, and it is worth keeping them apart:

This website, shelltrap.com — what happens when you read these pages.
The Shelltrap software — what the program on your own server transmits, and what it never transmits.

1. Controller

Panomity GmbH Seilergasse 34, 85570 Markt Schwaben, Germany Phone +49 8121-7607887 · hallo@panomity.de Represented by the managing director Sascha Endlicher, M.A. Register court Amtsgericht München, HRB 264411 · VAT ID DE324810080

How a synchronous upload gate works

Mon, 01 Jan 0001 00:00:00 +0000

The window you are trying to close

An attacker uploads a file through a vulnerable plugin at 09:15:02 and requests it at 09:15:04. Two seconds. Any detection mechanism with a latency longer than that has, in this case, documented an incident rather than prevented one.

Asynchronous detection is genuinely valuable — most compromises are not exploited within seconds, and finding the shell in five seconds instead of eighteen hours changes everything about the cleanup. But if you want to stop the upload, the check has to happen while the request is still in flight.

The CyberPanel plugin

Mon, 01 Jan 0001 00:00:00 +0000

Before you install

The Shelltrap broker must be running, /run/shelltrap/api.sock must exist, and CyberPanel must be installed. The plugin archive is built reproducibly and contains a single top-level directory shelltrap/, without caches or Python bytecode.

cd /usr/local/CyberCP
/usr/local/CyberCP/bin/python /usr/local/CyberCP/pluginInstaller/pluginInstaller.py \
 install --pluginName shelltrap

Why the install is so careful

The CyberPanel installer patches core files — CyberCP/settings.py, CyberCP/urls.py and the sidebar template — by inserting lines, and its hook calls use subprocess.call and ignore exit codes. A failed preflight therefore cannot stop the installation from claiming success.

Terms of business

Mon, 01 Jan 0001 00:00:00 +0000

The binding documents

A contract for Shelltrap is concluded in our shop and client area at shop.shelltrap.com . The documents shown and accepted there during checkout are the binding ones:

the general terms and conditions (Allgemeine Geschäftsbedingungen) of Panomity GmbH,
the licence terms for the Shelltrap software, of which an extract is published at licence terms ,
the product description and price as displayed at the moment of ordering.

If anything on this website contradicts those documents, those documents apply. If you would like to read them before you start an order, ask us and we will send them: hallo@panomity.de .

Licence terms (extract)

Mon, 01 Jan 0001 00:00:00 +0000

1. What is licensed

Shelltrap is proprietary software of Panomity GmbH. What is delivered is:

compiled, stripped Go binaries (the broker, the scanner worker and the CLI),
the thin PHP upload adapter,
the CyberPanel plugin (Python),
the packaged configuration, systemd units, documentation and public keys.

No source code is delivered. There is no source escrow arrangement in the standard licence.

2. Scope of the licence

A licence entitles you to install and operate the software on one server, for an unlimited number of domains, child domains and accounts on that server. The licence is bound at activation to a server fingerprint derived from /etc/machine-id; the standard licence permits one simultaneous activation.

Signature feeds

Mon, 01 Jan 0001 00:00:00 +0000

Nothing is activated that has not been signed, verified twice, gated against a known-good and a known-bad corpus, and made revocable.

Generations, not updates

A rule set is not a stream of edits; it is a generation: an immutable, signed directory. Vendor generation IDs are exactly YYYYMMDDTHHMMSSZ-NNNN, for example 20260903T120000Z-0001. Local overlays use local-<64 hex characters>.

Licensing and activation

Mon, 01 Jan 0001 00:00:00 +0000

The pieces

Term	Meaning
Licence key	`STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX` — Crockford Base32, 25 payload characters including two check characters. Generated when the licence is created and returned in clear text exactly once; the service stores only `sha256(key)` plus the first nine characters as a display prefix.
Licence	The record: plan, maximum servers (1 by default), status (`active`, `suspended`, `terminated`), expiry, and the link to your account.
Activation	Binding a licence to a server fingerprint. At most `max_servers` at a time; `deactivate` frees a slot.
Licence token	An Ed25519-signed document the daemon verifies offline.
Server fingerprint	`sha256` over a fixed prefix and the contents of `/etc/machine-id`. The hostname is sent for information only.

Activation

shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
shelltrap license status
shelltrap license renew
shelltrap license deactivate

The token lands in /etc/shelltrap/license.token, root, mode 0600. The key itself is stored only as a prefix in /etc/shelltrap/license.key, also 0600, so renewals do not need you to type it again. If you would rather not have the key on the server at all, delete that file and renew manually.

Hash sets

Fri, 04 Sep 2026 12:00:00 +0200

Shelltrap ships two kinds of hash data in every signed generation:

Known-bad hashes (hashes/*.hsb): exact SHA-256 matches of confirmed malware. A match produces a malicious verdict with confidence 100.
Allow sets (allow/*.sha256): SHA-256 hashes of verified files, currently the WordPress core files of supported releases downloaded from wordpress.org and hashed by Panomity. A match suppresses heuristic signals for that file; signature and ClamAV hits still take precedence.

Hashes are data, not works; the allow sets are published under the MIT license by Panomity GmbH. False positives or missing versions: hallo@panomity.de .

Heuristics engine

Fri, 04 Sep 2026 12:00:00 +0200

The heuristics engine (shelltrap:heuristics-v1, proprietary, Panomity GmbH) scores files by combining independent signals: request-driven command execution, dynamic eval/assert, encoded payload layers, escape density, entropy and long lines.

Weak statistical signals (entropy, long lines) never produce a suspicious verdict on their own; minified bundles and caches stay clean.
Documented library files (PHP tag first, a @package/@license docblock in the first 2 KiB, no eval/base64_decode/gzinflate) are held below suspicious even with escape-heavy code.
Verified WordPress core files are cleared by the allow sets before heuristics run.
Per domain, heuristics.action can be set to report, quarantine or off, and heuristics.threshold raises the bar for suspicious findings.

Report false positives with finding ID and file hash to hallo@panomity.de .

Known webshell families

Fri, 04 Sep 2026 12:00:00 +0200

Signature strings of well-known PHP webshells (c99, r57, b374k, WSO, FilesMan, p0wny), spam mailers and back-connect helpers. Every rule requires PHP context and at least two independent indicators.

Source file: panomity_known_shells.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_Shell_C99`	92	c99 PHP webshell family markers
`Panomity_Shell_R57`	92	r57 PHP webshell family markers
`Panomity_Shell_B374k`	92	b374k PHP webshell family markers
`Panomity_Shell_WSO`	90	WSO (Web Shell by oRb) family markers
`Panomity_Shell_FilesMan`	88	FilesMan file-manager webshell module marker
`Panomity_Shell_P0wny`	92	p0wny-shell single-file PHP shell markers
`Panomity_Shell_Generic_Mailer_Spam`	86	Bulk mailer spam kit markers (leaf/inbox mailer style), distinct from legitimate mail libraries
`Panomity_Shell_Generic_Uname_Backconnect`	87	Generic PHP shell exposing a back-connect helper driven by request input

Reporting a false positive

Send the finding ID, the rule name and, if possible, the file (or its SHA-256) to hallo@panomity.de or open a ticket in the client area . Confirmed false positives are fixed in the next signed generation; clients receive it automatically.

PHP obfuscation rules

Fri, 04 Sep 2026 12:00:00 +0200

Loader and obfuscation patterns: eval/base64 chains, assert and create_function loaders, preg_replace /e, str_rot13/gzinflate layers, hex and chr escape chains, goto obfuscation.

Source file: panomity_php_obfuscation.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Eval_Base64_Chain`	90	eval() applied directly to a decode/inflate call, the classic packed PHP shell loader
`Panomity_PHP_Assert_Superglobal_Loader`	90	assert() used as a code-execution sink over request input
`Panomity_PHP_Assert_Decode_Loader`	88	assert() applied to a decode/inflate call used as an eval substitute
`Panomity_PHP_CreateFunction_Loader`	87	create_function() lambda body built from request input or a decode call
`Panomity_PHP_PregReplace_E_Modifier`	88	preg_replace() with the deprecated /e modifier, a code-execution primitive in old PHP shells
`Panomity_PHP_StrRot13_GzInflate`	90	Stacked str_rot13/gzinflate/base64 decode layers wrapping an executable payload
`Panomity_PHP_Hex_Escape_Chain`	85	PHP file whose executable identifiers are hidden as long \x hex escape runs
`Panomity_PHP_Chr_Concat_Chain`	85	PHP identifier assembled from a long chr() concatenation chain
`Panomity_PHP_Goto_Obfuscation`	85	PHP file flattened with many goto jumps to random labels, typical of automated shell packers
`Panomity_PHP_Concat_Eval_Obfuscation`	86	eval/assert identifier split across string concatenation to evade naive scanners
`Panomity_PHP_Variable_Function_Superglobal`	89	Variable-function dispatch where both callable and argument come from request input

Reporting a false positive

PHP remote code execution patterns

Fri, 04 Sep 2026 12:00:00 +0200

Direct command execution driven by request data: system/exec/passthru/shell_exec with superglobals, backtick execution, proc_open pipes and similar.

Source file: panomity_php_rce.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Superglobal_Command_Exec`	90	OS command function fed directly from request input, including whitespace-padded variants
`Panomity_PHP_Superglobal_Eval`	90	eval() executed directly on request input
`Panomity_PHP_Backticks_Superglobal`	88	Shell backtick execution of request input inside a PHP file
`Panomity_PHP_Base64_Superglobal_Exec`	87	Command/eval sink taking base64_decode() of request input
`Panomity_PHP_Image_Polyglot_PHP_Payload`	90	Image file (JPEG/PNG/GIF/ICO magic) carrying an executable PHP payload appended to the pixels
`Panomity_PHP_Preg_Replace_Superglobal`	86	preg_replace() whose subject or replacement is request input combined with the /e modifier

Reporting a false positive

WordPress-specific droppers

Fri, 04 Sep 2026 12:00:00 +0200

Backdoors that hide inside WordPress structures: PHP in uploads, fake wp-config includes, mu-plugins backdoors, fake plugin headers with curl/eval, appended eval in index.php.

Source file: panomity_wordpress_droppers.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_WP_Uploads_PHP_Dropper`	88	PHP file dropped into wp-content/uploads that writes another PHP payload
`Panomity_WP_Config_Fake_Include`	87	Fake wp-config style loader that includes and evaluates a hidden payload file
`Panomity_WP_MuPlugins_Backdoor`	90	mu-plugins auto-loaded backdoor combining add_action with dynamic code execution on request input
`Panomity_WP_Fake_Plugin_Header_Backdoor`	89	File carrying a WordPress plugin header while fetching and evaluating remote code
`Panomity_WP_Index_Appended_Eval`	86	WordPress bootstrap file with an appended eval loader over request input

Reporting a false positive

ClamAV alone is not enough for webshells

Fri, 04 Sep 2026 09:00:00 +0200

“We run ClamAV” is the most common answer to “what scans your customers’ files”, and it is a reasonable starting point. It is a poor finishing point, and the clearest statement of why comes from the ClamAV project itself.

ClamAV’s own framing

From the ClamAV documentation , verbatim:

CXS alternatives in 2026: the honest field guide

Fri, 04 Sep 2026 09:00:00 +0200

ConfigServer’s eXploit Scanner is the product most CyberPanel and cPanel operators used for this job, and it no longer exists. This is the field as it stands on 4 September 2026: what actually happened, what a stalled cxs installation means in practice, and what the replacements cost.

CXS is gone: what CyberPanel operators should do next

Fri, 04 Sep 2026 09:00:00 +0200

On 30 July 2025, Way to the Web Ltd published a short notice on its blog and on configserver.com. A month later the company was gone, and with it the commercial exploit scanner that a generation of hosting operators had installed as a matter of routine.

CyberPanel malware scanner setup with Shelltrap

Fri, 04 Sep 2026 09:00:00 +0200

CyberPanel ships no malware scanner of its own, and the documented alternatives all come with a condition. This guide is the practical path to a host-level scanner on a stock CyberPanel box, in the order we actually do it: nothing enforcing on day one, everything visible.

CyberPanel's security history, and what it teaches operators

Fri, 04 Sep 2026 09:00:00 +0200

CyberPanel is our beachhead, and it is also a product with a documented security history. Writing honestly about both is the only version of this article worth publishing — the panel is a distribution channel for us, not a target, and the operators reading this are the people who had to clean up after October 2024.

False positives on WordPress core, and what to do

Fri, 04 Sep 2026 09:00:00 +0200

Every discussion of malware scanners is about detection. Every actual deployment is about false positives, because that is the failure mode your customers experience. This article is about which files trip generic heuristics on a WordPress host, why that happens, and what the tuning path looks like.

fanotify vs inotify for file monitoring

Fri, 04 Sep 2026 09:00:00 +0200

If a scanner claims real-time detection, it is using one of two kernel interfaces, and the difference between them decides what it can promise. Both are documented in detail by the kernel’s own man pages, which is a pleasant change from a field where most architecture claims are marketing.

Find webshells on a CyberPanel server manually

Fri, 04 Sep 2026 09:00:00 +0200

This is the sweep we run before anything else when a CyberPanel host is suspected of hosting a webshell. Everything below uses tools that are already on the box. Everything below also has a limit, and the limits are the reason the article is longer than the command list.

GDPR and data residency in malware scanning

Fri, 04 Sep 2026 09:00:00 +0200

Buying a malware scanner is a data-protection decision as much as a security one, because the product’s job is to read every file your customers put on your server. Whether those bytes stay on the machine decides how much paperwork, and how much risk, comes with the purchase.

How the PHP upload gate works (auto_prepend_file)

Fri, 04 Sep 2026 09:00:00 +0200

The most useful moment to look at an uploaded file is before the application accepts it. At that point the file is still a temporary file, nothing has been moved into a document root, and refusing it costs one HTTP 403 instead of an incident.

How webshells get into WordPress uploads

Fri, 04 Sep 2026 09:00:00 +0200

Almost every webshell on a shared host arrives through the same short story: a plugin accepts a file it should have rejected, the file lands somewhere the web server will execute it, and an HTTP request turns it into a shell. The details are worth knowing, because each step has a different control.

Imunify360 vs Shelltrap on CyberPanel: a fair comparison

Fri, 04 Sep 2026 09:00:00 +0200

Both products scan a Linux hosting server for malware in real time. They are not the same purchase, and the differences that matter to a CyberPanel operator are not the ones on either vendor’s feature grid.