Shelltrap is a webshell scanner for CyberPanel servers with OpenLiteSpeed. It monitors file events, scans locally and can quarantine malicious files. This article explains how scanning, upload checks and recovery work together, and how to start with reporting before enabling intervention.
We did not build it because the market lacks security products, but because the tool that did this job on our own machines was discontinued and nothing officially supported took its place.
Why now
On 30 July 2025, ConfigServer published an announcement on its blog. The archived copy of that page reads:
Way to the Web Ltd and Configserver.com will be closing down permanently on 31 August 2025. The server software market has changed drastically in the more than 25 years since our company began, and we now find the business is no longer profitable so must come to an end.
This was an orderly wind-down, announced a month ahead with a detailed FAQ, by a company that had served hosting for over two decades. The FAQ is equally precise about ConfigServer eXploit Scanner (cxs): after 31 August 2025 there are no downloads, no support, no licence IP changes and no further updates to the cxs fingerprint database.
The free firewall, csf, was picked up by the community and continues as a maintained fork; the commercial scanner did not get that second life. A cxs install still runs, but on signatures frozen in August 2025 and a licence that cannot follow the machine to a new IP address.
The problem it was bought for is unchanged:
- Sucuri’s 2023 Hacked Website Report, the last edition with cleanup data, found that in 2023 49.21 % of compromised websites contained at least one backdoor at the time of infection.
- Patchstack’s State of WordPress Security in 2026 counted 11,334 new WordPress-ecosystem vulnerabilities in 2025, 46 % of them unpatched at disclosure, and measures a weighted median time to first exploit of five hours.
- MITRE ATT&CK files the result under T1505.003, web shell as a persistence technique, whose Linux detection analytic starts with an unauthorised script appearing in the web directory.
CyberPanel operators have an extra gap: the panel ships no malware scanner of its own. Its knowledge base states that Imunify360 “is available with CyberPanel v2.0.0, but before using it you need to convert your operating system to CloudLinux OS“, and Imunify’s ImunifyAV documentation lists cPanel, Plesk and DirectAdmin as supported panels; CyberPanel is not among them. ClamAV and maldet are free and many people run something unofficially, but a stock Ubuntu or AlmaLinux box has no officially supported real-time option.
How it works
Shelltrap runs below the application: it installs nothing inside WordPress and is unaffected if a site’s own security plugin is disabled or quietly renamed.
The kernel does the watching
Shelltrap uses fanotify, which the kernel manual describes as “notification and interception of filesystem events” with the ability, unlike inotify, to “monitor a whole directory tree in a race-free manner”: one mark per mount instead of one watch per directory. A file closed after writing, moved into place or made executable gets scanned.
A root broker that cannot parse anything
fanotify needs CAP_SYS_ADMIN, and the manual page warns plainly about handing out file descriptors at that privilege level, so Shelltrap splits in two. The root broker holds the fanotify groups, opens files safely, runs quarantine transactions and serves the local API — and contains no parsers at all: no YARA, no ClamAV code, no archive or ELF parsing. The scanning worker runs as its own system user without network access, in its own mount and PID namespaces, constrained by seccomp, rlimits and Landlock, and gets nothing but a read-only descriptor. The code that touches attacker-controlled bytes has the fewest rights.
Four engines produce one verdict: ClamAV over the clamd socket, YARA 4.5 with rules precompiled for that engine version, SHA-256 hash sets with a known-good allowlist for WordPress core and common plugins, and heuristics — obfuscation markers, PHP in upload directories, .htaccess and .user.ini handler tricks. A heuristic finding needs several independent signals, scored individually so an administrator can see why. Verdicts are clean, suspicious, malicious, unscanned or degraded; a file that could not be scanned is never shown as clean.
The upload gate
Detection on write still happens after the write. For web uploads, Shelltrap closes that window: a small PHP prepend runs before any application code, does nothing unless the request carries an upload, passes the temporary descriptors to the broker and waits up to two seconds. A malicious upload gets a 403. On timeout the request goes through — fail-open by default, configurable per domain, because a scanner that takes a shop offline is the worse outage.
Policies, quarantine, signed feeds
- Policies per domain. Global, account and domain level, most specific wins. Hash, signature and heuristic findings report or quarantine independently, and heuristics default to report — watch a real week of traffic before letting anything act.
- Quarantine as a transaction. Copy by descriptor, compare hashes, fsync, publish atomically, then unlink the original after re-checking inode and hash. Restore puts back owner, mode, timestamps, ACLs, xattrs and SELinux context. Every action lands in a hash-chained audit log.
- Signed feeds. Each signature generation is Ed25519-signed with provenance per rule (source, commit, licence, author), passes a corpus gate, reaches canaries first and rolls back automatically on a quarantine storm.
- Alerts. Mail to the administrator at once on a malicious verdict, a digest for suspicious findings, health and metrics output, a JSON CLI, and a CyberPanel plugin the scanner can run without.
What we do not claim: fanotify’s queue can overflow — “The event queue can overflow. In this case, events are lost.” Real-time watching alone is no guarantee, so Shelltrap counts overflows, alarms, schedules a reconciliation scan and runs full sweeps anyway. In an unprivileged container it falls back to inotify and a crawler, and says so.
Made in Bavaria, processed in Germany
Panomity GmbH sits in Markt Schwaben east of Munich, and Shelltrap is developed here. The data protection story is deliberately short: the described scan keeps customer files on the server. Scanning is local: no cloud upload, no automatic sample submission. The only outbound connections are signature updates and licence checks, and both talk to Panomity servers in Germany. Nothing depends on a transfer to a third country, which can simplify the processing documentation and gives the question every agency eventually asks a simple answer: nowhere.
What it costs, and how to start
Shelltrap costs 14.90 EUR per month or 149.00 EUR per year per server, gross, including VAT. One licence covers one server with unlimited domains. Packages are deb and rpm for Ubuntu 22.04 and 24.04 and AlmaLinux 8, 9 and 10; the CyberPanel plugin installs from a ZIP, and the licence is activated with one command, shelltrap license activate.
Our advice for week one is unspectacular: run it in report-only mode, see what your own servers produce, then let it act. Order Shelltrap, or read the technical detail at shelltrap.com. Moving a fleet off cxs, or need the data processing agreement first? Write to hallo@panomity.de.
0 Comments