[vsilent]

What

Adds PHP webshell detection to stackdog, for PHP apps on the host and in containers. The response is alert + IP ban only; files and containers are not quarantined.

• File scan (src/detectors/php_shell/). Each sniff pass scores PHP files under host web roots (STACKDOG_PHPSHELL_PATHS) and under the docroots of PHP-looking containers (bind mounts plus overlay MergedDir, read through STACKDOG_HOST_ROOT). Results are cached by size/mtime in php_shell_scans. A file scoring ≥3 gives php.shell-file, which alerts and never bans.

• Signatures: built-in weighted rules, plus extra rules loaded from JSON (STACKDOG_PHPSHELL_SIGNATURES) without a rebuild.

• Access-log detector web.php-shell-access, which bans through the existing IpBanEngine gate (allowlist, protected local IPs, rate cap). It fires on:

  • a request to a flagged upload whose URL goes through uploads/;
  • a request with parameters to a flagged file that is not a common entry point;
  • a POST to PHP under an uploads/ URL.

  A plain visit to an infected page gives php.shell-request, which alerts and never bans.

• Config: STACKDOG_PHPSHELL_ENABLED=false turns off both the scan and the access-log detector.

• Docs: README section, CHANGELOG, .env.sample, and a commented /:/host:ro mount in docker-compose.yml.

• Website: new /php-shell-detection page, a home feature card and FAQ entry, a footer link, the sitemap entry, and the new env vars on the docs page.

Commit c6caac4 fixes five findings from an earlier code review:

• suffix matching banned site visitors;
• a file named webshell.php could pass the AI-phrase ban check;
• ENABLED=false left the access-log detector running;
• /images/, /files/ and /tmp/ URLs banned on POST;
• PATH_INFO and trailing-slash requests bypassed the detector.

Verification

• cargo test: 444 + 8 + 108 passed, 0 failed, 1 ignored (the corpus test, run manually via STACKDOG_PHPSHELL_CORPUS; 0 findings on 501 real PHP files).
• cargo clippy --all-targets -- -D warnings and cargo fmt --check: clean.
• cd website && npm run build: OK. The page was checked at 390px with no horizontal overflow.

Not verified yet (needs a Linux test host)

• Guess: the container MergedDir path is readable through STACKDOG_HOST_ROOT on a real overlay2 host. Only bind mounts are certain.
• An end-to-end iptables/nftables ban: drop a test shell into uploads/, request it 5 times from a non-allowlisted IP, then check stackdog firewall list.
• Only synthetic shell samples were tested, no real-world ones.

Out of scope

• The existing web.webshell-probe false positive on stacker agent long-poll logs is not fixed here.
• The eBPF "php-fpm spawns a shell" layer is planned, not implemented.

🤖 Generated with Claude Code