On 2025 Way to the Web Ltd shut down, and with it went support for cxs (ConfigServer eXploit Scanner) – a tool I’d been using for years on the servers I manage. cxs combined heuristic exploit detection, ClamAV-backed virus scanning, and a CSF firewall hook that auto-banned IPs behind malicious uploads. It was proprietary and obfuscated, and now even its own licensing server is offline.

Instead of looking for a commercial replacement, I decided to build my own, open-source. That’s how OpenXS started.

What it is

OpenXS’s core idea isn’t to build yet another scanner from scratch, but to act as a harness around existing, actively-maintained open-source projects – YARA (via a fork of php-malware-finder), ClamAV, maldet, CSF – giving them a common UX, unified reporting, quarantine and management, instead of each living separately with its own interface. A Python daemon keeps the YARA ruleset compiled in memory and answers scan requests over a Unix socket, so an upload doesn’t pay the cost of recompiling the ruleset on every single request.

What it does

• YARA-based detection of obfuscated PHP, webshells and known exploit patterns
• ClamAV and maldet (Linux Malware Detect) as additional, independent detectors
• version checks (WordPress core, Composer packages, pending apt security updates)
• file integrity monitoring with a SHA-256 baseline of a configurable list of important files
• “unknown core file” detection – a file under wp-admin/wp-includes that isn’t part of the installed WordPress version’s own official distribution at all, telling apart a simple leftover from an incomplete upgrade from something genuinely unexpected
• a “repair” action that replaces a modified, known file (WordPress core/plugin, Composer package, Drupal core) with its official pristine content, backed up to quarantine first
• database content scan – scans the database’s own content (WordPress, Joomla/Mambo, Drupal 7) with the same YARA ruleset, for compromises that live entirely inside the database without ever touching a file
• real-time upload blocking via a mod_security hook, before the web server even accepts the file
• automatic CSF ban on IPs behind confirmed malicious uploads
• a Webmin module for the dashboard, scan history, quarantine management, and one-click installers

Where it stands now

The project is still early-stage, but it’s already running in production on several of the servers I manage. The code is MIT licensed and public on GitHub:

https://github.com/mrpc/OpenXS

If you also manage Linux web hosting servers and were looking for a cxs replacement (or you’re just curious), take a look – issues, feedback and pull requests are always welcome.