{"id":1261,"date":"2026-10-26T19:03:31","date_gmt":"2026-10-26T17:03:31","guid":{"rendered":"http:\/\/mrpc.pramnos.net\/?p=1261"},"modified":"2026-10-26T19:33:48","modified_gmt":"2026-10-26T17:33:48","slug":"openxs-%ce%ad%ce%bd%ce%b1-open-source-exploit-scanner-%ce%b3%ce%b9%ce%b1-%cf%84%ce%bf%cf%85%cf%82-servers-%ce%bc%ce%bf%cf%85","status":"publish","type":"post","link":"https:\/\/mrpc.pramnos.net\/en\/2026\/10\/openxs-%ce%ad%ce%bd%ce%b1-open-source-exploit-scanner-%ce%b3%ce%b9%ce%b1-%cf%84%ce%bf%cf%85%cf%82-servers-%ce%bc%ce%bf%cf%85\/","title":{"rendered":"OpenXS: an open-source exploit scanner for my servers"},"content":{"rendered":"<p>On 2025 Way to the Web Ltd shut down, and with it went support for <a href=\"https:\/\/configserver.com\/\" target=\"_blank\" rel=\"noopener\">cxs (ConfigServer eXploit Scanner)<\/a> &#8211; a tool I&#8217;d been using for years on the servers I manage. cxs combined heuristic exploit detection, ClamAV-backed virus scanning, and a CSF firewall hook that auto-banned IPs behind malicious uploads. It was proprietary and obfuscated, and now even its own licensing server is offline.<\/p>\n<p>Instead of looking for a commercial replacement, I decided to build my own, open-source. That&#8217;s how <a href=\"https:\/\/github.com\/mrpc\/OpenXS\" target=\"_blank\" rel=\"noopener\">OpenXS<\/a> started.<\/p>\n<h3>What it is<\/h3>\n<p>OpenXS&#8217;s core idea isn&#8217;t to build yet another scanner from scratch, but to act as a harness around existing, actively-maintained open-source projects &#8211; YARA (via a fork of php-malware-finder), ClamAV, maldet, CSF &#8211; giving them a common UX, unified reporting, quarantine and management, instead of each living separately with its own interface. A Python daemon keeps the YARA ruleset compiled in memory and answers scan requests over a Unix socket, so an upload doesn&#8217;t pay the cost of recompiling the ruleset on every single request.<\/p>\n<h3>What it does<\/h3>\n<ul>\n<li>YARA-based detection of obfuscated PHP, webshells and known exploit patterns<\/li>\n<li>ClamAV and maldet (Linux Malware Detect) as additional, independent detectors<\/li>\n<li>version checks (WordPress core, Composer packages, pending apt security updates)<\/li>\n<li>file integrity monitoring with a SHA-256 baseline of a configurable list of important files<\/li>\n<li><strong>&#8220;unknown core file&#8221;<\/strong> detection &#8211; a file under <code>wp-admin<\/code>\/<code>wp-includes<\/code> that isn&#8217;t part of the installed WordPress version&#8217;s own official distribution at all, telling apart a simple leftover from an incomplete upgrade from something genuinely unexpected<\/li>\n<li>a <strong>&#8220;repair&#8221;<\/strong> action that replaces a modified, known file (WordPress core\/plugin, Composer package, Drupal core) with its official pristine content, backed up to quarantine first<\/li>\n<li><strong>database content scan<\/strong> &#8211; scans the database&#8217;s own content (WordPress, Joomla\/Mambo, Drupal 7) with the same YARA ruleset, for compromises that live entirely inside the database without ever touching a file<\/li>\n<li>real-time upload blocking via a mod_security hook, before the web server even accepts the file<\/li>\n<li>automatic CSF ban on IPs behind confirmed malicious uploads<\/li>\n<li>a Webmin module for the dashboard, scan history, quarantine management, and one-click installers<\/li>\n<\/ul>\n<h3>Where it stands now<\/h3>\n<p>The project is still early-stage, but it&#8217;s already running in production on several of the servers I manage. The code is MIT licensed and public on GitHub:<\/p>\n<p><a href=\"https:\/\/github.com\/mrpc\/OpenXS\">https:\/\/github.com\/mrpc\/OpenXS<\/a><\/p>\n<p>If you also manage Linux web hosting servers and were looking for a cxs replacement (or you&#8217;re just curious), take a look &#8211; issues, feedback and pull requests are always welcome.<\/p>","protected":false},"excerpt":{"rendered":"<p>On 2025 Way to the Web Ltd shut down, and with it went support for cxs (ConfigServer eXploit Scanner) &#8211; a tool I&#8217;d been using for years on the servers I manage. cxs combined heuristic exploit detection, ClamAV-backed virus scanning, and a CSF firewall hook that auto-banned IPs behind malicious uploads. It was proprietary and &hellip; <a href=\"https:\/\/mrpc.pramnos.net\/en\/2026\/10\/openxs-%ce%ad%ce%bd%ce%b1-open-source-exploit-scanner-%ce%b3%ce%b9%ce%b1-%cf%84%ce%bf%cf%85%cf%82-servers-%ce%bc%ce%bf%cf%85\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">OpenXS: an open-source exploit scanner for my servers<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,109],"tags":[549,96,551,552,423,168,144],"class_list":["post-1261","post","type-post","status-publish","format-standard","hentry","category-development","category-open-source","tag-development","tag-linux","tag-open-source","tag-php","tag-security","tag-server","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/posts\/1261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/comments?post=1261"}],"version-history":[{"count":4,"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/posts\/1261\/revisions"}],"predecessor-version":[{"id":1265,"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/posts\/1261\/revisions\/1265"}],"wp:attachment":[{"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/media?parent=1261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/categories?post=1261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrpc.pramnos.net\/en\/wp-json\/wp\/v2\/tags?post=1261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}