Observed arrival · 2026-09-05
Shelltrap puts a webshell scanner directly in the write path
A server-side security tool for CyberPanel and cPanel that watches file changes, scans uploads in an isolated worker, and blocks PHP files before an application sees them.
Field notes
The page describes a write-path workflow rather than a periodic malware scan: fanotify observes filesystem events, a broker hands a read-only descriptor to a restricted worker, and the worker combines ClamAV, YARA 4.5, hash sets, and heuristics. It also documents queue-overflow handling through bounded reconciliation scans. Licensing is per server with unlimited domains, while the cPanel/WHM offering is identified as a beta and the listed price is €14.90 per month including VAT.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue