Arx: detect, clean and prevent webshell / htaccess-lock infections (lessons 2026-10-15)

Imported from GitHub issue El-SaMa/oma#229 by @El-SaMa.

---

Lessons from the 2026-10-15 incident (Puunkaatopalvelu sites on satama: live WSO webshell wp-admin/js/oXoHBjTMH.php, htaccess-lock malware with copies disguised as .js/.css/.png). Arx saw "unexpected core files" but did not call it malware or alert anyone.

Detect

• Unexpected .php in wp-admin / wp-includes = critical malware finding (not just "modified core files"), immediate staff alert + customer notice.
• htaccess-lock detection: files whose content is .htaccess rules (FilesMatch deny php + allow-list like wp-confiq.php, lock.php), any extension; .htaccess in every core folder.
• Persistence checks: PHP in uploads, unknown mu-plugins, odd cron events, new admins, auto_prepend_file.
• File malware scan (ClamAV + Arx signatures) on laituri and satama, not only nilek.
• Hash/learn: every confirmed sample becomes an Arx signature (fingerprint verdict) so the fleet catches it next time.

Clean

• Restore original files also removes extra files in core (ed24c6fb).
• One "Clean infection" flow: core + plugins + extras + htaccess lock + uploads PHP + salts + rescan, with rollback.
• Database clean on all servers after more test data.

Prevent

• Block PHP execution in wp-admin/js, wp-admin/css, wp-admin/images and uploads by default (vhost measure).
• Auto security updates on by default for new sites; nightly vulnerable-plugin report to staff.
• Find entry point from access logs automatically (first request to the shell, source IP) and feed it to Shield.