The malware safety-net missed .htaccess/.htaccess.json droppers that
enable PHP on non-.php extensions (AddType/AddHandler
application/x-httpd-php .json, php_flag engine on): they carry no
<?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped
them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json)
had entered the source repo and was built into the baseline (B:match),
blinding the detector against itself.
Add safety-net section (d) mirroring the malware_htaccess_php_enable
YARA rule (illusion/hids#183), remove the file from the source tree,
and add its path to malware-iocs.paths.
Ref: cadline/infra#180
deployed/helix3 held only a minimal 227-line variant, missing the live
docroot customization (Google Analytics gtag, warehouse-menu logic,
HTTP_HOST domain branches) — so the malware-remediation restore stripped
these from the live site. Replace with the byte-exact live version (792
lines) with the seo-cloaking backdoor line (google-UA C2 exfil) removed.
Assisted-by: claude-code@claude-opus-4-8
Helix3 (JoomShaper) template + system/ajax plugins; the live templates/shaper_helix3/index.php was fbwjedi-cloaking-infected and is replaced with the clean monolith copy -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
