fix(helix3): restore live customization to baseline, drop cloaking backdoor #4

imre.agent · 2026-07-19T13:15:53+02:00

imre.agent commented

2026-07-19 13:15:53 +02:00

Problem

deployed/helix3/templates/shaper_helix3/index.php held only a minimal
227-line variant. It was missing the live docroot customization —
Google Analytics gtag (UA-51323892-1/-2), the warehouse-menu logic
($warehouseId), and HTTP_HOST domain branches. Because the baseline
lacked these, the malware-remediation restore stripped them from the
live site (GA tracking + warehouse menu lost).

Fix

Replace with the byte-exact live version (792 lines), with the single
injected line removed: an seo-cloaking backdoor that, on a Google
user-agent, fetched an obfuscated C2 URL (.../logs3/?type=fbwjedi) and
echoed it.

Verification

792 lines, LF; 0 backdoor markers (fbwjedi/logs3/remote file_get_contents).
Customization restored: GA gtag + $warehouseId warehouse logic + domain branches present.
Whitespace-independent diff vs the old 227-line variant: 571 live-only lines
(the legit customization), 6 repo-only lines (custom_css/js activation + a
commented debug var_dump). No malware in the added lines — verified line by line.
The removed backdoor line was cut byte-exactly (the file's trailing-newline
state preserved); only that one line differs from the quarantined original.

## Problem `deployed/helix3/templates/shaper_helix3/index.php` held only a minimal **227-line** variant. It was missing the live docroot customization — Google Analytics `gtag` (UA-51323892-1/-2), the warehouse-menu logic (`$warehouseId`), and `HTTP_HOST` domain branches. Because the baseline lacked these, the malware-remediation restore **stripped them from the live site** (GA tracking + warehouse menu lost). ## Fix Replace with the **byte-exact live version (792 lines)**, with the single injected line removed: an seo-cloaking backdoor that, on a Google user-agent, fetched an obfuscated C2 URL (`.../logs3/?type=fbwjedi`) and echoed it. ## Verification - 792 lines, LF; **0 backdoor markers** (`fbwjedi`/`logs3`/remote `file_get_contents`). - Customization restored: GA gtag + `$warehouseId` warehouse logic + domain branches present. - Whitespace-independent diff vs the old 227-line variant: 571 live-only lines (the legit customization), 6 repo-only lines (custom_css/js activation + a commented debug var_dump). No malware in the added lines — verified line by line. - The removed backdoor line was cut byte-exactly (the file's trailing-newline state preserved); only that one line differs from the quarantined original.

imre.agent added 1 commit 2026-07-19 13:15:53 +02:00

fix(helix3): restore live customization to baseline, drop cloaking backdoor c7a22428e5

deployed/helix3 held only a minimal 227-line variant, missing the live
docroot customization (Google Analytics gtag, warehouse-menu logic,
HTTP_HOST domain branches) — so the malware-remediation restore stripped
these from the live site. Replace with the byte-exact live version (792
lines) with the seo-cloaking backdoor line (google-UA C2 exfil) removed.

Assisted-by: claude-code@claude-opus-4-8

imre approved these changes 2026-07-19 13:34:30 +02:00

imre merged commit 68c1e4555f into main

2026-07-19 13:34:33 +02:00

imre referenced this issue from a commit

2026-07-19 13:34:33 +02:00

Merge pull request 'fix(helix3): restore live customization to baseline, drop cloaking backdoor' (#4) from fix/helix3-customization into main

imre.agent referenced this pull request

2026-07-19 21:08:03 +02:00

helix3 index.php: baseline still byte-diverges from deployed file after #4/#5 #6

Sign in to join this conversation.

No reviewers