# Pyxsoft blog

> Research, incident guides and product notes.

Source: https://www.pyxsoft.com/blog
Updated: 2026-11-10

---

- [Hacking tools: WSO / FilesMan web shell](https://www.pyxsoft.com/blog/hacking-tools-wso-shell.md) (2026-11-10): WSO is the web shell you actually find on a hacked cPanel account. A tour of its file manager, console, bruteforce and back-connect tools, why it hides so well, and how to find it.
- [Polymorphic PHP Malware: 19 Files, 19 Hashes, One Campaign](https://www.pyxsoft.com/blog/polymorphic-php-malware.md) (2026-11-10): A polymorphic PHP malware campaign hid in fake .well-known folders and deleted Wordfence and Sucuri. How it evades scanners, what it does, and how to find it.
- [How to Find and Clean Malware on a cPanel Server Without Breaking Sites](https://www.pyxsoft.com/blog/find-clean-malware-cpanel-server.md) (2026-10-30): A practical incident guide for cPanel/WHM administrators: find infected files with standard tools, tell injected code from pure malware, clean without taking sites down, and close the way back in.
- [Anatomy of a PHP Dropper: Eight Obfuscated Files, One Signature](https://www.pyxsoft.com/blog/one-signature-eight-obfuscated-droppers.md) (2026-10-30): We took apart a real PHP dropper family from WordPress uploads folders. Eight files with different hashes, no readable function names and no VirusTotal record reduced to one canonical form, and a single signature matched them all.
- [How to Scan a Server for Malware Without Slowing Down Your Sites](https://www.pyxsoft.com/blog/scan-server-malware-without-slowing-sites.md) (2026-10-30): Why malware scans make hosting servers slow, how to measure the real cause, what nice, ionice and CPU quotas actually do, and measured numbers from a scanner built around a hard CPU limit.
- [Why a Hacked Site Gets Reinfected After You Clean It](https://www.pyxsoft.com/blog/why-sites-get-reinfected-after-cleaning.md) (2026-10-30): You removed the malware and it came back. Real samples show why: injected code that reinstalls deleted files on every page view, payloads that delete themselves, and an entry point nobody closed.
- [Enabling Two-Factor Authentication (2FA) for root in cPanel/WHM](https://www.pyxsoft.com/blog/enabling-2fa-for-root-in-whm.md) (2025-01-05): Learn how to enable Two-Factor Authentication (2FA) for WHM (cPanel) to enhance security, protect sensitive data, and prevent unauthorized access.
- [Installing Pyxsoft in AlmaLinux 9 with cPanel](https://www.pyxsoft.com/blog/installing-pyxsoft-in-almalinux-9-cpanel.md) (2024-09-01): Learn how to install Pyxsoft on AlmaLinux 9 with cPanel for enhanced security and malware protection.
- [Upgrading cPanel from CentOS 7 to AlmaLinux 8 with Pyxsoft WAF](https://www.pyxsoft.com/blog/centos-7-upgrade.md) (2024-08-31)
- [Understanding WAFs and the Power of Pyxsoft](https://www.pyxsoft.com/blog/pyxsoft-waf.md) (2023-11-20)
- [Log4Shell Vulnerability Protection](https://www.pyxsoft.com/blog/log4shell-vulnerability-protection.md) (2021-12-21)
- [Brute Force Protection explained](https://www.pyxsoft.com/blog/brute-force-protection-explained.md) (2020-01-13)
- [Hacking tools: C99 Shell](https://www.pyxsoft.com/blog/hacking-tools-c99-shell.md) (2020-01-12)
- [WordPress Vulnerability CVE-2018-6389](https://www.pyxsoft.com/blog/wordpress-load-scripts-dos-vulnerability.md) (2018-02-07)