SessionScribe: cPanel/WHM session forgery
An unauthenticated CRLF injection in cPanel/WHM's session writer forges a logged-in root session. Disclosed 2026-04-28 by Sina Kheirkhah at watchTowr Labs.
modsec-sessionscribe.conf
5 phase-1 deny rules. Block at the WAF.
sessionscribe-remote-probe.sh
Remote verdict by HTTP code. Read-only.
sessionscribe-ioc-scan.sh
On-host IOC ladder. Vendor signals plus our heuristics.
356.0k
30.82M
2,158
Deployed across government, defense, education & enterprise networks
git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.shFeatured Projects
View allLinux Malware Detect
A high-performance malware scanner for Linux designed for the multi-core era. v2.0.1 introduces a foundational engine leap that delivers up to 10x faster performance than traditional scanners via hash-first short-circuiting and batch-parallel processing.
Advanced Policy Firewall
An iptables(netfilter) based firewall system for Linux servers. Provides three-fold filtering with static rules, stateful connection tracking, and sanity-based packet inspection.
Brute Force Detection
A modular shell script for parsing application logs and detecting authentication failures. Uses regex rules and integrates with APF, Shorewall, or raw iptables for blocking.
Quick Start
Get up and running in minutes. All tools install from source with a single command.
$ git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.sh$ git clone https://github.com/rfxn/advanced-policy-firewall.git && cd advanced-policy-firewall && ./install.sh$ git clone https://github.com/rfxn/brute-force-detection.git && cd brute-force-detection && ./install.shBuilt for Real-World Linux Security
Threat-Driven Design
Built from real malware data collected at the network edge. Every detection signature comes from active threats seen in production hosting environments, not theoretical research.
Shell-Native & Lightweight
Pure bash with minimal dependencies. No agents, no daemons eating resources, no runtime interpreters. Runs on any Linux system from embedded devices to enterprise servers.
Community-Sustained
20+ years of open source development under GPL v2. No venture funding, no enterprise upsells. Sustained by the community of sysadmins who rely on these tools daily.
Protection Stack
Three tools, one defense-in-depth strategy. Layer them together for comprehensive Linux security.
Malware Detection
LMD
Scan & quarantine threats from real hosting threat data
Firewall Policy
APF
Stateful iptables filtering with reactive address blocking
Intrusion Prevention
BFD
Block brute-force auth attacks with modular log parsing
Connect
AboutSupport Open Source Security
R-fx Networks projects are entirely community-funded. If these tools help protect your infrastructure, consider contributing.