magescan 0.3.0

Read-only, rule-driven compromise scanner for Magento 2 / Adobe Commerce. One static binary — nothing to install on the server.

Run it

On the server:

curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/magescan-linux-amd64 -o /tmp/magescan && chmod +x /tmp/magescan && /tmp/magescan all -root /var/www/magento -format table

Over SSH from your machine:

ssh user@host 'curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/magescan-linux-amd64 -o /tmp/magescan && chmod +x /tmp/magescan && /tmp/magescan all -root /var/www/magento -format table'

Verify: curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/SHA256SUMS | sha256sum --ignore-missing -c -

What's in 0.3.0

• Commands per scanner: files, db, system, logs, all (default), plus rules list|validate
• 31 embedded rules in rules/{files,db,system,logs}/: upload-dir PHP and filter-bypass names, webshell code, PHP-enabling .htaccess / .user.ini, session-file poisoning, path-traversal names, CMS/config/widget/email/banner skimmers, layout-XML injection, recent admins/integrations, CVE-2026-75650 implants and exploit requests, suspicious processes and cron
• DB credentials discovered from app/etc/env.php; every query validated as SELECT and run in a READ ONLY session
• Report formats: text, table, json, jsonl, csv, md, html (-o report.html picks the format from the extension; refused inside the store root)
• Parallel file walk (-threads, default 2), progress heartbeat for detached runs
• Drop-in rules without rebuilding (-rules dir); every embedded rule has match / no-match test cases

Assets

file	for
magescan-linux-amd64	most Magento servers, Adobe Commerce Cloud
magescan-linux-arm64	ARM / Graviton
magescan-darwin-arm64, magescan-darwin-amd64	macOS (local testing, rule authoring)
magescan-0.3.0-*	same binaries, versioned names for pinning
SHA256SUMS	checksums