Fix undetected malwares in scanner

[Copilot]

Adds four new exploit detection patterns to src/Exploits.php to catch three previously undetected malware families, along with malware fixture files for regression testing.

New Exploit Patterns

• cookie_backdoor: Detects $_COOKIE assigned to a local variable and then accessed via a substr()-based key — characteristic of cookie-based PHP backdoors (malwares 1 & 3)
• xor_str_repeat: Detects $arr[0] ^ str_repeat($key, ...) XOR decryption used to decode cookie-supplied payloads (malwares 1 & 3)
• str_replace_eval: Detects str_replace(..., '', ...) immediately followed by eval(), used to strip <?php from a stored payload before executing it (malwares 1 & 3)
• urldecode_obfuscation: Detects "url" . "decode" string-concatenation obfuscation of the urldecode function name (malware 2)

New Malware Fixtures

• tests/Fixtures/malware/cookie_backdoor.php — exercises cookie_backdoor, xor_str_repeat, and str_replace_eval patterns
• tests/Fixtures/malware/globals_include_backdoor.php — exercises urldecode_obfuscation pattern

Testing

• ✅ All three original malware samples from the issue are now detected
• ✅ No false positives introduced on existing clean fixtures (0 detections)
• ✅ All 6 malware fixtures detected (including the 2 new ones)

[marcocesarato]

@copilot continue

[Copilot]

@copilot continue

All tasks are now complete. Here's a summary of what was done:

4 new exploit patterns added to src/Exploits.php:

• cookie_backdoor — detects $_COOKIE assigned to a local var and then read via substr() key (malwares 1 & 3)
• xor_str_repeat — detects $arr[0] ^ str_repeat($key, ...) XOR decryption used to decode the cookie payload (malwares 1 & 3)
• str_replace_eval — detects str_replace(..., '', ...) immediately followed by eval() used to strip <?php before evaluating injected code (malwares 1 & 3)
• urldecode_obfuscation — detects "url" . "decode" string-concat obfuscation of the urldecode function name (malware 2)

2 new malware fixture files added:

• tests/Fixtures/malware/cookie_backdoor.php
• tests/Fixtures/malware/globals_include_backdoor.php

All three original malware samples from the issue are now detected, and no false positives were introduced on the clean fixtures.

[Copilot]

Pull request overview

This PR extends the scanner’s exploit detection definitions by adding new regex-based patterns to catch additional backdoor/obfuscation techniques, and adds new malware fixture files intended to serve as regression samples for those detections.

Changes:

• Added four new exploit patterns in src/Exploits.php targeting cookie-based backdoors, XOR+str_repeat decoding, str_replace-then-eval execution, and obfuscated urldecode naming.
• Added two new malware fixture files under tests/Fixtures/malware/ to exercise the new detections.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tests/Fixtures/malware/globals_include_backdoor.php	Adds a malware fixture demonstrating obfuscated urldecode naming and global-state include behavior.
tests/Fixtures/malware/cookie_backdoor.php	Adds a malware fixture demonstrating cookie-driven payload assembly, XOR decoding, and str_replace + eval execution.
src/Exploits.php	Adds four new exploit regex patterns intended to detect previously undetected malware families/techniques.

[marcocesarato]

@copilot apply changes based on this feedback