ChangeLog:

6.14   - Modified ModSecurity integration Install/Remove options in cxs UI for
	 EA4 as cPanel has moved files to a different directory 

6.13   - Fixed some incorrect file locks

	 Removed Bareword file handles

6.11   - Ensure all file opens are properly flocked

	 Switch to using require instead of eval/use to load runtime modules
	 where possible

	 Code review - started addressing perl critic suggestions in all
	 scripts and modules

	 Fixed incorrect --summary when subdomains outside of public_html while
	 using --www

	 Memory and CPU optimisations

	 PHP script decoding up to 15% faster

	 PHP fingerprint regex matching up to 50% faster

	 postftpup converted to a cPanel Hook

	 Exploit fingerprint definitions database additions

6.10   - On cPanel servers, ensure all document roots are scanned when using
         --www not just ~/public_html/ (i.e. domains, SSL, addons, subdomains)

	 Fix pure-uploadscript init script to exit with appropriate status code

	 Exploit fingerprint definitions database additions

6.09   - Fixed quarantine store of file group ownership used for display
         purposes only. The problem manifests when a users uid != gid and the
	 incorrect group is used for display purposes

	 Fixed Wmonitor display of file group ownership. The problem manifests
	 when a the users uid != gid and the incorrect group is used for
	 display purposes

6.08   - Replace /etc/cxs/test/ files with a single non-threatening script that
         will test trigger cxs and can be used to check the cxs ModSecurity 
	 rule is working. See /etc/cxs/install.txt for details

	 Modified ModSecurity integration Install/Remove options in cxs UI for
	 EA4

	 Exploit fingerprint definitions database additions

6.07   - Added text field in UI for PureFTPd/ModSecurity to indicate whether
         the options is currently enabled or disabled

6.06   - Fixed crond restart in UI on RHEL/CentOS/CloudLinux v7 which left
         pages blank

	 Exploit fingerprint definitions database additions

6.05   - Added version detection for Drupal v8

         Added PureFTPd integration Enable/Disable/Restart options to cxs UI

         Added ModSecurity integration Install/Remove options to cxs UI

	 Mute perl lc UTF-16 warnings where necessary

         New --options [U]. This option will match PHP scripts that allow
	 uploading files to the server via the HTTP POST method. This option
	 requires that --options [m] is also specified

	 Added --options [U] to the Restricted Mode UI options

	 UI updates and improvements

	 Exploit fingerprint definitions database additions

6.04   - Ensure CallUploadScript is disabled in /etc/pure-ftpd.conf on cPanel
         servers on uninstall

	 Exploit fingerprint definitions database additions

6.03   - Fixed UI issue where --soptions [as] were not being set

	 Exploit fingerprint definitions database additions

6.02   - Fixed issues with DA UI quarantine restore

         Improved DA UI POD display

6.01   - Added unsupported option --YSKIPUNCLAM. See POD for more information

	 Exploit fingerprint definitions database additions

6.00   - Added new major feature for cxs Watch: --Wmonitor [file]
         This option allows you to monitor and report on changes to a list of
	 resources in [file]. See cxs POD for more information

	 Added option --Wmonignore [file] to use instead of --ignore [file] for
	 use with --Wmonitor [file]

         Added IO::Select as a required perl module (a core perl module so
         should always be present)

         Improvements to php file detection

	 Improvements to deobfuscation routines

	 Fixed bug in display of atime for some quarantined files

	 Fix BCC header replacement field in email reports

	 Exploit fingerprint definitions database additions

5.33   - POD corrections and additions

	 Exploit fingerprint definitions database additions

5.32   - Force email Date: field incase the MTA fails to add one

         Modified all report timestamps to use the same format

	 Exploit fingerprint definitions database additions

5.31   - Ensure only root can attempt to download the bayes corpus

         Fixed POD reference to --bforget

	 Fixed POD formatting of long example commands

	 Updated Software Version Checking

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.30   - Modify cPanel install.txt to add the ConfigServer ModSecurity Vendor
         option

	 Added new advanced PHP decoders

	 Exploit fingerprint definitions database additions

5.29   - Modified documentation to address changes in ModSecurity v2.9 that
         requires the following is set as part of the ModSecurity config:
	 SecUploadKeepFiles RelevantOnly
	 
	 Exploit fingerprint definitions database additions

5.28   - Added new option --[no]ssl. When enabled (the default) all cxs URL
         functions, such as updating, bayes corpus retrieval and license
	 checking will be done over an SSL connection to ConfigServer servers

	 Added /var/run/clamd.scan/clamd.sock as another default clamd socket
	 location for --clamdsock [socket]

	 Added unsupported option --YSKIPCGI. See POD for more information

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.27   - Fixed call for the now removed cxswatch.pm from --Wstop

5.26   - Added /scripts/postftpup to restart pure-uploadscript after an ftp
         server upgrade

5.25   - Trigger pure-uploadscript restart

5.24   - Added new advanced PHP decoders
	 
	 Exploit fingerprint definitions database additions

5.23   - Added the ability to use positive --options [+][], i.e. the default
	 list of options is used in addition to those listed when prefixed with
	 a plus

         Improvements to --decode ([D])

	 Added atime, ctime and mtime to newly quarantined file descriptions
	 viewable from the UI and the CLI via --qview [file].restore4

	 Ensure /var/log/cxswatch.log ownership and permissions are set on each
	 update in case of rotation

	 File md5sum added to cgi and ftp alert email

5.22   - Ensure timestamp and cxs command are prepended to --report [file]

         Fix cxs Watch Timestamp in report emails

	 When using --options W ensure that resource is a directory and not a
	 symlink or socket

5.21   - Fixed issue in cxs Watch when --www is used and a new account is
         created through restore on cPanel servers

	 cxs Watch now tracks the parent directories for all users when
	 --allusers is used and will add them back if they disappear and are
	 recreated

5.20   - Fixed systemd cxs watch UI commands
	 
	 Exploit fingerprint definitions database additions

5.19   - Re-added POSIX Locale after changes in v5.16

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.18   - Added white-space pre-wrapping to HTML emails

         UI HTML updates and fixes

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.17   - Fixed --qcreate POD text

         Added systemd support for pure-uploadscript

5.16   - WARNING: The report format has changed in this version. If you are
	 parsing cxs reports, they now show the filename and then all hits
	 reported against that file before reporting the next file. Previously
	 each reported hit was shown separately with the filename following

	 Renamed cxs cron job in /etc/cron.d/ from cxs.cron to cxs-cron to
         cater for non-LSB compliant Linux cron managers

	 New option --[no]html. With --[no]html enabled (default), emails will
	 be sent in both plain-text and HTML formats. The option does not apply
	 if --template [file] is used

	 Fixed cxs Watch to remove rateignore data for a file if it is deleted

	 Fixed rateignore hash array lookup and unneccessary rateignore removal
	 causing files to be skipped

	 Added unsupported option --YRATEIGN. See POD for more information

	 Improvement to PHP script detection

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.15   - Fix for POD cron jobs RECOMMENDATIONS text

5.14   - Modified --Wrateignore [secs] so that ignored resources are rescanned
         once [sec] expires

	 Modified cxs watch so that resource attribute changes only trigger an
	 inotify event if --options [w] or [W] are used

	 cxswatch.sh now disables the world writable directory check options
	 on new installations (--options -wW)

	 Removed options --Wsymlink [script], --Wsymlinkmax [num] and 
	 --Wsymlinksec [secs]. These options provided ineffective control of
	 such exploits and caused performance isses with cxs Watch. The options
	 will no longer function, but cxs commands will not fail if they are
	 used

	 Updated cxs RECOMMENDATIONS section

5.13   - Ensure --Wrateignore [secs] has default values set in cxs Watch if
         --Wsleep [num] is set to 0

	 Added unsupported options --YRATECNT [num] and YRATESEC [secs]. See
	 POD for more information

 	 Exploit fingerprint definitions database additions

5.12   - Implemented native systemd support for startup and shutdown of cxs
         Watch

	 Added version detection for Fancybox for Wordpress

 	 Exploit fingerprint definitions database additions

5.11   - Updated license servers

 	 Exploit fingerprint definitions database additions

5.10   - Disable --xtra [file] when using --wttw [file]

         Display error on license retrieval failure

	 Added check for perl modules LWP::Protocol::https and Linux::Inotify2
	 on installation and upgrade

	 Added new advanced PHP decoders

 	 Exploit fingerprint definitions database additions

5.09   - Fix for issues where license file became corrupted after update to
         v5.08

5.08   - Fixed a rare potential issue with fingerprint processing in
         --xtra [file]

	 Added new advanced PHP decoders

         Updated scripts to use https://download.configserver.com

	 Revert to using LWP::UserAgent instead of HTTP::Tiny for SSL support
 
	 Exploit fingerprint definitions database additions

5.07   - Modified new installs to better initially update to the latest
         fingerprints

	 Ignore and Xtra files can now use an Include statement to include
	 additional files. If cxswatch is running then it will also watch the
	 included files for changes and reload if necessary

	 Added new quarantine option --qignore [method] which used when
	 restoring a file using --qrestore [file] will create an entry in
	 --ignore [file] before restoring the file. See POD for more info

	 Optimised fingerprint database to remove duplicates and old entries of
	 no value reducing the size without reducing effectiveness
 
	 Exploit fingerprint definitions database additions

5.06   - HTTP::Tiny upgraded to v0.050

         Modified use of BSD::Resource to be silent on failure
	 
	 Exploit fingerprint definitions database additions

5.05   - Updated installer to fix generic installs on some Redhat/CentOS setups

         Fixed issue with fingerprint database and a corrupt regex

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.04   - Improvements to .htaccess fingerprint P0216 -> P0767

         Modify installer to always perform an update on installation to ensure
	 the latest definitions are always available

	 cxswatch will now scan a directories permissions if any of its
	 attributes are changed and --options [w] and/or --options [W] is
	 enabled

	 Updated scripts to use download.configserver.com
	 
	 Exploit fingerprint definitions database additions

5.03   - Removed a false-postitive fingerprint definition

	 Exploit fingerprint definitions database additions

5.02   - Ensure --ignore [file] is always loaded last

         Allow ignoring of Fingerprints

         New master bayes corpus generated

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.01   - Raised bayes low/medium/high thresholds

         New master bayes corpus generated

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

5.00   - New feature --[no]bayes taken out of BETA and is the basis of v5

	 Added --[no]bayes to the UI

         New master bayes corpus generated

         Added warning in UI for --[no]fallback option regarding potential
	 performance impact

	 Exploit fingerprint definitions database additions

4.28   - Fixed cxs Watch loading the bayes database whether --bayes was in use
         or not

4.27   - Modified cxs Watch so that watches are updated/created if the
         alternative configuration file reload method is used

	 Exploit fingerprint definitions database additions

	 BETA: Added a local bayes corpus so that learning and forgetting can
	 be implemented locally

	 BETA: Added new option --blearn [X|C] so that new files can be added
	 to the local corpus as either an exploit (X) or as a clean file (C)

	 BETA: Added new option --bforget [X|C] so that new files can be
	 removed from the local corpus as either an exploit (X) or as a clean
	 file (C). Only files previously learned should be forgotten

         BETA: Modified cxs Watch to reload the master bayes corpus on change

         BETA: Modified cxs Watch to reload the local bayes corpus, if one
	 exists, on change

	 BETA: When cxs is upgraded and the master bayes corpus exists, the
	 latest master corpus will be automatically downloaded

         BETA: New master bayes corpus generated

	 BETA: Raised bayes low/medium/high thresholds

4.26   - A situation where Fingerprint P0452 persists was missed and is now
         removed

4.25   - Fingerprint P0452 removed as it appears some legitimate scripts are
         using the same obfuscation technique commonly used in exploits

         BETA: Bayes corpus size decreased by a further 28% but with increased
	 accuracy

	 Exploit fingerprint definitions database additions

4.24   - BETA: Bayes corpus format improved - if you are using this feature,
	 download the new corpus using "cxs --bget"

         BETA: Bayes corpus memory footprint decreased by a further 20%

         BETA: Bayes corpus loading speed improvements

4.23   - Improvements to the main decoder regex

         Improvements to decoder string extraction

	 Fixed formatting of --qlocal documentation

         BETA: New Bayes corpus generated - if you are using this feature,
	 download the new corpus using "cxs --bget"

         BETA: Bayes corpus size decreased by 25% but with increased accuracy

	 Exploit fingerprint definitions database additions

4.22   - Added option --qlocal which provides quarantine support when using
	 mod_ruid2 by storing quarantined files within a users account. See
	 documentation for more information and caveats

         BETA: Bayes learning improvements (speed, memory)

	 BETA: Bayes reporting improvements (speed, memory)

         BETA: New Bayes corpus generated - if you are using this feature,
	 download the new corpus using "cxs --bget"

	 Improvements to PHP decoded script scanning efficiency

4.21   - BETA: Bayes corpus loading speed improved by 100%

         BETA: Bayes corpus memory footprint decreased by 20%

	 BETA: Increased minimum score size for Bayes reporting to help reduce
	 false-positives

4.20   - New option --[no]bayes (currently in BETA). Naive Bayesian
         probabability scanning of script files. This option uses an enhanced
	 Naive Bayes algorithm to report a probability that a scanned script is
	 an exploit. This is achieved through a trained corpus (database). See
	 the cxs documentation for more details.

	 Additions to main decoder regex

	 Exploit fingerprint definitions database additions

4.19   - Additions to main decoder regex

         Modified option --template [file]. You can now use this to email the
	 end user when performing --allusers and --user [user] scans. See the
	 cxs Documentation for --template [file] for more information

	 Output improvements to --qview [file] and more information provided in
	 the POD

	 Exploit fingerprint definitions database additions

4.18   - HTTP::Tiny reverted to v0.041 as it breaks on some installations

4.17   - Unsupported option --YSKIPWMAIL added. Using this, If --options [W] or
         --options [wW] is triggered, then the directory will be chmod as
	 normal but no email will be sent. If any other option is triggered for
	 the same scan, the email will still be sent. This option only applies
	 to cxs Watch

	 Added full pseudo-breadcrumbs to cPanel UI

         HTTP::Tiny upgraded to v0.042

	 On cPanel servers, use cPanel provided perldoc binary in UI if present

	 Exploit fingerprint definitions database additions

4.16   - Updated POD to reflect --[no]fallback being disabled by default

         Changed default value of --Wsymlinkmax to 1000

	 Changed default value of --Wsymlinksec to 10

	 Added performance note about using --Wsymlink [script] to POD

	 Modified cxswatch restart routine to run /etc/cxs/cxswatch.sh directly

	 Modified cxswatch to more quickly detect restart requests on busy
	 systems

	 Exploit fingerprint definitions database additions

4.15   - Memory usage improvements and general speedups

         Added the ability to use negative --options [-][], i.e. the default
	 list of options is used apart from those listed when prefixed with a
	 minus

	 --[no]fallback now defaults to --nofallback due to performance
	 concerns which should be noted before enabling the option

	 Exploit fingerprint definitions database additions

4.14   - Force cxs into a detached process if running --upgrade as a CRON job
         to fix upgrade hanging issue

4.13   - Significant speedups in regex (up to 300% faster) and FP matching

	 Exploit fingerprint definitions database additions

4.12   - Code regression to prevent overloading update server during upgrades

4.11   - New feature: --[no]fallback. If clamd produces an error or is
         unavailable after a scan starts, this option will attempt to use
	 clamscan to scan files until clamd is available again. This option is
	 enabled by default

	 Additional minor updates to the POD documentation

	 Modify cxsdaily.sh to fork jobs to prevent hanging on new installs

	 Added timeout (5 mins) to cxs upgrade routine

	 Improvements to --wttw [file]

4.10   - Check file size against --sizemax [size] when using --wttw to ensure
         ignored files are not being submitted incorrectly

	 Exploit fingerprint definitions database additions

4.09   - UI Fixes and updates

         Fixed issue with default perl binary on non-cPanel servers
	 
	 Use raw UI plugin on DA servers when generating cxs commands/scans to
	 overcome buffering issues

	 Exploit fingerprint definitions database additions

4.08   - Removed redundant v3 quarantine code

         Removed displaying "i" during scan if file ignored as it is not
	 particularly helpful

	 Updates to Piwik and ownCloud version detection

	 Form design elements added

	 Change to --sizemax [bytes] behaviour. In the past a file > [bytes] in
	 size was ignored, now the file will be scanned but only the initial
	 [bytes] of the file will be scanned

	 Added decoding of octal as well as hex encoded characters for PHP
	 scripts

	 Exploit fingerprint definitions database additions

4.07   - Display "i" during scan if file ignored due to sizemax [bytes] being
         exceeded

         HTTP::Tiny upgraded to v0.039

	 Translate ampersand for HTML output

	 Fixed cxs UI not adding files to the ignore file after using the
	 Ignore link

	 Additional checks for ignore, xtra and new detections updates for cxs
	 watch daemon to reload the relevant files if necessary

	 Exploit fingerprint definitions database additions

4.06   - Parameterise all calls to system() and Open3()

         Only list viewable files in UI "Other Files" option

	 Fixed issue with ignoring user: and puser: with web scanning

	 Added new --ignore [file] option ip: - ignore IP address for web and
	 ftp uploads. This may or may not have any impact on performance with
	 ftp uploads as the IP address will need to be established from the
	 message log for each file

	 Removed DNS lookup on FTP IP addresses to improve performance

	 Exploit fingerprint definitions database additions

4.05   - Fixed POD display in UI

4.04   - Fixed issue with cxs Watch not reporting running state correctly

4.03   - Fixed issue with reporting boolean CLI options

4.02   - Fixed issue with creation of new quarantine directory for new installs

	 Improved quarantine directory detection for conversion on upgrade to
	 v4

4.01   - Introducing a new Quarantine system. This new version creates a more
         secure method of quarantining suspicious files in cxs. It removes the
	 need for a directory with 1777 permissions. It also makes the layout
	 and maintenance of the quarantine directory much simpler

	 Automatically rename old quarantine directory to [dir].(timestamp)
	 and create new quarantine structure. An email is sent to root with a
	 reminder to remove the old directory
	 
	 Any pre v4 old quarantine directory can still be viewed and restored
	 from through the UI if required, though this functionality (for old
	 quarantine directories) will be removed in the future

	 New option --qcreate. This option is used to create a new quarantine
	 directory structure. It will rename any pre-existing directory to
	 [name].(timestamp)

	 New option --qclean [days]. This option is used to clean a quarantine
	 directory specificed with --quarantine [dir], retaining the last
	 [days] worth of files

	 New option --qrestore [file]. This option is used to restore a
	 quarantine file via the CLI to the original file location (v4
	 quarantined files only)

	 New option --qview [file]. This option is used to view a quarantined
	 file via the CLI

	 Modified cxs UI to cater for new quarantine layout and provide some
	 additional information on quarantined files

	 Added new file /etc/cxs/cxsdaily.sh as an example file to symlink
	 from /etc/cron.daily/ to perform daily tasks and added to
	 RECOMMENDATIONS in the docs

         Modified cxs Watch scanning to automatically scan newly created
         directories for exploits to help overcome an issue where files are
	 created before a new directory is watched

	 Support for running cxs through suhosin has been removed

	 Fixed issue with --defapache [user]

	 Modified recommendations on file ownership and permissions when using
	 --logfile [file]

         HTTP::Tiny upgraded to v0.037

	 POD documentation tidy

	 Exploit fingerprint definitions database additions

3.27   - NOTE: Support for using suhosin is deprecated and will be removed in
	 the near future - use ModSecurity instead. If you are unable to use
	 ModSecurity, you will have to rely on either cxs Watch or manual scans

	 New option added: --defapache [user]. This is the default account
	 under which apache runs. This will be set to "apache" by default
	 except on cPanel servers where it is set to "nobody" by default

	 Make cxs watch restart reason more verbose

	 Improved file type detection for files within archives

	 Improvements to the main decoder regex

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

3.26   - Fixed issue with cxs process termination due to scanning timeouts

         Prevent regex hangs due to some exploit tactics

	 Fixed quarantine UI not restoring file permissions correctly

3.25   - Extended fingerprint checks for alternative linefeeds in scripts

         Fixed functionality of the included test.cgi upload test script

	 Enforce stricter permissions on /var/log/cxswatch.log

	 Disable option to upgrade cxs in DA UI and instruct to use CLI

	 Added use of --force to --upgrade to redo upgrade to latest version if
	 required

	 Additional checks to terminate php child process if timeout occurs

	 Exploit fingerprint definitions database additions

3.24   - Added the following to Script Version Scanning:
         Joomla XCloner Ext, WP XCloner Ext

	 Added new advanced PHP decoders

	 Exploit fingerprint definitions database additions

3.23   - Added the following to Script Version Scanning:
         CubeCart

	 Fixed cxs Watch in DA where new account creation was not automatically
	 detected

         HTTP::Tiny upgraded to v0.036

3.22   - Added the following to Script Version Scanning:
         AbanteCart, AEF, b2evolution, CMS Made Simple, CodeIgnitor, Concrete5,
	 Dotclear, e107, Elgg, Feng Office, HESK, Jcow CE, MODX Evolution,
	 MODX Revolution, Noahs Classifieds, OSClass, ownCloud, Oxwall, Piwigo,
	 Piwik, Seo Panel, Serendipity, StatusNet, TomatoCart, Xoops, ZenPhoto,
	 Zikula

	 Added the following popular Wordpress extensions to Script Version
	 Scanning:
	     WP Sociable
	     WP Share This
	     WP WP Super Cache
	     WP All In One WP Security & Firewall
	     WP BulletProof Security
	     WP FD Feedburner
	     WP Google Adsense Plugin
	     WP WordPress Simple Paypal Shopping Cart
	     WP WordPress eShop
	     WP WordPress s2Member
	     WP UpdraftPlus
	     WP BackUpWordPress

	 Added the following popular Joomnla extensions to Script Version
	 Scanning:
	     Joomla Akeeba
	     Joomla AllVideos
	     Joomla CDN for Joomla
	     Joomla Community Builder
	     Joomla JEvents
	     Joomla Jomsocial
	     Joomla K2
	     Joomla Kunena
	     Joomla Phoca Gallery
	     Joomla sh404SEF
	     Joomla Simple Image Gallery
	     Joomla Xmap

	 Exploit fingerprint definitions database additions

3.21   - Disable Script Version Scanning for web script scanning (cxscgi.sh) as
	 it does not apply

	 Perl module Storable added to the required list

         Added ten of the most popular Wordpress extensions to Script Version
	 Scanning:
	     WP Akismet Ext v2
	     WP Better WP Security Ext v3
	     WP Contact Form 7 Ext v3
	     WP Facebook Ext
	     WP Google XML Sitemaps Ext v3
	     WP Jetpack Ext v2
	     WP NextGEN Gallery Ext v2
	     WP Seo Ext
	     WP W3 Total Cache Ext
	     WP WooCommerce Ext v2

         Added ten of the most popular Joomla extensions to Script Version
	 Scanning:
	     Joomla Advanced Module Manager Ext v4
	     Joomla JCE Ext v2
	     Joomla RAntiSpam Ext v3
	     Joomla Joomla LiveHelpNow Chat Ext v2
	     Joomla Rapid Contact Ext
	     Joomla Asynchronous Google Analytics Ext v2
	     Joomla Google Maps Ext v3
	     Joomla Sourcerer Ext v4
	     Joomla Tabs Ext v3
	     Joomla Modules Anywhere Ext v3

	 Added the following to Script Version Scanning:
	 OpenCart, Nucleus CMS, Open Classifieds, LimeSurvey, ClipBucket,
	 WHMCS, Coppermine Photo Gallery

	 Exploit fingerprint definitions database additions

3.20   - Changed --options [s] to be --[no]sversionscan (Script Version
         Scanning) to make it independent of --[no]exploitscan, allowing a fast
	 scan for old script installs. This option is enabled by default. Use
	 --nosversionscan to disable

         Added the following to Script Version Scanning:
	 Typo3, Invision Power Board, WebCalendar, MyBB, Dolphin, SMF, OpenX
	 Source, SugarCRM Community Edition, Contao CMS, PrestaShop,
	 PHP-Fusion, phpPgAdmin, SquirrelMail, Roundcube, Kayako, osTicket

	 Added new --soptions [a] for --[no]sversionscan to report all versions
	 of found scripts, not just old versions

	 Added new --soptions [d] for --[no]sversionscan to report the
	 directory containing the script, not the trigger file

	 Exploit fingerprint definitions database additions

3.13   - UI button style modifications

	 Added phpList, Moodle, Magento Community Edition and MediaWiki version
	 checking to --options [s]

	 Modified POD to screen wrap HTML code more effectively

3.12   - Fixed cxs uninstaller removing csf UI files on cPanel installs

	 Added phpBB, phpMyAdmin, Zen Cart, osCommerce and VirtueMart version
	 checking to --options [s]

3.11   - Added to RECOMMENDATIONS to still run a regular scan without --ctime
         [hours] to ensure new scan techniques and exploit signatures are used
	 to check all existing files

	 Fixed directory creation on installation for unofficial DA plugin

	 Improved performance of file slurping and therefore scanning

	 Added new --options [s] that will search for a few common web script
	 installations and report if older than the latest version on record.
	 See documentation for more information

	 Exploit fingerprint definitions database additions

3.10   - Changed --throttle [num] to prevent throttling triggering a
         --timemax [secs] timeout

	 Added detection for some PHP JPEG and TIFF EXIF exploits

	 Improvements to image and zip file type detection

	 Exploit fingerprint definitions database additions

3.09   - Improvements to Virtuozzo/OpenVZ system detection where
         /proc/vz/veinfo does not exist

	 Added TimeStamp to the top of the scan report

	 If /etc/csuibuttondisable exists then the UI buttons will revert for
	 those that cannot cope with the themed ones

3.08   - Implemented new cxswatch log tail code

	 UI display changes

	 Exploit fingerprint definitions database additions

3.07   - Allow (limited) scans via UI in restricted mode

         Added Change Time (--ctime [hours]) option to UI

	 If --quarantine has been disabled, ensure all reports contain a
	 warning message with explanation

3.06   - Fixed bug with broken --cgi option (cxscgi.sh) from v3.05

         Fixed UI configurable lines display for cxswatch.log

         Remove immutable and append-only flags from files when moving files to
	 quarantine or deleting

	 Fixed supplied test/test.php for newer PHP versions

3.05   - Added /etc, /sys and /proc to directories requiring --force to be used
         when scanning

	 Added additional checks that any specified quarantine directory is
	 valid

	 Added new option --ctime [hours]. If you run regular full system scans
	 then you can use --ctime [hours] to only scan files changed in the 
	 intervening hours. This can speed up scan times dramatically

	 Apply hfile:, hdir: and hsym: ignores to FTP upload scanning

	 Exploit fingerprint definitions database additions

3.04   - Fixed file view from quarantine - reported by Rack911

         Further improved UI form data sanitisation

	 Bolstered the UI warning with regard to disabling Restricted Mode

3.03   - Fixed broken UI items

         Improvements to the ignore logic

         Improved UI form data sanitisation

	 Exploit fingerprint definitions database additions

3.02   - Security - Added UI Restricted Mode which is enabled by default. This
         disables features in the UI that could allow abritrary commands to be
	 run as root and system files to be overwritten. To enable unrestricted
	 access to the UI remove /etc/cxs/cxs.restricted

	 Added UI option to completely disable the UI by creating the file
	 /etc/cxs/cxs.disableui

3.01   - Implement slurp routine for configuration files to cater for incorrect
         linefeeds

	 Improvements to forced quarantine feature within --xtra [file] and
	 updated instructions provided in cxs.xtra.example

	 Security - Quarantine improvements

	 Exploit fingerprint definitions database additions

3.00   - Implemented hfile ignoring for ratelimiting in cxs Watch

         Implemented ignore caching in cxs Watch for ratelimited files

         HTTP::Tiny upgraded to v0.033

	 Exploit fingerprint definitions database additions

2.99   - Fix --wttw [file] successful submission text

2.98   - Added check for clamd when using --wttw [file]

         Added check for script files when using --wttw [file]

         HTTP::Tiny upgraded to v0.031

	 Removed a false-postitive fingerprint definition

	 Exploit fingerprint definitions database additions

2.97   - Added support for cPanel v11.38.1+ AppConfig addon registration

	 NOTE: In accordance with the new conventions for v11.38.1+ AppConfig
	 the url to the cxs WHM plugin will change from /cgi/addon_cxs.cgi to
	 /cgi/configserver/cxs.cgi. This will only happen with cxs v2.97+ and
	 cPanel v11.38.1+. Older version of cxs will continue to use the old
	 URL. This has no particular relevance to users accessing through WHM,
	 but will affect direct URL access by users or third party
	 applications

         Added new option --comment "text" which can be used to add a short
	 comment to files submitted using --wttw [file]

	 Modified --wttw [file] to ensure that it is not already detected as a
	 Virus or Fingerprint (now requires --force to report a false-positive)

	 Fixed packed hex advanced decoder regex

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.96   - Fixed --xtra [file] detection for regfile: and file: entries

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.95   - Internal version

2.94   - Removed a false-postitive fingerprint definition

2.93   - New features: --prenice [num], --pionice [num]. These options allow
         you to control the nice and ionice priorities of the running process.
	 This can, for example, help even out the load on heavy IO servers or
	 increase the speed of the scan on busy servers

	 Exploit fingerprint definitions database additions

2.92   - Improvements to the main decoder regex

         Improvements to error reporting on UI restore

	 Fixed typo in documentation regarding cxs.xtra :quarantine feature

	 Added IP, where available, to --script [script] parameters passed to
	 external script

	 Exploit fingerprint definitions database additions

2.91   - Ensure cxswatch is stopped, disabled and removed on cxs uninstall

         Added cleaned script code scanning to text match and decoder regex
	 detection to improve exploit script detection

	 Modified --help to use the POD paginated viewer
 
	 Exploit fingerprint definitions database additions

2.90   - Added alternative php binary locations for generic installations

         Improvements to --decode ([D])

	 Added new advanced PHP decoder

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.89   - Improvements to --decode ([D])

         Repurposed --options [u] to specifically highlight scripts only within
	 directories deemed suspicious, rather than general directories such as
	 /image/ or /upload(s)/. This should make the option more useful and
	 help avoid false-positives

	 Exploit fingerprint definitions database additions

2.88   - Include gzdecode() detection for PHP scripts

         Switched from using LWP to HTTP::Tiny to reduce memory footprint and
         reliance on the LWP perl module. The HTTP::Tiny module is included in
	 the distribution, so no further action is necessary

	 Modified cxs watch daemon to use POSIX::setsid()

	 Modified cxs quarantine routine to reduce memory footprint

	 Modified loading of Pod::Usage only if necessary to reduce memory
	 footprint

	 Modified cxs watch to not fail startup if new watch resource
	 disappears before completion
	 
	 Exploit fingerprint definitions database additions

2.87   - Improvements to the main decoder regex

         Reverted to using temporary files during PHP file decoding due to a
	 major bug in PHP v5.4.* which produces "Ran out of opcode space!" in
	 interactive mode

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.86   - Improvements to installer on initial fresh cPanel v11.36 installations

         Added a 20 second timeout for running --Wsymlink [script] and switched
	 from using system call to open3

         Added a 20 second timeout for running --script [script] and improve
	 output printing from [script]

	 Modified --options [u] to include more suspicious locations
 
	 Exploit fingerprint definitions database additions

2.85   - Moved suspicious script location detection to its own option within:
         --options [u], --doptions [u], --voptions [u] and --qoptions [u]
	 The option is included in the default setting for --options [options].
	 If you specify a list in any of these options and want to include this
	 in them, then you need to add [u] to the list of options

	 Separate dangerous quarantine options in the UI

2.84   - New feature: cxs watch daemon Symlink attack detection. This option
         will try and detect a symlink attack against the server. If
	 --Wsymlinkmax [num] symlinks are created with one directory within
	 --Wsymlinksec [secs] seconds then --Wsymlink [script] will be run. An
	 example is provided for this script in
	 /etc/cxs/symlinkdisable.example.pl

	 Enable --Wsymlink /etc/cxs/symlinkdisable.example.pl on new installs
	 in /etc/cxs/cxswatch.sh for email notifications

         Detect as suspicious, scripts found within /images/ and /upload(s)/
         directories

	 Fixed --Wadd [file] not working correctly in cxs watch

	 Fixed --www not being adhered to for new users while cxs watch running

	 Modified --www location on DA servers to the domains/ subdirectory of
	 users account for cxs watch daemon and single user scans

	 Improvements to file ownership detection in cxs watch. If a file is
	 owned by "nobody" cxs will compare user home directories in
	 /etc/passwd to the file location to try and determine a unique owner

	 Fixed UI saving default "smtp" setting incorrectly (again)

2.83   - Updated to use the new cPanel 11.36+ integrated perl binary if exists

	 Fixed UI saving default "smtp" setting incorrectly

	 Modified --www location on DA servers to the domains/ subdirectory of
	 users account as public_html/ is ignored as it is a symlink

2.82   - Added new advanced PHP decoder

         Impovements to detection of PHP script file type

	 Added new functionality to --xtra [file] to force quarantine of a file
	 with a matching regex if using --quarantine[dir]. See documentation or
	 the latest /etc/cxs/cxs.xtra.example for information

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.81   - Fixed a false-positive with the main .htaccess regex

         Fixed UI not correctly saving --MD5 to cxs.defaults if set

	 Fixed issue with temp file cleanup not reinitialising between scans

2.80   - Add scan type to Quarantine output for each entry

         Added timezone offset to cxs --mail emails

	 Improvements to the main decoder regex

	 Improvements to advanced PHP decoders to --decode ([D])
 
	 Exploit fingerprint definitions database additions

2.79   - Improved settings initialisation when scanning multiple files

         Added xtra supplied md5sum values to the report to help with match
	 identification

	 Removed the instructions for installing unofficial ClamAV databases as
	 we don't support them

2.78   - Improvements to various advanced PHP decoders

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.77   - Ensure htaccess fingerprints only apply to .htaccess files

         On cPanel servers hide the Support icon introduced by cPanel in v11.34

	 Added unsupported feature --YSKIPFPREGEX to ignore inbuilt fingerprint
	 regular expression matching when using --options [M], --xtra [file]
	 contents will still match

	 Added scanning for jsp scripts

	 Added scanning for asp and aspx scripts

	 Added scanning for java scripts

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.76   - Update to one of the main decoder regexes

2.75   - Added multiple new advanced PHP decoders

         Improvements to the main decoder regex
	 
	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.74   - Improvements to the daily update mechanism

         Fixed a false-positive with the main .htaccess regex

2.73   - Fixed a problem where compressed file depth was not being reset
         between files causing subsequent compressed files to be skipped from
	 scanning

	 Fixed problem where multi-depth compressed files were not being
	 identified by their original filename correctly

	 Added compressed file depth to output when matches found

2.72   - Added PNG and JPEG filetypes for hidden script scanning

         Fixed an issue where cxs was sometimes leaving temporary files in /tmp
	 after compressed file expansion

2.71   - cxs will now treat .htaccess files as script files and fingerprints
         have been added for common exploits

	 Added more information about existing csf anf cxs integration options
	 (i.e. UI, ModSecurity, pure-ftpd)

	 Added information that restores from quarantine must be done through
	 the UI

	 Exploit fingerprint definitions database additions

2.70   - Improvements to cxs Watch daemon ignore/xtra and new update reloading
         without restart

	 Switched to using Sys::Hostname in cxs Watch daemon

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.69   - Switched to using Sys::Hostname to determine hostname as CloudLinux
         restricts access to /proc/sys/kernel/hostname for some reason

2.68   - Modified POD and UI to show full rather than abbreviated commands

         Added new option --template [file]. When using --mail [email] a
	 standard email format is used. To customise this format an email
	 template file can be used instead. You can now use this to email the
	 Linux owner of the affected script under certain circumstances. See
	 the cxs Documentation for more information

	 Added new advanced PHP decoder for --decode ([D])

	 Improvements to advanced PHP decoders to --decode ([D])

	 Fixed PHP decoder issue that could restrict decoder depth under
	 certain circumstances

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.67   - NOTE: If you are using the cxs ModSecurity hook and ModSecurity v2.6,
	 you must now specify the ModSecurity configuration setting SecTmpDir.
	 If you have not set SecTmpDir in your ModSecurity configuration, then
	 you need to add the following on its own line before or after the
	 ModSecurity cxs line: "SecTmpDir /tmp" and then restart httpd. The
	 file you need to add this to, if not already present, on a cPanel
	 server is: /usr/local/apache/conf/modsec2.user.conf

         Unless specified, --qoptions now defaults to [Mv] when
         --quarantine [dir] is used. Any existing installations using
	 --quarantine [dir] will now have --qoptions [Mv] enabled, unless
	 otherwise specified on the command line or in cxs.defaults

	 Added unsupported feature --YSKIPREG to ignore inbuilt regex matching
	 when using --options [m], --xtra [file] contents will still match

	 Added unsupported feature --YSKIPMD5 to ignore inbuilt fingerprint
	 matching when using --options [M], --xtra [file] contents will still
	 match

	 Added a new option, --doptions [mMfSGchexTEv]. This defaults to [Mv]
	 when --delete is used. Any existing installations using --delete will
	 now have --doptions [Mv] enabled, unless otherwise specified on the
	 command line or in cxs.defaults

	 Fixed an issue where, under certain circumstances, files contained
	 within an archive were ignored for scanning

2.66   - Improvements to string detection in --decode ([D])

	 Added new advanced PHP decoder for --decode ([D])

	 Removed a false-positive fingerprint detection

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.65   - Added new advanced PHP decoder for --decode ([D])

         Improvements made to md5sum ignore procedure

	 Fixed problem when using md5sum ignore within archives

2.64   - Improvements to --decode ([D]) variable detection

	 Added new advanced PHP decoder for --decode ([D])
	 
	 Exploit fingerprint definitions database additions

2.63   - Additional reasons for scan skipping added for --debug output

         Reload ignore file in cxs watch parent as well as children for rate
	 limit warning

	 New feature added --Wrateignore [secs]. To help prevent excessive
	 resource usage, cxs Watch will ignore files for [secs] seconds if the
	 rate limit warning is issued. Scanning will then resume. Set this to 0
	 to disable the ignore feature. This option is set to 300 (i.e. 5 mins)
	 for new installations

2.62   - Removed extraneous / in the cgi email notification for the "Web upload
         script URL"

	 Added cxs Watch logging for Inotify IN_Q_OVERFLOW events with a
	 recommendation to increase /proc/sys/fs/inotify/max_queued_events if
	 this occurs

	 Added file check before invoking Inotify to confirm it exists to avoid
	 spurious errors on VPS servers

	 Allow files as well as directories in --Wadd [file]

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

2.61   - Improvements to hidden script file detection

	 Added formatting to cgi and ftp email reports

	 Added new fields to the cgi email report

	 Change POD Examples section to use full command line options

	 Improvements to ignoring any files based on md5sum (including those
	 identified as exectuables, viruses, etc)

	 Remove extraneous spaces from ignore and xtra md5sum entries

	 Improvements to --MD5 so that all reported files displays the md5sum

	 Changed the way md5sum values are displayed if --MD5 is used

	 Improvements to the main decoder regex

	 Exploit fingerprint definitions database additions

2.60   - Ensure that an account name is only passed to --script [script] when
         performing a manual scan using --user or --all

	 Ignore adobe-xap-filters when detecting hidden script files

	 Exploit fingerprint definitions database additions

2.59   - Improvements to quarantine procedure

2.58   - Fixed a problem in the UI where the selections for --options were
         applied from /etc/cxs/cxs.defaults, if set, rather than the selections
	 in the UI if all the standard selections were ticked

	 UI improvements

	 Change file name check behaviour so that it still detects with empty
	 files

	 Include all item sizes in --summary report

	 Include all ignored files in --summary report

	 Improvements to hidden script file detection

	 Exploit fingerprint definitions database additions

2.57   - Fixed problem with quarantine move failing - introduced in v2.56

         Implement ignores for rate limit warnings in cxs Watch daemon

         Allow a value of 0 for --filemax [num] which disables the feature

	 Set --filemax [num] to 0 in cxswatch.sh for new installs

2.56   - Improvements to quarantine move failure message

         Implement ignores in compressed files

	 Added a rate limit warning to cxs Watch daemon. If a file is scanned
	 more then (2 * Wsleep) times in (10 * Wsleep) seconds then a warning
	 is logged. This is to help identify frequently scanned files that you
	 might want to ignore (e.g. if they are very frequently updated log
	 files)

	 Improved installation procedure for checking required perl modules

	 Exploit fingerprint definitions database additions

2.55   - Changes to htaccessdisable.pl example script

         Increased default value for --filemax [num] in cxswatch.sh for new
	 installs

	 If necessary, log license error to cxs Watch daemon log

2.54   - Added logrotate configuration for cxswatch

         Include an example perl script that will disable directory access with
	 a .htaccess file if a match is found using the --script [script] 
	 option: /etc/cxs/htaccessdisable.pl

	 Modifications to cxs Watch daemon so that it no longer needs to
         completely restart when new daily detections are downloaded

	 Always log if skipping directories in cxs Watch daemon due to
	 --filemax [num]

	 Fixed a problem with a false-positive in the php interpreter timeout

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.53  - Timeout added for php interpreter during --decode ([D])

         Do not disable --viruscan if clamd not running in cxs Watch

	 Exploit fingerprint definitions database additions

v2.52  - cxs Watch will now fail to start or will terminate on VPS servers if
         /proc/sys/fs/inotify/max_user_watches is set too low

	 Added error reporting if clamd fails to respond, but stop reporting
	 clamd errors if too many consecutive errors occur

	 Updated POD regarding the new csf option: LF_CXS

v2.51  - Improved temporary file cleanup

         Change cxs UI to use /sbin/pidof to determine if the Watch daemon is
	 stopped, starting or running. If /sbin/pidof does not exist, no
	 status is shown

	 Modification to prevent scan failure if FTP is down and --options [P]
	 used

	 Exploit fingerprint definitions database additions

v2.50  - Improvements to the Fingerprint Matching system

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.49  - Use temporary files when performing a virus scan during --decode ([D])

	 Change all clamd STREAM to SCAN scanning

	 Use a robust routine for creating random temporary files during 
	 --options [Z] (scanning within archives)
	 
	 Exploit fingerprint definitions database additions

v2.48  - Allow a value of 0 for --Wrefresh which disables the functionality in
         the cxs Watch daemon

	 Added new advanced PHP decoder for --decode ([D])

	 Stop cxs Watch from following symlinks

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.47  - Added new advanced PHP decoders for --decode ([D])

         Change main cxs Watch process name during startup while still starting

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.46  - Added two new advanced PHP decoders for --decode ([D])

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.45  - Modification to quarantine to ensure unique filenames

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.44  - Added new --ignore [file] option pscript: - regex of web script to
         ignore

	 Set --options [P] ftp timeout to 10 seconds

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.43  - SECURITY FIX. Anyone running cxs on a DirectAdmin server should
         upgrade to this release immediately

         Add check for successful open of admin.list on DA servers to avoid a
	 segfault, which could lead to a buffer overflow

v2.42  - Fixed problem where dir: ignores where not being fully implemented in
         single file scans

	 Fixed problem where dir: and hdir: ignores where not being fully
	 implemented by the cxs Watch daemon when auto-reloading an ignore file

	 Exploit fingerprint definitions database additions

v2.41  - Developed another new advanced PHP decoder for --decode ([D])

         Fixed advanced decoder output formatting when using --decode [file]

	 Exploit regex definitions database additions

v2.40  - Modifications to cxs Watch daemon so that it no longer needs to
         completely restart if changes to --xtra [file] are detected

	 Added detection and decoding of Hex encoding to advanced PHP decoders

	 Exploit fingerprint definitions database additions

v2.39  - Memory management and speedup improvements for cxs Watch Daemon

         Improvements to advanced PHP decoders to --decode ([D])

	 Corrected cxs POD to read --upgrade instead of --update

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.38  - Added more advanced PHP decoders to --decode ([D])

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.37  - cxs Watch - report error if unable to increase
         /proc/sys/fs/inotify/max_user_watches

	 Further improvements to --timemax [secs] reports

	 Further improvements to error reporting during scans

	 Exploit fingerprint definitions database additions

v2.36  - cxs Watch will now restart if a change to a specific --xtra [file] is
         made. This triggers a full restart of cxs Watch

	 Improvements to --timemax [secs]

	 Improvements to error reporting during scans

	 Added more advanced PHP decoders to --decode ([D])

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.35  - Added new option --timemax [secs]. Scan timeout per file in seconds to
         prevent looping. Default is 30 seconds

         Additional logging on cxs watch startup to show the progress of user
	 account inotify setup

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.34  - Modifications to the UI

         Updates to the failure detection of the quarantine procedure

         New option --force. If --force is not used then cxs will refuse to
         scan within restricted directories: /usr /var /bin /lib /lib64 /boot

	 Modified daily update check to only restart cxs Watch if updates are
	 actually new

	 Modified cxs Watch to no longer require a /scripts/postwwwacct entry
	 (which is now ignored) as it now monitors /var/cpanel/users/ for new
	 users on cPanel servers

	 Exploit fingerprint definitions database additions

v2.33  - Redesigned cxs UI, included functions for controlling cxs Watch

         Added TERM logging to the cxs Watch daemon to signify termination

v2.32  - Added init script for cxswatch daemon on cPanel servers. This is
         instead of using /etc/rc.local to start the daemon and can also be
	 used to stop/start/restart/status the daemon. See the cxs 
	 documentation for more information

	 Added entry to chkserv.d on cPanel servers so that cPanel will monitor
	 the cxswatch daemon using tailwatchd. See the cxs documentation for
	 more information

v2.31  - Fixed issue with tarball and zip file contents checking

         Further improvements to the Fingerprint matching system

	 Exploit fingerprint definitions database additions

v2.30  - Significant speedups for pattern matching

         Improvements to the Fingerprint matching system which includes
         speedups and additional identification methods

	 Fixed error message for scanning an non-existent file

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.29  - Fixed problem with quarantine file naming convention causing duplicate
         file names under certain circumstances and failing to quarantine the
	 second instance

	 Fixed spurious Cpanel::Version::gettree() warning in cPanel error log

	 Exploit regex definitions database additions

v2.28  - Fixed problem with cxs Watch daemon restart introduced in v2.2.27. You
         will have to manually restart any running cxs Watch daemon after this
	 upgrade

	 If BSD::Resource perl module is installed, double the configured
	 process stack size to help avoid Segmentation Faults

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.27  - New --options [P]. This option will search standard web application
         configuration files for MySQL database passwords. It will then attempt
	 to login via FTP on localhost with the username of the account being
	 processed and the detected password (it will attempt up to two
	 password hits per configuration file). If the login is successful, the
	 option will trigger a match. See CLI documentation for more info

	 Separated and highlighted advanced Exploit Scan options in the UI that
	 can affect user data and/or produce false-positives in the vain hope
	 it will stop some people just ticking everything and then wondering
	 where their files have gone

	 Added Net::FTP to the perl module requirements (this is a core perl
	 module so should already be installed)

	 New options --uidmin [uid] and --uidmax [uid] for the GENERIC install
	 when used with --allusers. These have no effect on cPanel and DA

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.26  - Added new option for --xtra [file]: regfile: which is a regular
         expression match for a file or directory name

	 Added new CLI option --smtp. This will send emails generated by --mail
	 [email] via localhost SMTP instead of sendmail

	 Added MIME::Base64 and Net::SMTP to the perl module requirements (both
	 are core perl modules so should already be installed)

v2.25  - Fix for UI version processing issue

v2.24  - Allow binary submissions via --wttw

	 Improvements to --decode ([D]) option

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.23  - Improved cxs Watch daemon scanning to include moved files to detect
         files uploaded by the cPanel File Manager

	 Fixed bug where --cleanlog [file] was not logging the filename for
	 cxsftp.sh scanning

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.22  - Exploit regex definitions database correction

v2.21  - Speedups to --decode ([D]) option

         Improvements to decode regex

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.20  - Fixed issue with MD5 setting via UI when saving to defaults

         Improvements to regex validation to any specified --ignore or --xtra
	 files

	 Improvements to decode regex

	 Improvements to --decode ([D]) option

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.19  - Added regex validation to any specified --ignore or --xtra files

         Added quarantine failure reason to messages

	 Improvements to --decode ([D]) option to no longer use temporary files

	 If [Fingerprint Match] found also perform a Virus Scan

	 Automatically ignore --quarantine [dir] during scans

	 Improvements to fingerprint matching

	 Added new option --MD5 to display a matched file md5sum. See docs for
	 more information

	 Added new option md5sum: to --ignore [file]. See docs for more
	 information

	 Added new option md5sum: to --xtra [file]. See docs for more
	 information

	 Added new option "Ignore MD5" to cxs Quarantine UI for ftp, web and
	 scan entries

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.18  - Further improvements to Filetype detection

v2.17  - Added hdir:/quarantine_clamavconnector to the csf.ignore.example file

         Improvements to php script detection where extension is not .php

	 Filetype detection speedups

	 Filetype differentiation between MS-DOS and MS Windows executables

	 Added new option --Wrefresh. To keep the cxs Watch daemon up to date,
	 it will restart every 7 days by default. To change this interval, you
	 can set B<--Wrefresh [days]>

	 Improvements to the decode regex

	 Exploit regex definitions database additions
	 
	 Exploit fingerprint definitions database additions

v2.16  - Further improvements to the check for PHP code hidden in GIF image
         files for "hidden script file", regex matching and decode scanning

v2.14  - Improvements to the check for PHP code hidden in GIF image files for
         "hidden script file", regex matching and decode scanning

	 Add link to the Changelog when cxs is upgraded

	 If an ignore file us used with cxs Watch daemon and the ignore file is
	 modified, cxs Watch will reload the ignore file and restart the child
	 processes. However, after making a large number of changes to the
	 ignore file or if adding puser: or user: to the ignore file, the cxs
	 Watch daemon should be manually restarted

	 Improved cxs Watch logging when suspicious file found and --Wloglevel
	 set to 0

	 Exploit fingerprint definitions database additions

v2.13  - During cxs Watch startup default to the POSIX locale to avoid error
         message ambiguity for intotify from the kernel

	 Improvements to --decode ([D]) option

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v2.12  - Improvements to --decode ([D]) option

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v2.11  - Further SECURITY improvements to Quarantine functionality

	 All cxs users should upgrade to this release immediately

v2.10  - Fixed a SECURITY BUG in Quarantine file restore which could result in
         root privilege escalation. The destination restore file must not now
	 exist before restoring will work. Our thanks to Jeff Petersen for
	 reporting this issue

	 All cxs users should upgrade to this release immediately

v2.09  - New --options [R]. It will trigger a match for the inbuilt regex used
         by --options [D] when decoding PHP encoded (base64, etc) scripts

	 Improvements to --decode ([D]) option so that both the last and the
	 penultimate decode level are both scanned

	 Added improved code for dropping privileges to the "nobody" user while
	 running the interactive php interpreter as root

	 Ensure Quarantine only works on files

	 Updated UI text for options

	 Removed duplicated regex definitions from the database now that
	 --options [R] has been added. Be sure to add R to your --options lists
	 if you specify them if you still want to trap these.

v2.08  - Removed code that dropped privileges to the "nobody" user while
         running the interactive php interpreter as it broke subsequent
	 scanning at depth

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v2.07  - Improvements to --decode ([D]) option

         New Feature - Added daily check for new Exploit Fingerprints. If cxs
	 is scheduled to check for a new version daily, an additional check for
	 new Exploit Fingerprints released since the last cxs version is
	 performed. These will be downloaded and used on subsequent scans

	 Exploit fingerprint definitions database additions

v2.06  - Fixed bug in application type detection introduced in v2.04 which
         restricted script specific regex detection from working correctly

	 Exploit fingerprint definitions database additions

v2.04  - Added Quarantine UI option to block FTP IP addresses in csf

         Fixed Quarantine UI display problems

         Added option --tscripts [list] which is a comma separated list of
	 scripts that --options [T] will detect if you want to restrict which
	 types are checked

	 Exploit fingerprint definitions database additions

v2.03  - Improvements to --decode [file] - don't process ignore file

         Speedups for --options [D]

	 Speedups for cxs Watch daemon startup

	 Fixes to cxs Watch daemon when processing new and --Wadd [file] 
	 directories where --ignore [file] and --filemax [num] were not
	 applied

	 Improvements to hdir, hfile and hsym processing for --ignore [file]

	 Adjustments to --Wloglevel [num]

	 Improvements to FTP IP detection 

v2.02  - Fixed bugs in --decode [file] output report and improved content of
         the report

	 Exploit fingerprint definitions database additions

v2.01  - Modified --decode [file] and --options [D] to drop privileges to the
         "nobody" user while running the interactive php interpreter and
	 on the ownership of the decoded file while processing it
	 
v2.00  - Added new scanning option: cxs Watch. This is an alternative to ftp
         and web script upload scanning. The cxs Watch daemon uses a separate
	 process to watch entire user accounts for new and modified files and
	 scans them immediately. The scanning children use up significantly
	 fewer resources than the ftp and web script upload scanning methods.
	 This new feature requires:
		Redhat/CentOS v5+ (i.e. a kernel that supports inotify)
		Linux::Inotify2 Perl module
	 Systems that do not meet these requirements can continue to use the
	 ftp and web script upload scanning methods. See the documentation for
	 more information about this new option under --Wstart

	 --options [D] now enabled by default to improve exploit detection
	 rates (default options:mMOLfSGchexdnwZD)

	 Updated POD documentation, including a new RECOMMENDATIONS section

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.56  - Reinstated the Scan Report header for the --all option lost in v1.55

         Added new option --www to only scan within the public_html/ directory
	 when using --allusers or --user [user]

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.55  - Modified FTP IP Address lookup code to only read the last 64K of the
         relevant log file, improving lookup speed and resource usage

	 Made /etc/init.d/pure-uploadscript LSB compliant

	 Exploit fingerprint definitions database additions

v1.54  - Added a note to the CGI alert email for ModSecurity false-positives
         where the request body is inspected before Apache has a chance to
	 determine whether the called script exists (i.e. a 404)

	 Added new option --wttw [file] which is available for submitting text
	 exploits (i.e. PHP, Perl, Shell) to ConfigServer if cxs fails to
	 detect it. The file is sent as an attachment via email. Please be sure
	 to read the documentation before using this option

	 Exploit fingerprint definitions database additions

v1.53  - Sort File::Find directory traversal/files alphabetically

         Multiple scanning performance and resource usage improvements

	 --voptions [M] removed as it serves no function

	 Added text for --options [M] (Known exploit) where we have it

	 Improvements to relative path file/directory scanning

	 Exploit fingerprint definitions database additions

v1.52  - Ignore SIGPIPE when using --decode (--options [D]) while running
         interactive php interpreter, which caused scans to abort

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.51  - Sort Quarantine UI users

         If --quarantine or --delete fails (e.g. an immutable file), report
	 failure to do so. Failure to quarantine will no longer attempt removal
	 of the original file

	 Only "View" quarantine files in UI if they are text files

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.50  - Fixed a problem with the use of File::Copy and the quarantine system
	 where files that are moved across file systems do not retain the
	 correct permissions

v1.49  - Display complete cxs command options at the top of reports, not just
         the CLI command (i.e. include defaults and cxs.default entries)

	 Added a "View Quarantine" button at the bottom of the "View Quarantine
	 User" UI page to return to the quarantine view

	 Added default clamd rpm and apt-get socket location detection
	 (/var/run/clamav/clamd.sock and /var/run/clamav/clamd.ctl)

	 DirectAdmin development work (not currently supported)
	 (RedHat Enterprise v3+/CentOS v3+/Debian v5+)

	 Added code for future multiple license servers

	 Fixed a problem with the use of File::Copy and the quarantine system
	 where files that are moved across file systems do not retain the
	 correct ownership

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.48  - Modified FTP scanning to honour hfile: ignore file entries

         Fixed problem with --qoptions [] sending all scan result matches to
	 quarantine after a single legitimate match was found, regardless of
	 the --qoptions [] specified

v1.47  - Fixed problem with UI upgrade sleeping before upgrading (as introduced
         for cron jobs). Upgrading to this version will still sleep through the
	 UI, but subsequent versions should be fine. Instead of using the UI,
	 using the CLI will avoid this problem for this upgrade, i.e.: cxs -U

v1.46  - Restore from quarantine in UI now preserves file ownership of the
         restored file

	 Prefill UI Quarantine directory if set in cxs.defaults

	 Added new option to Quarantine UI to bulk Restore files in the same
	 way as bulk Delete works

	 Exploit fingerprint definitions database additions

v1.45  - Added new option --qoptions [mMOLfSGchexdnwTEv]. By default
         --quarantine [dir]> will move all file matches. If --qoptions [] is
	 also used then only the selected file types will be moved

	 Added --qoptions [mMOLfSGchexdnwTEv] to UI

	 Improvements to --decode ([D]) option

	 Added --upgrade timer to sleep for up to 1800 seconds when running as
	 a cron job to avoid overloading the license server

	 Added the the --jumpfrom [user] and --jumpto [user] options to the UI

	 Exploit fingerprint definitions database additions

v1.44  - Added Quarantine option to UI

         Modified the --jumpfrom [user], --jumpto [user] options so a special
	 value can be used for the from and to [user] using a single letter
	 then a plus sign to scan those users whose name begins with the letter
	 specified (not case sensitive). Again, this is inclusive. For example,
	 to scan all accounts beginning with k through to g use:
	 --jumpfrom k+ --jumpto g+

	 Improvements to --decode ([D]) option

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.43  - Improvements to --decode ([D]) option. If the final decode depth
         results in a php Parse error, the previous depth is scanned instead.
	 This improves the likelihood of a successful decode and scan

	 Improvements to --decode ([D]) option. Decode PHP scripts in memory
	 using the interactive php interpreter instead of using temporary files

	 Improvements to --decode ([D]) option. Add timeout to php interpreter
	 to avoid decoding hangs

	 Exploit fingerprint definitions database additions

v1.42  - Suppress error output from Archive::Zip

v1.41  - Enabled option --options [Z] by default for scanning within compressed
         archives

	 Suppress error output from Archive::Tar

	 Exploit fingerprint definitions database additions

v1.40  - Improved detection of ruby and c exploits

         Added the ability to use --quarantine and --delete when performing a
	 manual or scheduled scan. However, since the likelihood of a
	 false-positive is relatively high, this is not recommended without
	 care and understanding of the implications

	 Added test for existence of --quarantine [dir]. If it does not exist
	 an error will be shown and the scan will continue with the quarantine
	 directive disabled

	 New --options [Z]. This option decompresses archives (i.e. zip, tar,
	 tar.gz and tar.bz2 files) and scans each file within the archive
	 using the same options provided to the original scan

	 Added --options [Z] to WHM UI

	 Updated perl modules requirements to now include: Archive::Zip and
	 Archive::Tar

	 Cater for single quotes in cron jobs in the WHM UI

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.39  - Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.38  - Improvements to --decode ([D]) option

         Added [D] option to WHM UI

	 Fixed typo in WHM UI

	 More detailed message for when --filemax reached in a directory

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.37  - Fixed bug in --options [D] when running under a non-root account

         Modified --script [script] execution to prevent stray output from
	 [script] when --quiet used

	 Added retry timeout in WHM UI for checking www.configserver.com for
	 new version information (to avoid repeated hangs when unreachable)

	 Included additional instructions in install.txt to install additional
	 unofficial ClamAV databases from Sanesecurity

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.36  - Significant Improvements to --decode ([D]) option

         Added verbose switch to example cPanel Account Suspend perl script

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.35  - Optimised fingerprint definitions database

         Removed fingerprint definitions database false-positive

v1.34  - Fixed licensing issue with v1.33

v1.33  - Updated example cPanel Account Suspend perl script to be verbose

         cxs startup speedups

	 Add support to --script to pass the username when using --user [user]

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.32  - Include an example cPanel Account Suspend perl script for use with
         --script /etc/cxs/cpanelsuspend.pl

	 Exploit fingerprint definitions database additions

v1.31  - Always exit if ftp/cgi user is listed in a specified ignore file

         Disable pure-uploadscript if /etc/cxs/ftpddisable exists (in addition
	 to /etc/ftpddisable)

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.30  - Added new option --script [script] which runs an external script
         whenever a match is detected against a file. See documentation for
	 more information

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.29  - Significant improvements to --decode [file]

         Increased LWP timeout to cater for servers with slow connections to
	 the license server

	 Added total Viruses and Fingerprint Matches to the --mail Subject

	 Added total Fingerprint Matches to the --summary

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.28  - If ftp is disabled in cPanel do not start pure-uploadscript

         New --options [E]. This option will match scripts that send out email
	 using sendmail, exim or via SMTP. This option requires that --options
	 [m] is also specified

         Improvement to --decode [file] variable detection

	 Improvements to various eval() regex matches

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.27  - Fixed issue introduced in v1.26 that prevented ignoring of hdir and
         hfile options in an ignore file

v1.26  - Allow the use of --background (-B) in cxsftp.sh

         Skip processing a home directory of / when using --all

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.25  - Improved handling of --decode failures

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.24  - Improvements to --decode [file]

         Add the cxs command line to a report even if the scan report is empty

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.23  - Fixed a false-positive detection of c/c++ source files

         Added filename legend to View option UI in Other Files

	 For single or multiple user scans, Symlinks within the homedir will
	 now be ignored

	 Removed [\;\|\`\\] regex checks from the [f] and [d] --options, as it
	 appears to be of little value (you could always add back such a check
	 using a similar regex entry in an xtra file)

	 Modified hidden text in image file check to only report if the text is
	 script code

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.22  - Fixed --options [D] output not going to a --report [file]

         Improvement to --decode [file] variable detection

	 Exploit fingerprint definitions database additions

v1.21  - Added UID check to ensure updates are only performed by root (UID=0)

         New --options [D]. This is an experimental option that puts any PHP
	 scripts containing an eval() function that decodes base64 and rot13
	 data through the (experimental) --decode [file] option during a scan.
	 This will then highlight the decoded result if it hits any regex,
	 fingerprint or virus scan matches

	 Added eval(str_rot13 to --decode [file]

	 Fixed --decode [file] not scanning final decoded result with regex
	 definitions and fingerprints

	 Improvements to --decode [file] detection and processing

	 Modified pure-uploadscript init file to cope with multiple pure-ftpd
	 pids on restart and to stop pure-ftpd more cleanly

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.20  - Improvements to regex definitions database

         Added new ignore options for sym:, psym: and hsym: to allow ignoring
	 of symlinks

	 Modified --generate to add sym: for symlinks to ignore file

	 All UI user selections modified to be dropdown lists

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.19  - Fixed bug preventing csf from blocking FTP IP addresses when --block
         used

	 Added failure message from csf to FTP email if deny fails

         Added new exploit scanning option W to be used with --option (must be
	 explicitly added to the options list - the same way as the C option).
	 The W option will chmod all world writable directories found to 755.
	 Use this option with care as it could prevent web scripts from
	 functioning on non-suPHP or non-SUEXEC enabled systems

v1.18  - Scanning speedup when using --voptions

         Improvements to --decode performance and effectiveness

	 New optimised fingerprint database. This new database, though with
	 fewer entries, is better targetted at detecting relevant exploits that
	 ClamAV misses (the majority!)

	 Changed "Match for fingerprint of an exploit" to
	 "Known exploit = [Fingerprint Match]"

	 Changed "Match for regular expression (regex)" to
	 "Regular expression match = [regex]"

v1.17  - Fixed email " (Hits:nn)" not totalling all accounts hits

v1.16  - Removed spurious "set to skip" message text

	 Added " (Hits:nn)" to the Subject line of email reports

	 Added new option --ulist [file] for use with the --all option to
	 perform scans of only those users listed in [file]

	 Regex scanning improvements

	 Disable default deep scanning on FTP and web script uploads to help
	 avoid false-positives. If you want to continue deep scanning add
	 --deep to cxsftp.sh and/or cxscgi.sh

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.15  - Added breakout if --decode [file] depth is > 250 to prevent looping

         Fixed problem with quarantine UI to cope with a trailing slash on the
	 --quarantine [dir] statement

	 Improved detection of the quarantine directory in UI

	 Added DNS lookups on FTP IP address reports

	 Allow the use of floating point numbers with --throttle [num]

	 Added "Ignore" option for FTP quarantines files to Quarantine UI to
	 add a file: ignore statement to a relevant ignore file if configured

	 Added new options --jumpfrom [user] and --jumpto [user] for use with
	 the --all option to perform scans of only those user between the two
	 points, both of which are inclusive

	 Added jumpfrom and jumpto to UI resource choice

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.14  - Added new experimental options --decode [file] and --depth [num]. See
         the perldoc documentation for more information

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.13  - Modified FrontPage extensions check to be case-insensitive

         Use of --all --mail [email] and --nosummary will now only report
	 suspicious accounts instead of all accounts. --report [file] will
	 still contain the full report

	 Updated cxs perldoc help

	 Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.12  - New option (-X, --xtra [file]) to allow custom regular expression
         matches and filenames that cxs will additionally scan for

	 Exploit fingerprint definitions database additions

v1.11  - Modified hidden image text file to exclude most FrontPage extensions
         files

         Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.10  - Added new check to suspicious file routine to detect text files hiding
         as image files

	 Made file extension checks case-insensitive

	 Exploit fingerprint definitions database additions

v1.09  - Improved licensing code tolerance on network failure for web and ftp
         scanning on servers that are behind NAT

         Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

	 Ftp and web scanning speedups

v1.08  - Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.07  - Exploit regex definitions database additions

	 Exploit fingerprint definitions database additions

v1.06  - Fixed issue with pure-uploadscript restart on cron job cxs upgrade

	 Exploit fingerprint definitions database additions

v1.05  - Improved UI detection of the quarantine directory in cxsftp.sh and
         cxscgi.sh if used

v1.04  - Fixed duplicate virus scan on script files with regex matches

	 Exploit fingerprint definitions database additions

v1.03  - Added quotes around the $1 parameter in cxscgi.sh and cxsftp.sh to
         cope with files with spaces in their names. Existing scripts will be
	 fixed on upgrade

v1.02  - Added initial FreeBSD (v7.2) support - currently no UI cron job
         support has been implemented, jobs will have to be added to
	 /etc/crontab manually on FreeBSD

         Fixed UI quarantine restore to always use correct uid and gid

	 Exploit fingerprint definitions database additions

	 Added some more examples to the POD and reference the examples in
	 cxsftp.sh and cxscgi.sh

v1.01  - Added new exploit scanning option M to be used with --option (enabled
         by default) and --voption. The M option scans a fingerprint lookup
	 table of over 4500 known exploit scripts. If you cron jobs or have
	 modified cxsftp.sh or cxscgi.sh that use an --options list, you might
	 want to add M to the list to use this new feature

	 Digest::MD5 added to required perl modules

         Added extra check in UI where alternative clamdsock is ticked but none
         entered in the textbox

	 Exploit regex definitions database additions

	 Don't show user in quarantine UI if empty
	 
v1.00  - Initial release
