feat(security): PHP file integrity scanner with threat scoring #258

New Issue

2026-06-23T17:00:23Z

jmiller commented

2026-06-23 17:00:23 +00:00

PHP File Integrity Scanner

Overview

Hash-based file integrity monitoring that detects new, modified, and deleted PHP files between scans. Assigns threat scores based on file patterns and locations. Comparable to Akeeba Admin Tools Pro and RSFirewall.

Features

Baseline scan — store MD5+SHA1 checksums of all PHP files on first run
Differential scan — compare current files against stored baseline
Threat scoring — weight changes by location (core files = high, templates = medium, tmp = critical)
New file detection — flag PHP files that didn't exist in baseline
Deleted file detection — flag missing files that were in baseline
Modified file detection — flag files with changed checksums
Joomla core hash comparison — verify core files against known-good hashes from Joomla's update server
Scheduled scanning — task plugin for periodic automatic scans
Email/ntfy alerts — notify on scan completion with findings summary
Scan history — track changes over time with diff viewer
Exclusion list — configurable paths to skip (cache, tmp, etc.)

Database Schema

CREATE TABLE #__mokosuiteclient_file_hashes (
  id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  scan_id INT UNSIGNED NOT NULL,
  file_path VARCHAR(500) NOT NULL,
  md5_hash CHAR(32),
  sha1_hash CHAR(40),
  file_size INT UNSIGNED,
  file_modified DATETIME,
  threat_score TINYINT UNSIGNED DEFAULT 0,
  status ENUM('unchanged','modified','new','deleted') DEFAULT 'unchanged',
  KEY scan_id (scan_id),
  KEY status (status)
);

CREATE TABLE #__mokosuiteclient_file_scans (
  id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  started DATETIME NOT NULL,
  completed DATETIME,
  total_files INT UNSIGNED DEFAULT 0,
  new_files INT UNSIGNED DEFAULT 0,
  modified_files INT UNSIGNED DEFAULT 0,
  deleted_files INT UNSIGNED DEFAULT 0,
  max_threat_score TINYINT UNSIGNED DEFAULT 0
);

Competitive Gap

Akeeba Admin Tools Pro charges EUR 50/yr for this
RSFirewall includes this in their EUR 49 package
This is the #1 competitive gap identified in market research

## PHP File Integrity Scanner ### Overview Hash-based file integrity monitoring that detects new, modified, and deleted PHP files between scans. Assigns threat scores based on file patterns and locations. Comparable to Akeeba Admin Tools Pro and RSFirewall. ### Features - **Baseline scan** — store MD5+SHA1 checksums of all PHP files on first run - **Differential scan** — compare current files against stored baseline - **Threat scoring** — weight changes by location (core files = high, templates = medium, tmp = critical) - **New file detection** — flag PHP files that didn't exist in baseline - **Deleted file detection** — flag missing files that were in baseline - **Modified file detection** — flag files with changed checksums - **Joomla core hash comparison** — verify core files against known-good hashes from Joomla's update server - **Scheduled scanning** — task plugin for periodic automatic scans - **Email/ntfy alerts** — notify on scan completion with findings summary - **Scan history** — track changes over time with diff viewer - **Exclusion list** — configurable paths to skip (cache, tmp, etc.) ### Database Schema ```sql CREATE TABLE #__mokosuiteclient_file_hashes ( id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, scan_id INT UNSIGNED NOT NULL, file_path VARCHAR(500) NOT NULL, md5_hash CHAR(32), sha1_hash CHAR(40), file_size INT UNSIGNED, file_modified DATETIME, threat_score TINYINT UNSIGNED DEFAULT 0, status ENUM('unchanged','modified','new','deleted') DEFAULT 'unchanged', KEY scan_id (scan_id), KEY status (status) ); CREATE TABLE #__mokosuiteclient_file_scans ( id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, started DATETIME NOT NULL, completed DATETIME, total_files INT UNSIGNED DEFAULT 0, new_files INT UNSIGNED DEFAULT 0, modified_files INT UNSIGNED DEFAULT 0, deleted_files INT UNSIGNED DEFAULT 0, max_threat_score TINYINT UNSIGNED DEFAULT 0 ); ``` ### Competitive Gap - Akeeba Admin Tools Pro charges EUR 50/yr for this - RSFirewall includes this in their EUR 49 package - This is the #1 competitive gap identified in market research

jmiller added this to the v03.00.00 milestone 2026-06-23 17:00:23 +00:00

jmiller commented

2026-06-23 17:00:27 +00:00

Branch created: feature/258-feat-security-php-file-integrity-scanner

git fetch origin
git checkout feature/258-feat-security-php-file-integrity-scanner

Branch created: [`feature/258-feat-security-php-file-integrity-scanner`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteClient/src/branch/feature/258-feat-security-php-file-integrity-scanner) ```bash git fetch origin git checkout feature/258-feat-security-php-file-integrity-scanner ```

jmiller referenced this issue

2026-06-23 17:00:33 +00:00

feat(security): malware pattern scanner #259

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteClient#258