Developer Console fatal error after 3.77 → 3.84 upgrade — Shell Console flagged as malware by hosting scanner

Hi Dave

All of the below is written by Claude. I’ve copied it completely so you can pick out what you need if you think it is something you could improve. Or if you think this is a host problem and I should go to them, let me know.

The issue:

After the upgrade, the site started throwing this fatal error:

Warning: require_once(/home/*********/public_html/cmsb/plugins/developerConsole/consoles/shellConsole.php): Failed to open stream: No such file or directory

Error: Failed opening required '/home/*********/public_html/cmsb/plugins/developerConsole/consoles/shellConsole.php’

I re-uploaded the file and it worked briefly, then the exact same error came back a short time later. This repeated a few times before I dug into it properly.

Root cause:

My host runs CPGuard, which includes a background malware scanner. I found the file in its quarantine log, flagged repeatedly under the signature {HEX}Malware.Expert.php.command.passthru — it's detecting shellConsole.php's use of proc_open() (the mechanism behind Shell Console's command execution) as shell-execution malware and quarantining it, then re-detecting it every time it's restored.

I understand this isn't something you can really "fix" in the sense of making proc_open()-based command execution invisible to malware scanners — a legitimate remote shell-command tool and a malicious one look identical at the code level. Given how common malware scanners are on shared/managed cPanel hosting, I'd guess this could affect other customers too, so I wanted to flag it in case it's useful.

What I did in the meantime:

Since re-uploading the file was never going to stick with the scanner re-checking this aggressively, I disabled Shell Console directly in developerConsole.php rather than keep fighting it — commented out its require_once, its pluginAction_addHandlerAndLink() registration, its entry in the dispatch() match statement, and its nav button in getNavButtons(). MySQL Console and PHP Console are unaffected and working normally. I'm aware this lives in a core-bundled file and will need to be reapplied on the next upgrade.

I've also marked the file as a false positive in CPGuard, which didn't have any effect. The file is still removed from the folder.

Thanks
Jeff