Cloudflare rule is _public_, no need to put it in another rule

1 files changed, 2 insertions, 1 deletions

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 7ace9f0..dad427b 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -90,7 +90,7 @@ rule DodgyPhp
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
 
     condition:
-        (any of them or CloudFlareBypass) and not IsWhitelisted
+        any of them and not IsWhitelisted
 }
 
 rule DangerousPhp
@@ -132,6 +132,7 @@ rule DangerousPhp
         $ = "posix_setuid" fullword nocase
         $ = "preg_replace_callback" fullword
         $ = "proc_open" fullword nocase
+        $ = "proc_close" fullword nocase
         $ = "popen" fullword nocase
         $ = "register_shutdown_function" fullword nocase
         $ = "register_tick_function" fullword nocase