fix: MariaDB false positives in WP database scan + heuristic index.php FPs

- Use cmd.Output() instead of CombinedOutput() so MariaDB deprecation
  warnings on stderr don't appear as injected content in posts/options
- Filter remaining warning lines from stdout (belt and suspenders)
- Skip standard anti-directory-listing index.php files (<120 bytes,
  "Silence is golden") from HEURISTIC_RECENT_PHP detection

Author: defensia-bot

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to the Defensia Agent.
 
+## v1.4.48
+- **fix: MariaDB deprecation warning causing false positive malware findings** — `CombinedOutput()` mixed stderr warnings ("Deprecated program name") into query results, triggering `WP_DB_INJECTED_POST`, `WP_DB_INJECTED_OPTION`, and `WP_DB_ROGUE_ADMIN` on every WordPress site using MariaDB. Now uses `Output()` (stdout only) and filters any remaining warning lines.
+- **fix: false positive HEURISTIC_RECENT_PHP on plugin index.php files** — standard anti-directory-listing files (`<?php // Silence is golden`) in plugin asset directories are now skipped.
+
 ## v1.4.47
 - **fix: custom scan paths ending in `/` were silently ignored** — a trailing separator makes `filepath.Glob` return zero matches *and* a nil error, so a path like `/home/*/web/*/public_html/` never got scanned and never reported an error. Patterns are now trimmed before matching, and blank entries are skipped instead of resolving to `.` or `/` (which made the scanner walk the whole filesystem).
 - **HestiaCP / VestaCP support** — `/home/*/web/*/public_html` is now detected automatically, no custom path needed. The vhost directory is the domain, so each web root is reported with its domain.

internal/malware/heuristic.go

@@ -132,6 +132,22 @@ func CheckRecentPHP(path string, maxAgeHours int) *HeuristicFinding {
 		return nil
 	}
 
+	// Skip standard WordPress/plugin anti-directory-listing index.php files
+	// (typically "<?php // Silence is golden" or empty). These are created
+	// by plugin updates and are not malicious.
+	if strings.HasSuffix(path, "/index.php") {
+		if data, err := os.ReadFile(path); err == nil && len(data) < 120 {
+			content := strings.TrimSpace(string(data))
+			if content == "" ||
+				strings.Contains(content, "Silence is golden") ||
+				strings.Contains(content, "// silence") ||
+				content == "<?php" ||
+				content == "<?php\n" {
+				return nil
+			}
+		}
+	}
+
 	return &HeuristicFinding{
 		FilePath: path,
 		CheckID:  "HEURISTIC_RECENT_PHP",

internal/malware/wp_database.go

@@ -120,17 +120,26 @@ func queryForMalware(host, user, pass, db, query string, root WebRoot) []string
 	}
 
 	cmd := exec.Command("mysql", args...)
-	output, err := cmd.CombinedOutput()
+	// Use Output() not CombinedOutput() — stderr contains MariaDB deprecation
+	// warnings ("Deprecated program name") that look like injected content.
+	output, err := cmd.Output()
 	if err != nil {
 		return nil
 	}
 
 	var results []string
 	for _, line := range strings.Split(string(output), "\n") {
 		line = strings.TrimSpace(line)
-		if line != "" {
-			results = append(results, line)
+		if line == "" {
+			continue
 		}
+		// Skip MariaDB/MySQL warnings that leak into stdout via shell redirects
+		if strings.Contains(line, "Deprecated program name") ||
+			strings.HasPrefix(line, "Warning:") ||
+			strings.HasPrefix(line, "mysql:") {
+			continue
+		}
+		results = append(results, line)
 	}
 	return results
 }