First PHP Webshell Opcode Incremental Dataset Motivation To improve the robustness of PHP webshell detection by analyzing low-level opcode patterns, circumventing common code obfuscation and evasion techniques. Content Summary Samples: 10,000+ PHP files (5,000+ webshells, some with anti-detection tricks , 5,000+ benign files from WordPress/PHPCMS). Includes source code, opcodes, processed opcodes Preprocessing: Extracted opcode sequences and decoded Opcode Double-Tuples (ODTs) with expert-designed filtering rules Temporal Validation: Split into pre-2021 (training/validation) and 2021-2024 (testing) samples. Can be used for incremental learning. License *Academic use only. Key Value Enables behavior-based detection models by preserving semantic context through opcode-level feature engineering. Full Changelog: https://github.com/w-32768/PHP-Webshell-Detection-via-Opcode-Analysis/commits/Webshell