Ahsay

Four KEV adds, one root cause. Lab reproduction of CWE-78 to an shx webshell with IFS and base64, plus the log, file, and process detections that catch it.