lw-yara is a collection of Yara rules specifically designed to detect PHP shells and other webserver malware. The ruleset provides detection capabilities for various types of malicious code that target web servers, with a particular focus on PHP-based threats. This tool integrates with the Yara malware identification and classification engine to enable automated detection of webserver malware. The ruleset is maintained as an open-source project and serves as a resource for security professionals conducting malware analysis and threat detection activities. lw-yara can be used in security operations centers, incident response scenarios, and malware research environments to identify suspicious files and code patterns associated with webserver attacks.