@blamejs/exceptd-skills 0.19.22 → 0.19.23

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.19.23 — 2026-08-11
+
+Every CVE in the catalog now records the controls it requires. The last 34 entries complete the set at 1025 of 1025 — 2,176 control requirements drawn from 143 distinct controls — so `framework-gap` reports the controls a CVE needs that no framework carries for any entry in the catalog, not a subset of it. The closing set includes PHP-CGI, Samba, Apache Tomcat, XStream, Oracle WebLogic, Cisco IOS XE and ASA, Ivanti EPMM, Mirth Connect, and consumer routers from Zyxel and D-Link.
+
+Some populations are defined by a combination, not a product. The PHP-CGI entry applies only to Windows hosts running Apache with PHP-CGI below the fixed builds; a Linux host, or a Windows host serving PHP through another interface, is not an instance of it. The requirement says so, because an emergency batch scoped to "PHP" spends its window on hosts that were never exposed. It also names why a request filter written against the obvious payload proves nothing here: the injection arrives as a soft hyphen that Windows remaps to a dash, so a rule has to be validated by replaying the encoded byte rather than the character the rule author had in mind.
+
+Where the vulnerable interface is the reason the device exists, the entry says what isolation cannot do. Several of the closing entries are consumer routers and access points whose management interface is reachable from the network they serve, so restricting reachability bounds who can send the request and repairs nothing — and for the models with no fixed firmware, removal is the requirement rather than a step after patching.
+
 ## 0.19.22 — 2026-08-11
 
 Another 38 CVEs report the controls they require, taking coverage to 991 of 1025. The set includes Citrix NetScaler, Apache ActiveMQ and RocketMQ, Adobe ColdFusion, Oracle Fusion Middleware, Zimbra, Ivanti's Cloud Services Appliance, Qlik Sense, Cisco NX-OS, and the Fortinet FortiSandbox and Trend Micro Apex One entries.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-11T19:32:39.070Z",
+  "generated_at": "2026-08-11T20:35:50.100Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "8a272417326889968145ebc4e93c57b0db3ecaa44186188769cda934e6369763",
+    "manifest.json": "1e56ecce2864d711243241a23737e958c028f1c4fd52887f643d5d3921cd2ac2",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "e6b9bae2be71e9b73848c1c2ca7175ac4ab0c8e153565f3c0fda3824e668c3a1",
-    "data/cve-catalog.json": "3c1089b065f070984c997a601a6abd541706dbf50b3901f2ae32d0fd4542e0c2",
+    "data/cve-catalog.json": "c01d0157297cc3e287d7ab89ce5e159100ef5d04a04eb0ed36de0f68d97c0cc5",
     "data/cwe-catalog.json": "7b2223f0773d2f033d72fdcbf00cba9cdfdc2dff6bfb1366c9b30144396945f6",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "a4f86106ba3b5a75646a923ce2fc3f09bdc17aeff8357e8513a1052c5168014e",
+    "data/zeroday-lessons.json": "43a1276c2cfde43c857d8d1e2c788487c4f123d0a21ddc11b2498eb1d0cdf01e",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/cve-catalog.json

@@ -27286,7 +27286,7 @@
       "NIST-800-53-SC-7": "Boundary/WAF rules keyed on literal '-' options miss the Best-Fit 0xAD encoding, so perimeter filtering fails to block the argument injection.",
       "ISO-27001-2022-A.8.9": "Configuration management does not flag the insecure Windows Apache + PHP-CGI + Best-Fit code-page combination that is the precondition for this bug.",
       "NIS2-Art21-patch-management": "Patch-management timelines are far slower than the observed same-week weaponization of this critical RCE.",
-      "PCI-DSS-4.0-6.3.3": "The patch-security-vulnerabilities requirement does not mandate moving off PHP-CGI to a safer SAPI (PHP-FPM), leaving the injectable interpreter mode deployed.",
+      "PCI-DSS-4.0-6.3.3": "The patch-security-vulnerabilities requirement is satisfied by the fixed PHP build and says nothing about the interpreter mode that made the flaw reachable, so the CGI SAPI stays deployed on an estate that patches diligently. There is no drop-in alternative on the affected platform either — PHP-FPM is a Unix SAPI and is not shipped for Windows, which is the only environment this CVE affects — so removing the injectable mode means either dropping the mapping that routes requests to the CGI binary where the deployment permits it, or moving the workload to a platform where a non-CGI SAPI is available. Neither is a patching action, and neither is prompted by the requirement.",
       "UK-CAF-D1": "CAF response-and-recovery planning does not account for the same-week ransomware weaponization observed here, where an internet-facing PHP-CGI RCE (EPSS ~1.0) is mass-exploited faster than an incident-response cycle can spin up.",
       "AU-Essential-8-Patch": "Essential-Eight application-patch timelines trail the near-immediate, ransomware-linked mass exploitation of exposed Windows PHP-CGI hosts, where the Best-Fit code-page bypass turns a routine RCE into a same-day compromise."
     },