penthera 1.7.0 → 1.8.0

package/lib/rules/advisories/eol.json

@@ -0,0 +1,413 @@
+{
+  "kind": "runtime-eol",
+  "rules": [
+    {
+      "id": "php-eol",
+      "product": "php",
+      "branches": [
+        {
+          "branch": "8.5",
+          "eol": "2029-12-31"
+        },
+        {
+          "branch": "8.4",
+          "eol": "2028-12-31"
+        },
+        {
+          "branch": "8.3",
+          "eol": "2027-12-31"
+        },
+        {
+          "branch": "8.2",
+          "eol": "2026-12-31"
+        },
+        {
+          "branch": "8.1",
+          "eol": "2025-12-31"
+        },
+        {
+          "branch": "8.0",
+          "eol": "2023-11-26"
+        },
+        {
+          "branch": "7.4",
+          "eol": "2022-11-28"
+        },
+        {
+          "branch": "7.3",
+          "eol": "2021-12-06"
+        },
+        {
+          "branch": "7.2",
+          "eol": "2020-11-30"
+        },
+        {
+          "branch": "7.1",
+          "eol": "2019-12-01"
+        },
+        {
+          "branch": "7.0",
+          "eol": "2019-01-10"
+        },
+        {
+          "branch": "5.6",
+          "eol": "2018-12-31"
+        },
+        {
+          "branch": "5.5",
+          "eol": "2016-07-21"
+        },
+        {
+          "branch": "5.4",
+          "eol": "2015-09-14"
+        },
+        {
+          "branch": "5.3",
+          "eol": "2014-08-14"
+        }
+      ],
+      "source": "https://www.php.net/eol.php",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "description": "End-of-life dates from php.net's Unsupported Branches page; supported lines and their security-support end dates from https://www.php.net/supported-versions.php (8.2 until 2026-12-31, 8.3 until 2027-12-31, 8.4 until 2028-12-31, 8.5 until 2029-12-31). Checked 2026-10-21.",
+      "references": [
+        "phpsupported",
+        "endoflifedate"
+      ]
+    },
+    {
+      "id": "nodejs-eol",
+      "product": "nodejs",
+      "branches": [
+        {
+          "branch": "26",
+          "eol": "2029-04-30"
+        },
+        {
+          "branch": "25",
+          "eol": "2026-06-01"
+        },
+        {
+          "branch": "24",
+          "eol": "2028-04-30"
+        },
+        {
+          "branch": "23",
+          "eol": "2025-06-01"
+        },
+        {
+          "branch": "22",
+          "eol": "2027-04-30"
+        },
+        {
+          "branch": "21",
+          "eol": "2024-06-01"
+        },
+        {
+          "branch": "20",
+          "eol": "2026-04-30"
+        },
+        {
+          "branch": "19",
+          "eol": "2023-06-01"
+        },
+        {
+          "branch": "18",
+          "eol": "2025-04-30"
+        },
+        {
+          "branch": "17",
+          "eol": "2022-06-01"
+        },
+        {
+          "branch": "16",
+          "eol": "2023-09-11"
+        },
+        {
+          "branch": "15",
+          "eol": "2021-06-01"
+        },
+        {
+          "branch": "14",
+          "eol": "2023-04-30"
+        },
+        {
+          "branch": "13",
+          "eol": "2020-06-01"
+        },
+        {
+          "branch": "12",
+          "eol": "2022-04-30"
+        },
+        {
+          "branch": "11",
+          "eol": "2019-06-30"
+        },
+        {
+          "branch": "10",
+          "eol": "2021-04-30"
+        },
+        {
+          "branch": "9",
+          "eol": "2018-06-30"
+        },
+        {
+          "branch": "8",
+          "eol": "2019-12-31"
+        },
+        {
+          "branch": "6",
+          "eol": "2019-04-30"
+        },
+        {
+          "branch": "4",
+          "eol": "2018-04-30"
+        }
+      ],
+      "source": "https://nodejs.org/en/about/previous-releases",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "description": "From the Node.js release schedule (https://github.com/nodejs/Release/blob/main/schedule.json): 22, 24 and 26 are supported; 25 ended 2026-06-01 and 20 ended 2026-04-30. Checked 2026-10-21.",
+      "references": [
+        "nodejsreleases",
+        "endoflifedate"
+      ]
+    },
+    {
+      "id": "python-eol",
+      "product": "python",
+      "branches": [
+        {
+          "branch": "3.10",
+          "eol": "2026-10-01"
+        },
+        {
+          "branch": "3.9",
+          "eol": "2025-10-31"
+        },
+        {
+          "branch": "3.8",
+          "eol": "2024-10-07"
+        },
+        {
+          "branch": "3.7",
+          "eol": "2023-06-27"
+        },
+        {
+          "branch": "3.6",
+          "eol": "2021-12-23"
+        },
+        {
+          "branch": "3.5",
+          "eol": "2020-09-30"
+        },
+        {
+          "branch": "3.4",
+          "eol": "2019-03-18"
+        },
+        {
+          "branch": "3.3",
+          "eol": "2017-09-29"
+        },
+        {
+          "branch": "2.7",
+          "eol": "2020-01-01"
+        }
+      ],
+      "source": "https://devguide.python.org/versions/",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "description": "From the Python Developer's Guide status of Python versions: 3.11 to 3.15 are supported; 3.10 reached end of life on 2026-10-01. Only ended lines are listed, since future ends are given to the month. Checked 2026-10-21.",
+      "references": [
+        "pythondevguideversions",
+        "endoflifedate"
+      ]
+    },
+    {
+      "id": "nginx-eol",
+      "product": "nginx",
+      "branches": [
+        {
+          "branch": "1.29",
+          "eol": "2026-05-13"
+        },
+        {
+          "branch": "1.28",
+          "eol": "2026-04-14"
+        },
+        {
+          "branch": "1.27",
+          "eol": "2025-06-24"
+        },
+        {
+          "branch": "1.26",
+          "eol": "2025-04-23"
+        },
+        {
+          "branch": "1.25",
+          "eol": "2024-05-29"
+        },
+        {
+          "branch": "1.24",
+          "eol": "2024-04-23"
+        },
+        {
+          "branch": "1.23",
+          "eol": "2023-05-23"
+        },
+        {
+          "branch": "1.22",
+          "eol": "2023-04-11"
+        },
+        {
+          "branch": "1.21",
+          "eol": "2022-06-21"
+        },
+        {
+          "branch": "1.20",
+          "eol": "2022-05-24"
+        },
+        {
+          "branch": "1.19",
+          "eol": "2021-05-25"
+        },
+        {
+          "branch": "1.18",
+          "eol": "2021-04-20"
+        },
+        {
+          "branch": "1.17",
+          "eol": "2020-05-26"
+        },
+        {
+          "branch": "1.16",
+          "eol": "2020-04-20"
+        },
+        {
+          "branch": "1.15",
+          "eol": "2019-05-21"
+        },
+        {
+          "branch": "1.14",
+          "eol": "2019-04-23"
+        },
+        {
+          "branch": "1.13",
+          "eol": "2018-06-05"
+        },
+        {
+          "branch": "1.12",
+          "eol": "2018-04-17"
+        },
+        {
+          "branch": "1.11",
+          "eol": "2017-04-25"
+        },
+        {
+          "branch": "1.10",
+          "eol": "2017-04-12"
+        }
+      ],
+      "source": "https://nginx.org/en/download.html",
+      "date": "2026-10-21",
+      "confidence": "likely",
+      "description": "nginx supports only the current mainline (1.31) and stable (1.30) lines and lists older ones as legacy versions with no fixes. The dates each line stopped being supported are from endoflife.date (https://endoflife.date/nginx), a secondary source, hence confidence likely. Checked 2026-10-21.",
+      "references": [
+        "nginxadvisories",
+        "endoflifedate"
+      ]
+    },
+    {
+      "id": "apache-httpd-eol",
+      "product": "apache-httpd",
+      "branches": [
+        {
+          "branch": "2.2",
+          "eol": "2017-07-11"
+        },
+        {
+          "branch": "2.0",
+          "eol": "2013-07-10"
+        }
+      ],
+      "source": "https://httpd.apache.org/",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "description": "httpd.apache.org: Apache httpd 2.2 is end of life, the final release was 2.2.34 (July 2017), with no further security updates; only 2.4 is supported. Dates of the final 2.2 and 2.0 releases from endoflife.date. Checked 2026-10-21.",
+      "references": [
+        "httpdvulns24",
+        "endoflifedate"
+      ]
+    },
+    {
+      "id": "openssl-eol",
+      "product": "openssl",
+      "branches": [
+        {
+          "branch": "0.9.8",
+          "eol": "2015-12-31"
+        },
+        {
+          "branch": "1.0.0",
+          "eol": "2015-12-31"
+        },
+        {
+          "branch": "1.0.1",
+          "eol": "2016-12-31"
+        },
+        {
+          "branch": "1.0.2",
+          "eol": "2019-12-31"
+        },
+        {
+          "branch": "1.1.0",
+          "eol": "2019-09-11"
+        },
+        {
+          "branch": "1.1.1",
+          "eol": "2023-09-11"
+        },
+        {
+          "branch": "3.0",
+          "eol": "2026-09-07"
+        },
+        {
+          "branch": "3.1",
+          "eol": "2025-03-14"
+        },
+        {
+          "branch": "3.2",
+          "eol": "2025-11-23"
+        },
+        {
+          "branch": "3.3",
+          "eol": "2026-04-09"
+        },
+        {
+          "branch": "3.4",
+          "eol": "2026-10-22"
+        },
+        {
+          "branch": "3.5",
+          "eol": "2030-04-08"
+        },
+        {
+          "branch": "3.6",
+          "eol": "2026-11-01"
+        },
+        {
+          "branch": "4.0",
+          "eol": "2027-05-14"
+        }
+      ],
+      "source": "https://endoflife.date/openssl",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "description": "Dates from endoflife.date, checked on 2026-10-21 against the OpenSSL release strategy (https://openssl-library.org/policies/releasestrat/), which lists 3.4, 3.5, 3.6 and 4.0 as supported and 3.0, 1.1.1, 1.0.2 and older as no longer supported (paid extended support exists for 3.0, 1.1.1 and 1.0.2).",
+      "references": [
+        "opensslvulns",
+        "endoflifedate"
+      ]
+    }
+  ]
+}

package/lib/rules/advisories/pack.json

@@ -0,0 +1,20 @@
+{
+  "schema": 1,
+  "name": "advisories",
+  "version": "1.0.0",
+  "created_at": "2026-10-21T15:22:16Z",
+  "min_penthera": "1.8.0",
+  "description": "Runtime and server security advisories (PHP, Apache HTTP Server, nginx, Node.js, Python, OpenSSL) and end-of-life release lines, from vendor advisories and support pages. Every rule cites its vendor source.",
+  "rules": [
+    {
+      "file": "advisories.json",
+      "kind": "runtime-advisory",
+      "sha256": "8e222761046dedf17c4acf2f4bf87e1961f4b73fe6098d5501bd4547b3d80fd9"
+    },
+    {
+      "file": "eol.json",
+      "kind": "runtime-eol",
+      "sha256": "e98c360db5a69dd83a2e4673bd254f558fc2c0558a5a49087c538f070728ea9e"
+    }
+  ]
+}

package/lib/rules/advisories/pack.json.sig

@@ -0,0 +1,6 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgDgRSZTRaMM36gE32AzSZRuHiqG
+VstB30pUKdNOYLIywAAAAOcGVudGhlcmEtcnVsZXMAAAAAAAAABnNoYTUxMgAAAFMAAAAL
+c3NoLWVkMjU1MTkAAABASImtVokMrMVc+ObkfJUW0Bx0tul35dLGjb1Gmnsa316Lrv6xRU
+4XyuUjXIxS1xAiVcybAKbu67VH/35XTwmvDg==
+-----END SSH SIGNATURE-----

package/lib/rules/allowed_signers

@@ -0,0 +1,13 @@
+# Keys trusted to sign Penthera rule packs (ssh-keygen -Y, namespace
+# "penthera-rules"). Format: ALLOWED SIGNERS in ssh-keygen(1):
+#
+#   principal namespaces="penthera-rules" ssh-ed25519 AAAA... comment
+#
+# Only the maintainer's release-signing key belongs here. Adding a key to this
+# file in a PR is a change to Penthera's trust root and gets the same review
+# as a change to the verifier. Users who trust their own packs pass
+# --rules-signers <file> instead of editing this file.
+#
+# The maintainer's release-signing key (a dedicated key, used only for rule
+# packs). See docs/rule-packs.md, "Signing a release".
+daan@gaia.computer namespaces="penthera-rules" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA4EUmU0WjDN+oBN9gM0mUbh4qhlbLQd9KVCnTTmCyMs penthera rule signing

package/lib/rules/core/agent-exec.json

@@ -0,0 +1,29 @@
+{
+  "kind": "agent-exec",
+  "rules": [
+    {
+      "id": "shell-process-substitution",
+      "label": "shell runs a download via process substitution",
+      "pattern": "\\b(?:(?:ba|z)?sh|source|\\.)\\s+<\\(\\s*(?:curl|wget)\\b",
+      "flags": "i",
+      "source": "https://github.com/danoszz/penthera/blob/afafb24/lib/agents/hidden-content.js",
+      "date": "2026-10-19",
+      "confidence": "likely",
+      "references": [
+        "greshake2023signed"
+      ]
+    },
+    {
+      "id": "shell-command-substitution",
+      "label": "shell -c runs a download",
+      "pattern": "\\b(?:ba|z)?sh\\s+-c\\s+[\"']?\\$\\(\\s*(?:curl|wget)\\b",
+      "flags": "i",
+      "source": "https://github.com/danoszz/penthera/blob/afafb24/lib/agents/hidden-content.js",
+      "date": "2026-10-19",
+      "confidence": "likely",
+      "references": [
+        "greshake2023signed"
+      ]
+    }
+  ]
+}

package/lib/rules/core/agent-instructions.json

@@ -0,0 +1,17 @@
+{
+  "kind": "agent-instruction",
+  "rules": [
+    {
+      "id": "instruction.credential-paths",
+      "description": "Mentions of SSH keys, cloud credentials and package-manager tokens inside hidden text.",
+      "pattern": "(?:~\\/\\.ssh|\\bid_rsa\\b|\\bid_ed25519\\b|\\.aws\\/credentials|\\.npmrc|\\.netrc|\\bkeychain\\b)",
+      "flags": "i",
+      "source": "https://github.com/danoszz/penthera/blob/afafb24/lib/agents/hidden-content.js",
+      "date": "2026-10-19",
+      "confidence": "potential",
+      "references": [
+        "greshake2023signed"
+      ]
+    }
+  ]
+}

package/lib/rules/core/pack.json

@@ -0,0 +1,30 @@
+{
+  "schema": 1,
+  "name": "core",
+  "version": "1.0.0",
+  "created_at": "2026-10-19T13:44:05Z",
+  "min_penthera": "1.2.0",
+  "description": "Built-in detections that ship with Penthera: AI provider key formats, hidden-instruction and remote-exec patterns for agent configs, and the exposed .env template.",
+  "rules": [
+    {
+      "file": "agent-exec.json",
+      "kind": "agent-exec",
+      "sha256": "9decfc8f8305b302826e6b23c5f71520534beebe58e08d3da2731772a15eb416"
+    },
+    {
+      "file": "agent-instructions.json",
+      "kind": "agent-instruction",
+      "sha256": "edf192a2cf5665596b97ba2702d2540d37db3c9a7a953171a58f42ac16ed3b97"
+    },
+    {
+      "file": "secrets.json",
+      "kind": "secret",
+      "sha256": "48f2601311ea16d1254b21920582e3bf18c2c612a0e45406a8bdd2571358c320"
+    },
+    {
+      "file": "templates.json",
+      "kind": "nuclei-template",
+      "sha256": "67d762547efa3ac68b632fa2ca9196d97b601b7a35ec4e12eaf41207eb1e906d"
+    }
+  ]
+}

package/lib/rules/core/pack.json.sig

@@ -0,0 +1,6 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgDgRSZTRaMM36gE32AzSZRuHiqG
+VstB30pUKdNOYLIywAAAAOcGVudGhlcmEtcnVsZXMAAAAAAAAABnNoYTUxMgAAAFMAAAAL
+c3NoLWVkMjU1MTkAAABAnpz2oJEtsQ+W+YKd+pycUp0c3N036Y2ISItLrAWcK74RgRu3uM
+mY6yTTPXNF0ilM1jbMknukk0tsXA2cfQQ6AA==
+-----END SSH SIGNATURE-----