phpwarden 2.0.2__tar.gz → 2.1.0__tar.gz

{phpwarden-2.0.2 → phpwarden-2.1.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.0.2
-Summary: PHP exposure and exploitation guard — assess any PHP host against an evolving CVE feed, and watch PHP-FPM for active exploitation
+Version: 2.1.0
+Summary: PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps.
 Author: oroma-alfred
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://phpwarden.io
 Project-URL: Source, https://github.com/oroma-alfred/phpwarden
 Project-URL: Issues, https://github.com/oroma-alfred/phpwarden/issues
-Keywords: php,php-fpm,security,cve,vulnerability,exploitation,detection,rce
+Keywords: php,composer,wordpress,php-fpm,security,vulnerability,cve,kev,epss,sca,scanner
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: System Administrators
@@ -100,6 +100,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view

{phpwarden-2.0.2 → phpwarden-2.1.0}/README.md

@@ -78,6 +78,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view

{phpwarden-2.0.2 → phpwarden-2.1.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.0.2"
-description = "PHP exposure and exploitation guard — assess any PHP host against an evolving CVE feed, and watch PHP-FPM for active exploitation"
+version = "2.1.0"
+description = "PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps."
 readme = "README.md"
 requires-python = ">=3.8"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 authors = [{ name = "oroma-alfred" }]
-keywords = ["php", "php-fpm", "security", "cve", "vulnerability", "exploitation", "detection", "rce"]
+keywords = ["php", "composer", "wordpress", "php-fpm", "security", "vulnerability", "cve", "kev", "epss", "sca", "scanner"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",

{phpwarden-2.0.2 → phpwarden-2.1.0}/src/phpwarden/__init__.py

@@ -5,4 +5,4 @@ environment against an evolving knowledge base of PHP CVEs (the feed), and can
 watch PHP-FPM for active exploitation. The engine is open; the CVE feed is the
 part a subscription keeps current.
 """
-__version__ = "2.0.2"
+__version__ = "2.1.0"

{phpwarden-2.0.2 → phpwarden-2.1.0}/src/phpwarden/cli.py

@@ -372,6 +372,39 @@ def _wordpress(args):
     return _combine(1 if findings else 0, _maybe_report(args, doc))
 
 
+def _integrity(args):
+    from phpwarden import integrity as integ
+    res = integ.check(args.path, locale=args.locale, plugins=not args.no_plugins)
+    doc = integ.to_doc(res)
+    if args.json:
+        print(json.dumps(doc, indent=2))
+        return 1 if res.tampered else 0
+    if not res.core_version:
+        print(f"{args.path}: no WordPress install detected at that path")
+        return 2
+    labels = {"php-in-uploads": "PHP file in uploads", "unexpected": "does not belong",
+              "modified": "modified", "missing": "missing"}
+    bad = [i for i in res.issues if i.kind != "missing"]
+    print(f"WordPress {res.core_version} at {args.path}: {res.files_checked} files compared with wordpress.org, "
+          f"{len(bad)} problem{'s' if len(bad) != 1 else ''}.")
+    for i in res.issues:
+        flag = "  SUSPICIOUS" if i.suspicious else ""
+        print(f"\n  {labels.get(i.kind, i.kind):20} {i.path}  ({i.component}){flag}")
+        for pid in i.suspicious:
+            print(f"      matches: {integ.describe(pid)}")
+    if res.verified:
+        print(f"\n  verified against official checksums: {len(res.verified)} component(s)")
+    if res.unverified:
+        print(f"  could not be verified: {len(res.unverified)} component(s)")
+        for u in res.unverified[:40]:
+            print(f"      {u['component']}: {u['reason']}")
+    if not res.issues:
+        print("\n  No modified or unexpected files in the components that could be verified.")
+    print("\n  This compares files with wordpress.org checksums and looks for common backdoor code.\n"
+          "  It is not a signature-based malware scanner.")
+    return 1 if res.tampered else 0
+
+
 def _report(args):
     rows = reportgen.load_rows(args.files)
     feed = FeedManager().current()
@@ -438,6 +471,14 @@ def main(argv=None):
     _report_args(wpc)
     wpc.set_defaults(func=_wordpress)
 
+    ig = sub.add_parser("integrity", help="check WordPress core and plugin files against wordpress.org "
+                                          "checksums; flag injected files and backdoor code")
+    ig.add_argument("path", help="path to the WordPress root")
+    ig.add_argument("--locale", default="en_US", help="WordPress locale of the install (default en_US)")
+    ig.add_argument("--no-plugins", action="store_true", help="check core and uploads only")
+    ig.add_argument("--json", action="store_true")
+    ig.set_defaults(func=_integrity)
+
     rp = sub.add_parser("report", help="aggregate JSON results into an HTML fleet dashboard")
     rp.add_argument("files", nargs="+", help="JSON files from scan/deps/wordpress --json")
     rp.add_argument("--out", help="write HTML to a file instead of stdout")