phpwarden 2.0.3__tar.gz → 2.1.1__tar.gz

{phpwarden-2.0.3 → phpwarden-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.0.3
+Version: 2.1.1
 Summary: PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps.
 Author: oroma-alfred
 License-Expression: Apache-2.0
@@ -23,8 +23,8 @@ Dynamic: license-file
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
-not CVSS.** Of the ~21,100 PHP advisories in the feed, 43 are actually being
-exploited (CISA KEV, as of 2026-11-12). phpwarden puts those first, then sorts
+not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 41 are known to be
+exploited (CISA KEV, as of 2026-11-13). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
@@ -32,6 +32,13 @@ It scans the PHP engine/FPM version, Composer dependencies and WordPress
 installs against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
+**Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
+known vulnerabilities, `composer audit` 286 and OSV.dev 262. Of 297 findings,
+100 were rated critical or high and 4 were actually exploited or likely to be;
+phpwarden ranked each of those first or second in its project. Method, numbers
+and a script to rerun it:
+[the benchmark write-up](https://phpwarden.io/blog/phpwarden-vs-composer-audit-osv-2026-11).
+
 ```bash
 $ phpwarden deps composer.lock
 18 vulnerable package(s) in composer.lock; 0 actively exploited (KEV). Ranked by exploitation risk, then reachability:
@@ -51,6 +58,7 @@ $ phpwarden deps composer.lock
 | PHP engine / FPM CVE exposure | `scan` | image & network scanners |
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
+| WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
 | Exploitation signatures in logs | `detect` | SIEM content |
 | WAF blocking rules (PHP-specific) | `rules` | the gap a generic WAF leaves |
 | Fleet exposure dashboard | `report` | the CNAPP's PHP view |
@@ -78,8 +86,9 @@ $ phpwarden deps composer.lock
 ```bash
 composer require --dev phpwarden/phpwarden   # PHP projects → vendor/bin/phpwarden
 pipx install phpwarden                       # Python-tooling box
+brew install oroma-alfred/tap/phpwarden      # macOS / Linux with Homebrew
 python3 phpwarden.pyz scan                   # single file, no install
-docker build -t phpwarden . && docker run --rm phpwarden scan --version 8.3.10 --sapi fpm --os linux
+docker run --rm phpwarden/phpwarden scan --version 8.3.10 --sapi fpm --os linux   # Docker Hub, amd64 + arm64
 ```
 
 On modern macOS / Debian / Ubuntu a plain `pip install phpwarden` into the
@@ -90,8 +99,8 @@ system Python is blocked by [PEP 668](https://peps.python.org/pep-0668/); use
 python3 -m venv ~/.venvs/phpwarden && ~/.venvs/phpwarden/bin/pip install phpwarden
 ```
 
-Docker usage (mounted projects, CI, dashboard reporting) is in
-[`docs/docker.md`](docs/docker.md).
+Docker usage (mounted projects, exit codes, CI, dashboard reporting) is on the
+image's [Docker Hub page](https://hub.docker.com/r/phpwarden/phpwarden).
 
 ## Use
 
@@ -100,6 +109,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view
@@ -112,6 +122,21 @@ built for gating: `0` clean, `1` exposed / vulnerable / signature hits,
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
+
+## Replacing Wordfence CLI
+
+Wordfence closed new licences for its CLI in October 2026; Free licences stopped working on 2026-10-14 and Premium
+licences are not renewed. phpwarden runs the same way (on the server, no plugin in the site) and covers:
+
+| Wordfence CLI | phpwarden | Notes |
+|---|---|---|
+| `wordfence vuln-scan /path` | `phpwarden wordpress /path` | Same job, ranked by real-world exploitation; JSON/SARIF and CI exit codes. Also scans Composer and the PHP engine. |
+| `wordfence malware-scan /path` | `phpwarden integrity /path` | Compares core and wordpress.org plugin files with official checksums; flags injected files, PHP in uploads and common backdoor code. **Not a signature scanner**: premium plugins and themes cannot be verified and are listed as such. |
+| `wordfence remediate` | – | Reinstall the flagged component with WP-CLI. |
+| `wordfence db-scan` | – | Not covered. |
+
+Full guide: https://phpwarden.io/compare/phpwarden-vs-wordfence-cli#replace
+
 ## Send results to the dashboard
 
 Any `scan`, `deps`, `wordpress` or `detect` run can post its result to
@@ -174,7 +199,7 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 The bundled community feed (currently 2026.10.31.2) works forever, offline:
 
-- **~21,100 advisories**: ~8,600 Composer (from [OSV.dev](https://osv.dev) and
+- **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch

{phpwarden-2.0.3 → phpwarden-2.1.1}/README.md

@@ -1,8 +1,8 @@
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
-not CVSS.** Of the ~21,100 PHP advisories in the feed, 43 are actually being
-exploited (CISA KEV, as of 2026-11-12). phpwarden puts those first, then sorts
+not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 41 are known to be
+exploited (CISA KEV, as of 2026-11-13). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
@@ -10,6 +10,13 @@ It scans the PHP engine/FPM version, Composer dependencies and WordPress
 installs against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
+**Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
+known vulnerabilities, `composer audit` 286 and OSV.dev 262. Of 297 findings,
+100 were rated critical or high and 4 were actually exploited or likely to be;
+phpwarden ranked each of those first or second in its project. Method, numbers
+and a script to rerun it:
+[the benchmark write-up](https://phpwarden.io/blog/phpwarden-vs-composer-audit-osv-2026-11).
+
 ```bash
 $ phpwarden deps composer.lock
 18 vulnerable package(s) in composer.lock; 0 actively exploited (KEV). Ranked by exploitation risk, then reachability:
@@ -29,6 +36,7 @@ $ phpwarden deps composer.lock
 | PHP engine / FPM CVE exposure | `scan` | image & network scanners |
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
+| WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
 | Exploitation signatures in logs | `detect` | SIEM content |
 | WAF blocking rules (PHP-specific) | `rules` | the gap a generic WAF leaves |
 | Fleet exposure dashboard | `report` | the CNAPP's PHP view |
@@ -56,8 +64,9 @@ $ phpwarden deps composer.lock
 ```bash
 composer require --dev phpwarden/phpwarden   # PHP projects → vendor/bin/phpwarden
 pipx install phpwarden                       # Python-tooling box
+brew install oroma-alfred/tap/phpwarden      # macOS / Linux with Homebrew
 python3 phpwarden.pyz scan                   # single file, no install
-docker build -t phpwarden . && docker run --rm phpwarden scan --version 8.3.10 --sapi fpm --os linux
+docker run --rm phpwarden/phpwarden scan --version 8.3.10 --sapi fpm --os linux   # Docker Hub, amd64 + arm64
 ```
 
 On modern macOS / Debian / Ubuntu a plain `pip install phpwarden` into the
@@ -68,8 +77,8 @@ system Python is blocked by [PEP 668](https://peps.python.org/pep-0668/); use
 python3 -m venv ~/.venvs/phpwarden && ~/.venvs/phpwarden/bin/pip install phpwarden
 ```
 
-Docker usage (mounted projects, CI, dashboard reporting) is in
-[`docs/docker.md`](docs/docker.md).
+Docker usage (mounted projects, exit codes, CI, dashboard reporting) is on the
+image's [Docker Hub page](https://hub.docker.com/r/phpwarden/phpwarden).
 
 ## Use
 
@@ -78,6 +87,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view
@@ -90,6 +100,21 @@ built for gating: `0` clean, `1` exposed / vulnerable / signature hits,
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
+
+## Replacing Wordfence CLI
+
+Wordfence closed new licences for its CLI in October 2026; Free licences stopped working on 2026-10-14 and Premium
+licences are not renewed. phpwarden runs the same way (on the server, no plugin in the site) and covers:
+
+| Wordfence CLI | phpwarden | Notes |
+|---|---|---|
+| `wordfence vuln-scan /path` | `phpwarden wordpress /path` | Same job, ranked by real-world exploitation; JSON/SARIF and CI exit codes. Also scans Composer and the PHP engine. |
+| `wordfence malware-scan /path` | `phpwarden integrity /path` | Compares core and wordpress.org plugin files with official checksums; flags injected files, PHP in uploads and common backdoor code. **Not a signature scanner**: premium plugins and themes cannot be verified and are listed as such. |
+| `wordfence remediate` | – | Reinstall the flagged component with WP-CLI. |
+| `wordfence db-scan` | – | Not covered. |
+
+Full guide: https://phpwarden.io/compare/phpwarden-vs-wordfence-cli#replace
+
 ## Send results to the dashboard
 
 Any `scan`, `deps`, `wordpress` or `detect` run can post its result to
@@ -152,7 +177,7 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 The bundled community feed (currently 2026.10.31.2) works forever, offline:
 
-- **~21,100 advisories**: ~8,600 Composer (from [OSV.dev](https://osv.dev) and
+- **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch

{phpwarden-2.0.3 → phpwarden-2.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.0.3"
+version = "2.1.1"
 description = "PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps."
 readme = "README.md"
 requires-python = ">=3.8"

{phpwarden-2.0.3 → phpwarden-2.1.1}/src/phpwarden/__init__.py

@@ -5,4 +5,4 @@ environment against an evolving knowledge base of PHP CVEs (the feed), and can
 watch PHP-FPM for active exploitation. The engine is open; the CVE feed is the
 part a subscription keeps current.
 """
-__version__ = "2.0.3"
+__version__ = "2.1.1"

{phpwarden-2.0.3 → phpwarden-2.1.1}/src/phpwarden/cli.py

@@ -372,6 +372,39 @@ def _wordpress(args):
     return _combine(1 if findings else 0, _maybe_report(args, doc))
 
 
+def _integrity(args):
+    from phpwarden import integrity as integ
+    res = integ.check(args.path, locale=args.locale, plugins=not args.no_plugins)
+    doc = integ.to_doc(res)
+    if args.json:
+        print(json.dumps(doc, indent=2))
+        return 1 if res.tampered else 0
+    if not res.core_version:
+        print(f"{args.path}: no WordPress install detected at that path")
+        return 2
+    labels = {"php-in-uploads": "PHP file in uploads", "unexpected": "does not belong",
+              "modified": "modified", "missing": "missing"}
+    bad = [i for i in res.issues if i.kind != "missing"]
+    print(f"WordPress {res.core_version} at {args.path}: {res.files_checked} files compared with wordpress.org, "
+          f"{len(bad)} problem{'s' if len(bad) != 1 else ''}.")
+    for i in res.issues:
+        flag = "  SUSPICIOUS" if i.suspicious else ""
+        print(f"\n  {labels.get(i.kind, i.kind):20} {i.path}  ({i.component}){flag}")
+        for pid in i.suspicious:
+            print(f"      matches: {integ.describe(pid)}")
+    if res.verified:
+        print(f"\n  verified against official checksums: {len(res.verified)} component(s)")
+    if res.unverified:
+        print(f"  could not be verified: {len(res.unverified)} component(s)")
+        for u in res.unverified[:40]:
+            print(f"      {u['component']}: {u['reason']}")
+    if not res.issues:
+        print("\n  No modified or unexpected files in the components that could be verified.")
+    print("\n  This compares files with wordpress.org checksums and looks for common backdoor code.\n"
+          "  It is not a signature-based malware scanner.")
+    return 1 if res.tampered else 0
+
+
 def _report(args):
     rows = reportgen.load_rows(args.files)
     feed = FeedManager().current()
@@ -438,6 +471,14 @@ def main(argv=None):
     _report_args(wpc)
     wpc.set_defaults(func=_wordpress)
 
+    ig = sub.add_parser("integrity", help="check WordPress core and plugin files against wordpress.org "
+                                          "checksums; flag injected files and backdoor code")
+    ig.add_argument("path", help="path to the WordPress root")
+    ig.add_argument("--locale", default="en_US", help="WordPress locale of the install (default en_US)")
+    ig.add_argument("--no-plugins", action="store_true", help="check core and uploads only")
+    ig.add_argument("--json", action="store_true")
+    ig.set_defaults(func=_integrity)
+
     rp = sub.add_parser("report", help="aggregate JSON results into an HTML fleet dashboard")
     rp.add_argument("files", nargs="+", help="JSON files from scan/deps/wordpress --json")
     rp.add_argument("--out", help="write HTML to a file instead of stdout")