phpwarden 2.1.0__tar.gz → 2.1.1__tar.gz

{phpwarden-2.1.0 → phpwarden-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.1.0
+Version: 2.1.1
 Summary: PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps.
 Author: oroma-alfred
 License-Expression: Apache-2.0
@@ -23,8 +23,8 @@ Dynamic: license-file
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
-not CVSS.** Of the ~21,100 PHP advisories in the feed, 43 are actually being
-exploited (CISA KEV, as of 2026-11-12). phpwarden puts those first, then sorts
+not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 41 are known to be
+exploited (CISA KEV, as of 2026-11-13). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
@@ -32,6 +32,13 @@ It scans the PHP engine/FPM version, Composer dependencies and WordPress
 installs against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
+**Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
+known vulnerabilities, `composer audit` 286 and OSV.dev 262. Of 297 findings,
+100 were rated critical or high and 4 were actually exploited or likely to be;
+phpwarden ranked each of those first or second in its project. Method, numbers
+and a script to rerun it:
+[the benchmark write-up](https://phpwarden.io/blog/phpwarden-vs-composer-audit-osv-2026-11).
+
 ```bash
 $ phpwarden deps composer.lock
 18 vulnerable package(s) in composer.lock; 0 actively exploited (KEV). Ranked by exploitation risk, then reachability:
@@ -51,6 +58,7 @@ $ phpwarden deps composer.lock
 | PHP engine / FPM CVE exposure | `scan` | image & network scanners |
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
+| WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
 | Exploitation signatures in logs | `detect` | SIEM content |
 | WAF blocking rules (PHP-specific) | `rules` | the gap a generic WAF leaves |
 | Fleet exposure dashboard | `report` | the CNAPP's PHP view |
@@ -78,8 +86,9 @@ $ phpwarden deps composer.lock
 ```bash
 composer require --dev phpwarden/phpwarden   # PHP projects → vendor/bin/phpwarden
 pipx install phpwarden                       # Python-tooling box
+brew install oroma-alfred/tap/phpwarden      # macOS / Linux with Homebrew
 python3 phpwarden.pyz scan                   # single file, no install
-docker build -t phpwarden . && docker run --rm phpwarden scan --version 8.3.10 --sapi fpm --os linux
+docker run --rm phpwarden/phpwarden scan --version 8.3.10 --sapi fpm --os linux   # Docker Hub, amd64 + arm64
 ```
 
 On modern macOS / Debian / Ubuntu a plain `pip install phpwarden` into the
@@ -90,8 +99,8 @@ system Python is blocked by [PEP 668](https://peps.python.org/pep-0668/); use
 python3 -m venv ~/.venvs/phpwarden && ~/.venvs/phpwarden/bin/pip install phpwarden
 ```
 
-Docker usage (mounted projects, CI, dashboard reporting) is in
-[`docs/docker.md`](docs/docker.md).
+Docker usage (mounted projects, exit codes, CI, dashboard reporting) is on the
+image's [Docker Hub page](https://hub.docker.com/r/phpwarden/phpwarden).
 
 ## Use
 
@@ -113,6 +122,21 @@ built for gating: `0` clean, `1` exposed / vulnerable / signature hits,
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
+
+## Replacing Wordfence CLI
+
+Wordfence closed new licences for its CLI in October 2026; Free licences stopped working on 2026-10-14 and Premium
+licences are not renewed. phpwarden runs the same way (on the server, no plugin in the site) and covers:
+
+| Wordfence CLI | phpwarden | Notes |
+|---|---|---|
+| `wordfence vuln-scan /path` | `phpwarden wordpress /path` | Same job, ranked by real-world exploitation; JSON/SARIF and CI exit codes. Also scans Composer and the PHP engine. |
+| `wordfence malware-scan /path` | `phpwarden integrity /path` | Compares core and wordpress.org plugin files with official checksums; flags injected files, PHP in uploads and common backdoor code. **Not a signature scanner**: premium plugins and themes cannot be verified and are listed as such. |
+| `wordfence remediate` | – | Reinstall the flagged component with WP-CLI. |
+| `wordfence db-scan` | – | Not covered. |
+
+Full guide: https://phpwarden.io/compare/phpwarden-vs-wordfence-cli#replace
+
 ## Send results to the dashboard
 
 Any `scan`, `deps`, `wordpress` or `detect` run can post its result to
@@ -175,7 +199,7 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 The bundled community feed (currently 2026.10.31.2) works forever, offline:
 
-- **~21,100 advisories**: ~8,600 Composer (from [OSV.dev](https://osv.dev) and
+- **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch

{phpwarden-2.1.0 → phpwarden-2.1.1}/README.md

@@ -1,8 +1,8 @@
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
-not CVSS.** Of the ~21,100 PHP advisories in the feed, 43 are actually being
-exploited (CISA KEV, as of 2026-11-12). phpwarden puts those first, then sorts
+not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 41 are known to be
+exploited (CISA KEV, as of 2026-11-13). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
@@ -10,6 +10,13 @@ It scans the PHP engine/FPM version, Composer dependencies and WordPress
 installs against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
+**Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
+known vulnerabilities, `composer audit` 286 and OSV.dev 262. Of 297 findings,
+100 were rated critical or high and 4 were actually exploited or likely to be;
+phpwarden ranked each of those first or second in its project. Method, numbers
+and a script to rerun it:
+[the benchmark write-up](https://phpwarden.io/blog/phpwarden-vs-composer-audit-osv-2026-11).
+
 ```bash
 $ phpwarden deps composer.lock
 18 vulnerable package(s) in composer.lock; 0 actively exploited (KEV). Ranked by exploitation risk, then reachability:
@@ -29,6 +36,7 @@ $ phpwarden deps composer.lock
 | PHP engine / FPM CVE exposure | `scan` | image & network scanners |
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
+| WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
 | Exploitation signatures in logs | `detect` | SIEM content |
 | WAF blocking rules (PHP-specific) | `rules` | the gap a generic WAF leaves |
 | Fleet exposure dashboard | `report` | the CNAPP's PHP view |
@@ -56,8 +64,9 @@ $ phpwarden deps composer.lock
 ```bash
 composer require --dev phpwarden/phpwarden   # PHP projects → vendor/bin/phpwarden
 pipx install phpwarden                       # Python-tooling box
+brew install oroma-alfred/tap/phpwarden      # macOS / Linux with Homebrew
 python3 phpwarden.pyz scan                   # single file, no install
-docker build -t phpwarden . && docker run --rm phpwarden scan --version 8.3.10 --sapi fpm --os linux
+docker run --rm phpwarden/phpwarden scan --version 8.3.10 --sapi fpm --os linux   # Docker Hub, amd64 + arm64
 ```
 
 On modern macOS / Debian / Ubuntu a plain `pip install phpwarden` into the
@@ -68,8 +77,8 @@ system Python is blocked by [PEP 668](https://peps.python.org/pep-0668/); use
 python3 -m venv ~/.venvs/phpwarden && ~/.venvs/phpwarden/bin/pip install phpwarden
 ```
 
-Docker usage (mounted projects, CI, dashboard reporting) is in
-[`docs/docker.md`](docs/docker.md).
+Docker usage (mounted projects, exit codes, CI, dashboard reporting) is on the
+image's [Docker Hub page](https://hub.docker.com/r/phpwarden/phpwarden).
 
 ## Use
 
@@ -91,6 +100,21 @@ built for gating: `0` clean, `1` exposed / vulnerable / signature hits,
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
+
+## Replacing Wordfence CLI
+
+Wordfence closed new licences for its CLI in October 2026; Free licences stopped working on 2026-10-14 and Premium
+licences are not renewed. phpwarden runs the same way (on the server, no plugin in the site) and covers:
+
+| Wordfence CLI | phpwarden | Notes |
+|---|---|---|
+| `wordfence vuln-scan /path` | `phpwarden wordpress /path` | Same job, ranked by real-world exploitation; JSON/SARIF and CI exit codes. Also scans Composer and the PHP engine. |
+| `wordfence malware-scan /path` | `phpwarden integrity /path` | Compares core and wordpress.org plugin files with official checksums; flags injected files, PHP in uploads and common backdoor code. **Not a signature scanner**: premium plugins and themes cannot be verified and are listed as such. |
+| `wordfence remediate` | – | Reinstall the flagged component with WP-CLI. |
+| `wordfence db-scan` | – | Not covered. |
+
+Full guide: https://phpwarden.io/compare/phpwarden-vs-wordfence-cli#replace
+
 ## Send results to the dashboard
 
 Any `scan`, `deps`, `wordpress` or `detect` run can post its result to
@@ -153,7 +177,7 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 The bundled community feed (currently 2026.10.31.2) works forever, offline:
 
-- **~21,100 advisories**: ~8,600 Composer (from [OSV.dev](https://osv.dev) and
+- **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch

{phpwarden-2.1.0 → phpwarden-2.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.1.0"
+version = "2.1.1"
 description = "PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps."
 readme = "README.md"
 requires-python = ">=3.8"

{phpwarden-2.1.0 → phpwarden-2.1.1}/src/phpwarden/__init__.py

@@ -5,4 +5,4 @@ environment against an evolving knowledge base of PHP CVEs (the feed), and can
 watch PHP-FPM for active exploitation. The engine is open; the CVE feed is the
 part a subscription keeps current.
 """
-__version__ = "2.1.0"
+__version__ = "2.1.1"