phpwarden 2.1.1__tar.gz → 2.2.1__tar.gz

{phpwarden-2.1.1 → phpwarden-2.2.1}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.1.1
-Summary: PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps.
+Version: 2.2.1
+Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies.
 Author: oroma-alfred
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://phpwarden.io
@@ -23,8 +23,8 @@ Dynamic: license-file
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
-not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 41 are known to be
-exploited (CISA KEV, as of 2026-11-13). phpwarden puts those first, then sorts
+not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 54 are known to be
+exploited (CISA KEV, as of 2026-11-14). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
@@ -59,6 +59,9 @@ $ phpwarden deps composer.lock
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
 | WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
+| Your own PHP code (75 rules) | `code` | — (not a PHPStan/Psalm replacement) |
+| Live site from outside: exposed files, debug endpoints | `probe` | — |
+| One ranked verdict across all of the above | `assess` | — |
 | Exploitation signatures in logs | `detect` | SIEM content |
 | WAF blocking rules (PHP-specific) | `rules` | the gap a generic WAF leaves |
 | Fleet exposure dashboard | `report` | the CNAPP's PHP view |
@@ -79,7 +82,9 @@ $ phpwarden deps composer.lock
   configuration is reported as *possibly* exposed with the exact condition to
   confirm — not flagged as a certain hit, and not silently dismissed.
 - **Offline by default.** The feed ships inside the package. Nothing leaves the
-  machine unless you opt in to `--report-to` or `feed update`.
+  machine unless you opt in to `--report-to` or `feed update`. Two commands
+  need the network by nature: `integrity` fetches checksums from wordpress.org,
+  and `probe` talks only to the site you point it at.
 
 ## Install
 
@@ -87,7 +92,7 @@ $ phpwarden deps composer.lock
 composer require --dev phpwarden/phpwarden   # PHP projects → vendor/bin/phpwarden
 pipx install phpwarden                       # Python-tooling box
 brew install oroma-alfred/tap/phpwarden      # macOS / Linux with Homebrew
-python3 phpwarden.pyz scan                   # single file, no install
+curl -LO https://phpwarden.io/phpwarden.pyz && python3 phpwarden.pyz scan   # single file, no install
 docker run --rm phpwarden/phpwarden scan --version 8.3.10 --sapi fpm --os linux   # Docker Hub, amd64 + arm64
 ```
 
@@ -112,17 +117,61 @@ phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
 phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
+phpwarden rules --format nginx --dry-run     # the same rules, log-only: nothing is blocked
+phpwarden rules --replay /var/log/nginx/access.log    # what the rules would have blocked in an existing log
+phpwarden probe https://example.com  # live check of a site you own: exposed files, debug endpoints, versions vs the feed
+phpwarden code .                     # your own PHP: 75 high-signal rules, 74 on by default (injection, unserialize, WordPress handlers)
+phpwarden assess . --url https://example.com --log access.log   # one ranked verdict; --out / --baseline shows what is fixed and verified
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view
 phpwarden feed status                # which feed is active, how many advisories
+phpwarden feed update                # pull a newer feed: free weekly snapshot, or the maintained channel with a key
 ```
 
+`scan`, `deps`, `wordpress`, `probe` and `code` also take `--format sarif`
+(SARIF 2.1.0, for GitHub code scanning and other CI dashboards).
+
+`probe`, `code`, `assess`, `--format sarif`, `rules --dry-run` / `--replay` and
+the no-key `feed update` are new in 2.2.0.
+
 Every command takes `--json`. Exit codes are shared across subcommands and
-built for gating: `0` clean, `1` exposed / vulnerable / signature hits,
+built for gating: `0` clean, `1` exposed / vulnerable / signature hits / tampered
+files / high or critical `code` and `probe` findings (`probe` also on any
+known-exploited finding) / anything to act on now or this week (`assess`),
 `2` possibly exposed (`scan`), `3` PHP version unknown (`scan`), `4` input
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
 
+## New in 2.2.0
+
+- **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
+  requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
+  endpoints, and the WordPress, plugin and PHP versions the site reveals, and
+  matches those against the feed. Active checks run only after you prove the
+  site is yours (DNS TXT record, a file, or a meta tag; `--print-token` shows
+  how). Without that it reads the homepage and stops.
+- **`phpwarden code PATH`**: 75 rules (74 on by default) for your own PHP code, following request
+  data to `eval`, shell commands, SQL, `unserialize`, includes and redirects.
+  It follows data across files (helper functions and classes elsewhere in the
+  project, fixed includes, class properties); it is not a type checker like
+  PHPStan or Psalm. `phpwarden code --list-rules` lists every rule.
+- **`phpwarden assess`**: one ranked list from every view of a site: installed
+  versions, your code, the live site from outside, and the access log, with the
+  reason for each item ("exploited, reachable, visible from outside, already
+  fetched"). `--out` then `--baseline` reports what is fixed and verified.
+- **`--format sarif`** on `scan`, `deps`, `wordpress`, `probe` and `code`.
+- **`rules --dry-run` and `rules --replay ACCESS_LOG`**: see what the WAF rules
+  would block before they block anything.
+- **Free weekly feed updates**: `phpwarden feed update` without a key pulls a
+  weekly snapshot of the maintained feed. A vulnerability newly listed as known
+  exploited is released to the free channel straight away.
+- **Coverage commitment**: in-scope CISA KEV entries are in the maintained feed
+  within 24 hours of listing, checked on every rebuild and published at
+  https://phpwarden.io/feeds/kev-status.json. Details: https://phpwarden.io/sla
+- **Editors**: a VS Code extension in `integrations/vscode` (build and install
+  the `.vsix` from that folder; not on the Marketplace yet) and PhpStorm External Tool steps in
+  `integrations/phpstorm`.
+
 ## Replacing Wordfence CLI
 
 Wordfence closed new licences for its CLI in October 2026; Free licences stopped working on 2026-10-14 and Premium
@@ -140,8 +189,9 @@ Full guide: https://phpwarden.io/compare/phpwarden-vs-wordfence-cli#replace
 ## Send results to the dashboard
 
 Any `scan`, `deps`, `wordpress` or `detect` run can post its result to
-[app.phpwarden.io](https://app.phpwarden.io) for history across hosts and
-alerts when a finding you already carry lands in KEV:
+[app.phpwarden.io](https://app.phpwarden.io) for history across hosts.
+It marks findings that become known-exploited; email and webhook alerts are on
+Pro and Team, Slack on Team:
 
 ```bash
 phpwarden scan --report-to https://app.phpwarden.io/v1/reports --report-token <token>
@@ -186,7 +236,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: main        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.1.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -197,44 +247,51 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 ## The feed
 
-The bundled community feed (currently 2026.10.31.2) works forever, offline:
+The bundled community feed (2026.11.13.3 in this release) works forever, offline:
 
 - **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. 19,400+ carry an
-  EPSS score; 42 were in KEV when this feed was built.
+  fixed versions, exposure conditions and detection signatures. About 19,700 carry an
+  EPSS score; 41 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
-  public-domain (OSV, NVD, FriendsOfPHP, CISA KEV, FIRST EPSS). No commercial
+  public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial
   vendor's feed is used, so coverage cannot be revoked or priced away.
 - Every build passes `feedbuilder/check_feed.py` (no open-ended range with a
   known fix, no fixed version inside its own affected range, no duplicate
   (package|slug, cve)). The feed is assembled by `feedbuilder/` from a curated
   base plus bulk imports and enrichment; curated entries always win.
 
-A [phpwarden.io](https://phpwarden.io) subscription unlocks the maintained
-channel — new advisories and KEV/EPSS refreshes as they are triaged — via
-`PHPWARDEN_LICENSE=... phpwarden feed update`. Without a key, phpwarden runs
-the community feed and says so.
-
-Curated engine CVEs with detection signatures:
-
-| CVE | What | Scope |
-|-----|------|-------|
-| CVE-2019-11043 | PHP-FPM env_path_info RCE | FPM + nginx, config-gated |
-| CVE-2023-3824 | PHAR stack overflow RCE | any SAPI, untrusted PHAR |
-| CVE-2024-4577 | PHP-CGI argument injection | Windows + CGI |
-| CVE-2024-8926 / 8927 | cgi.force_redirect bypass | CGI / FPM |
-| CVE-2024-11236 | DB-quoter integer overflow | any SAPI |
-| CVE-2026-109618 / 109619 | php2shell FPM memory RCE | any SAPI |
+Updating the feed is optional and has two channels:
+
+- **Free weekly.** `phpwarden feed update` with no key downloads a weekly
+  snapshot of the maintained feed. A vulnerability newly listed as known
+  exploited is released to this channel straight away. If the server cannot be
+  reached, phpwarden keeps the feed it has and says so. Set
+  `PHPWARDEN_FREE_FEED_URL=off` to stop the no-key update from calling out.
+- **Maintained.** A [phpwarden.io](https://phpwarden.io) subscription gives a
+  license key; `PHPWARDEN_LICENSE=... phpwarden feed update` then pulls the
+  channel that is rebuilt twice a day.
+
+Examples of hand-curated engine CVEs:
+
+| CVE | What | Scope | Log signature |
+|-----|------|-------|---------------|
+| CVE-2019-11043 | PHP-FPM env_path_info RCE | FPM + nginx, config-gated | yes |
+| CVE-2023-3824 | PHAR stack overflow RCE | any SAPI, untrusted PHAR | no |
+| CVE-2024-4577 | PHP-CGI argument injection | Windows + CGI | yes |
+| CVE-2024-8926 | cgi.force_redirect bypass | Windows + CGI | no |
+| CVE-2024-8927 | cgi.force_redirect bypass | CGI / FPM | no |
+| CVE-2024-11236 | DB-quoter integer overflow | any SAPI | no |
+| CVE-2026-109618 / 109619 | php2shell FPM memory RCE | any SAPI | yes |
 
 ## Continuous guard
 
 `scan` and `detect` are point-in-time. For always-on containment of
 in-progress php2shell-class attacks (OOM on a worker, then that worker reused),
 run `phpwarden-guard`, which boots in dry-run and never acts until you promote
-it after a burn-in. See the guard's DESIGN document.
+it after a burn-in. See [`VALIDATION.md`](VALIDATION.md) for what was validated.
 
 ## Honest limits
 

{phpwarden-2.1.1 → phpwarden-2.2.1}/README.md

@@ -1,8 +1,8 @@
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
-not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 41 are known to be
-exploited (CISA KEV, as of 2026-11-13). phpwarden puts those first, then sorts
+not CVSS.** Of about 19,500 PHP vulnerabilities in the feed, 54 are known to be
+exploited (CISA KEV, as of 2026-11-14). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
@@ -37,6 +37,9 @@ $ phpwarden deps composer.lock
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
 | WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
+| Your own PHP code (75 rules) | `code` | — (not a PHPStan/Psalm replacement) |
+| Live site from outside: exposed files, debug endpoints | `probe` | — |
+| One ranked verdict across all of the above | `assess` | — |
 | Exploitation signatures in logs | `detect` | SIEM content |
 | WAF blocking rules (PHP-specific) | `rules` | the gap a generic WAF leaves |
 | Fleet exposure dashboard | `report` | the CNAPP's PHP view |
@@ -57,7 +60,9 @@ $ phpwarden deps composer.lock
   configuration is reported as *possibly* exposed with the exact condition to
   confirm — not flagged as a certain hit, and not silently dismissed.
 - **Offline by default.** The feed ships inside the package. Nothing leaves the
-  machine unless you opt in to `--report-to` or `feed update`.
+  machine unless you opt in to `--report-to` or `feed update`. Two commands
+  need the network by nature: `integrity` fetches checksums from wordpress.org,
+  and `probe` talks only to the site you point it at.
 
 ## Install
 
@@ -65,7 +70,7 @@ $ phpwarden deps composer.lock
 composer require --dev phpwarden/phpwarden   # PHP projects → vendor/bin/phpwarden
 pipx install phpwarden                       # Python-tooling box
 brew install oroma-alfred/tap/phpwarden      # macOS / Linux with Homebrew
-python3 phpwarden.pyz scan                   # single file, no install
+curl -LO https://phpwarden.io/phpwarden.pyz && python3 phpwarden.pyz scan   # single file, no install
 docker run --rm phpwarden/phpwarden scan --version 8.3.10 --sapi fpm --os linux   # Docker Hub, amd64 + arm64
 ```
 
@@ -90,17 +95,61 @@ phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
 phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
+phpwarden rules --format nginx --dry-run     # the same rules, log-only: nothing is blocked
+phpwarden rules --replay /var/log/nginx/access.log    # what the rules would have blocked in an existing log
+phpwarden probe https://example.com  # live check of a site you own: exposed files, debug endpoints, versions vs the feed
+phpwarden code .                     # your own PHP: 75 high-signal rules, 74 on by default (injection, unserialize, WordPress handlers)
+phpwarden assess . --url https://example.com --log access.log   # one ranked verdict; --out / --baseline shows what is fixed and verified
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view
 phpwarden feed status                # which feed is active, how many advisories
+phpwarden feed update                # pull a newer feed: free weekly snapshot, or the maintained channel with a key
 ```
 
+`scan`, `deps`, `wordpress`, `probe` and `code` also take `--format sarif`
+(SARIF 2.1.0, for GitHub code scanning and other CI dashboards).
+
+`probe`, `code`, `assess`, `--format sarif`, `rules --dry-run` / `--replay` and
+the no-key `feed update` are new in 2.2.0.
+
 Every command takes `--json`. Exit codes are shared across subcommands and
-built for gating: `0` clean, `1` exposed / vulnerable / signature hits,
+built for gating: `0` clean, `1` exposed / vulnerable / signature hits / tampered
+files / high or critical `code` and `probe` findings (`probe` also on any
+known-exploited finding) / anything to act on now or this week (`assess`),
 `2` possibly exposed (`scan`), `3` PHP version unknown (`scan`), `4` input
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
 
+## New in 2.2.0
+
+- **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
+  requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
+  endpoints, and the WordPress, plugin and PHP versions the site reveals, and
+  matches those against the feed. Active checks run only after you prove the
+  site is yours (DNS TXT record, a file, or a meta tag; `--print-token` shows
+  how). Without that it reads the homepage and stops.
+- **`phpwarden code PATH`**: 75 rules (74 on by default) for your own PHP code, following request
+  data to `eval`, shell commands, SQL, `unserialize`, includes and redirects.
+  It follows data across files (helper functions and classes elsewhere in the
+  project, fixed includes, class properties); it is not a type checker like
+  PHPStan or Psalm. `phpwarden code --list-rules` lists every rule.
+- **`phpwarden assess`**: one ranked list from every view of a site: installed
+  versions, your code, the live site from outside, and the access log, with the
+  reason for each item ("exploited, reachable, visible from outside, already
+  fetched"). `--out` then `--baseline` reports what is fixed and verified.
+- **`--format sarif`** on `scan`, `deps`, `wordpress`, `probe` and `code`.
+- **`rules --dry-run` and `rules --replay ACCESS_LOG`**: see what the WAF rules
+  would block before they block anything.
+- **Free weekly feed updates**: `phpwarden feed update` without a key pulls a
+  weekly snapshot of the maintained feed. A vulnerability newly listed as known
+  exploited is released to the free channel straight away.
+- **Coverage commitment**: in-scope CISA KEV entries are in the maintained feed
+  within 24 hours of listing, checked on every rebuild and published at
+  https://phpwarden.io/feeds/kev-status.json. Details: https://phpwarden.io/sla
+- **Editors**: a VS Code extension in `integrations/vscode` (build and install
+  the `.vsix` from that folder; not on the Marketplace yet) and PhpStorm External Tool steps in
+  `integrations/phpstorm`.
+
 ## Replacing Wordfence CLI
 
 Wordfence closed new licences for its CLI in October 2026; Free licences stopped working on 2026-10-14 and Premium
@@ -118,8 +167,9 @@ Full guide: https://phpwarden.io/compare/phpwarden-vs-wordfence-cli#replace
 ## Send results to the dashboard
 
 Any `scan`, `deps`, `wordpress` or `detect` run can post its result to
-[app.phpwarden.io](https://app.phpwarden.io) for history across hosts and
-alerts when a finding you already carry lands in KEV:
+[app.phpwarden.io](https://app.phpwarden.io) for history across hosts.
+It marks findings that become known-exploited; email and webhook alerts are on
+Pro and Team, Slack on Team:
 
 ```bash
 phpwarden scan --report-to https://app.phpwarden.io/v1/reports --report-token <token>
@@ -164,7 +214,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: main        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.1.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -175,44 +225,51 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 ## The feed
 
-The bundled community feed (currently 2026.10.31.2) works forever, offline:
+The bundled community feed (2026.11.13.3 in this release) works forever, offline:
 
 - **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
   and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. 19,400+ carry an
-  EPSS score; 42 were in KEV when this feed was built.
+  fixed versions, exposure conditions and detection signatures. About 19,700 carry an
+  EPSS score; 41 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
-  public-domain (OSV, NVD, FriendsOfPHP, CISA KEV, FIRST EPSS). No commercial
+  public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial
   vendor's feed is used, so coverage cannot be revoked or priced away.
 - Every build passes `feedbuilder/check_feed.py` (no open-ended range with a
   known fix, no fixed version inside its own affected range, no duplicate
   (package|slug, cve)). The feed is assembled by `feedbuilder/` from a curated
   base plus bulk imports and enrichment; curated entries always win.
 
-A [phpwarden.io](https://phpwarden.io) subscription unlocks the maintained
-channel — new advisories and KEV/EPSS refreshes as they are triaged — via
-`PHPWARDEN_LICENSE=... phpwarden feed update`. Without a key, phpwarden runs
-the community feed and says so.
-
-Curated engine CVEs with detection signatures:
-
-| CVE | What | Scope |
-|-----|------|-------|
-| CVE-2019-11043 | PHP-FPM env_path_info RCE | FPM + nginx, config-gated |
-| CVE-2023-3824 | PHAR stack overflow RCE | any SAPI, untrusted PHAR |
-| CVE-2024-4577 | PHP-CGI argument injection | Windows + CGI |
-| CVE-2024-8926 / 8927 | cgi.force_redirect bypass | CGI / FPM |
-| CVE-2024-11236 | DB-quoter integer overflow | any SAPI |
-| CVE-2026-109618 / 109619 | php2shell FPM memory RCE | any SAPI |
+Updating the feed is optional and has two channels:
+
+- **Free weekly.** `phpwarden feed update` with no key downloads a weekly
+  snapshot of the maintained feed. A vulnerability newly listed as known
+  exploited is released to this channel straight away. If the server cannot be
+  reached, phpwarden keeps the feed it has and says so. Set
+  `PHPWARDEN_FREE_FEED_URL=off` to stop the no-key update from calling out.
+- **Maintained.** A [phpwarden.io](https://phpwarden.io) subscription gives a
+  license key; `PHPWARDEN_LICENSE=... phpwarden feed update` then pulls the
+  channel that is rebuilt twice a day.
+
+Examples of hand-curated engine CVEs:
+
+| CVE | What | Scope | Log signature |
+|-----|------|-------|---------------|
+| CVE-2019-11043 | PHP-FPM env_path_info RCE | FPM + nginx, config-gated | yes |
+| CVE-2023-3824 | PHAR stack overflow RCE | any SAPI, untrusted PHAR | no |
+| CVE-2024-4577 | PHP-CGI argument injection | Windows + CGI | yes |
+| CVE-2024-8926 | cgi.force_redirect bypass | Windows + CGI | no |
+| CVE-2024-8927 | cgi.force_redirect bypass | CGI / FPM | no |
+| CVE-2024-11236 | DB-quoter integer overflow | any SAPI | no |
+| CVE-2026-109618 / 109619 | php2shell FPM memory RCE | any SAPI | yes |
 
 ## Continuous guard
 
 `scan` and `detect` are point-in-time. For always-on containment of
 in-progress php2shell-class attacks (OOM on a worker, then that worker reused),
 run `phpwarden-guard`, which boots in dry-run and never acts until you promote
-it after a burn-in. See the guard's DESIGN document.
+it after a burn-in. See [`VALIDATION.md`](VALIDATION.md) for what was validated.
 
 ## Honest limits
 

{phpwarden-2.1.1 → phpwarden-2.2.1}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.1.1"
-description = "PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps."
+version = "2.2.1"
+description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies."
 readme = "README.md"
 requires-python = ">=3.8"
 license = "Apache-2.0"

phpwarden-2.2.1/src/phpwarden/__init__.py

@@ -0,0 +1,9 @@
+"""phpwarden: a PHP vulnerability scanner.
+
+It checks the PHP engine, Composer dependencies, WordPress, your own code and
+the live site against a feed of known vulnerabilities, ranks findings by
+real-world exploitation (CISA KEV, then EPSS, then CVSS), and can watch PHP-FPM
+for active exploitation. The engine and the bundled feed are open; free users
+get weekly feed updates, and a subscription adds the feed rebuilt twice a day.
+"""
+__version__ = "2.2.1"