Changelog & feed updates

What's shipped in phpwarden, and how the vulnerability feed stays current.

Current feed snapshot

Channel community+osv+foph+nvd · feed version 2026.10.26.2, bundled and offline. The maintained channel (Pro) refreshes continuously from the same sources.

20,918total advisories

8PHP engine CVEs

8,582Composer

12,328WordPress

v2.0.0 current

2026-10-24

The PHP exposure & exploitation guard — broadened from a single-CVE checker into full-surface coverage.

Three scan surfaces: PHP engine, Composer dependencies (composer.lock) and WordPress core/plugins/themes.
Exploitation-first ranking: findings sorted by CISA KEV then FIRST EPSS, ahead of raw CVSS.
20,918-advisory feed built entirely from open data (OSV, NVD, FriendsOfPHP, CISA KEV, FIRST EPSS) — bundled, offline, no vendor license required.
SaaS dashboard: accounts, email verification, per-project ingest tokens, exploitation-ranked findings, history & trends, CSV/JSON export, email/Slack alerts on new KEV hits.
Automation: GitHub Action, and an ingest API (/v1/reports, /v1/findings, /v1/history).
WAF rule generation (ModSecurity / nginx) and log-based exploitation detection.
Runtime guard companion daemon for PHP-FPM worker-poisoning containment (dry-run).
Distribution targets: single-file zipapp available now; PyPI, Docker and deb/rpm on the GA checklist.

How the feed updates

Sources — OSV.dev (Packagist), FriendsOfPHP/security-advisories, NVD (CVE 2.0), CISA KEV and FIRST EPSS.
Enrichment — every advisory is tagged with its KEV (in-the-wild) status and EPSS score so ranking reflects real exploitation.
Free (community) — the feed bundled with the release you install; refresh by upgrading the package.
Pro (maintained) — phpwarden feed update pulls the continuously-rebuilt channel; set PHPWARDEN_LICENSE to enable it.

Browse every advisory → · Read the feed docs →

Version numbers follow semantic versioning. Feed versions are dated (YYYY.MM.DD.n); the .n suffix increments for same-day rebuilds. Detailed per-release notes accumulate here as new versions ship.