WordPress.org
Get WordPress

Plugin Directory

Changeset 3758985


Ignore:
Timestamp:
10/21/2026 07:36:32 PM (3 weeks ago)
Author:
nimbleplugin
Message:

1.2.6 - PHP is now part of the security picture. The component inventory knew plugins, themes and WordPress itself, but not the one piece of software every request passes through. Warns when the PHP branch no longer receives security fixes (and caps the score), when support is ending, and when a newer patch level was already out when this release was built - with the date, so the age of the answer travels with it. Flags expose_php, display_errors, allow_url_include and whether PHP can start shell commands. The diagnostics check no longer calls every PHP from 8.1 up a Supported runtime. It does not claim to know about individual advisories: that needs a feed.

Location:
nimble-security
Files:
2 added
12 edited
1 copied

Legend:

Unmodified
Added
Removed

  • nimble-security/tags/1.2.6/changelog.txt

    r3754209 r3758985  
     1= 1.2.6 =
     2* PHP er nu en del af sikkerhedsbilledet. Komponentoversigten kendte plugins,
     3  temaer og WordPress selv - men ikke den ene software paa serveren, som hver
     4  eneste forespoergsel gaar igennem. Den 21. oktober 2026 blev to
     5  uautentificerede fjernudfoersels-fejl rettet i PHP, og pluginnet sagde ikke
     6  et ord om det fundament, det stod paa.
     7* Der advares nu, naar PHP-grenen ikke laengere modtager sikkerhedsrettelser.
     8  Udloebsdatoerne foelger med udgivelsen og afgoeres uden at spoerge nogen.
     9  En gren, der ikke staar i tabellen, meldes som ukendt - ikke som udloebet;
     10  at raabe op om en nyere PHP end udgivelsen kender, er ogsaa et forkert svar.
     11* Der oplyses, naar et nyere patch-niveau allerede var udsendt, da denne
     12  version blev bygget - med datoen, saa svarets alder foelger med svaret.
     13* Fire ting i selve koerselsmiljoeet flages: expose_php (versionen staar i
     14  hver eneste svarhoved), display_errors, allow_url_include, og om PHP kan
     15  starte kommandoer paa serveren.
     16* "PHP runtime" i diagnosticeringen sagde "Supported runtime" om enhver PHP
     17  fra 8.1 og op. Det er et kompatibilitetssvar, og i et sikkerhedsprodukt
     18  laeses det som "ingenting at komme efter her" - PHP 8.1 bestod den i ti
     19  maaneder efter sin sidste sikkerhedsrettelse. Den svarer nu det samme som
     20  scoren.
     21* En udloebet PHP-gren saetter et loft over sikkerhedsscoren i stedet for at
     22  koste et par point. Ingen haardhed ovenpaa goer op for et fundament, der
     23  ikke laengere bliver rettet.
     24* Hvad den stadig ikke kan: sige at en bestemt PHP-version er ramt af en
     25  bestemt saarbarhed. Det kraever et raadgivningsfeed. En tabel over
     26  patch-niveauer frosset ind i et plugin er foraeldet dagen efter naeste
     27  PHP-udgivelse, og et sikkerhedsprodukt, der beroliger stille, er vaerre end
     28  et der tier.
     29
    130= 1.2.5 =
    231* En besked paa Nimble Securitys egne skaermbilleder fortaeller at Pro findes, og

  • nimble-security/tags/1.2.6/nimble-security.php

    r3754209 r3758985  
    44 * Plugin URI: https://nimbleplugins.com/nimble-security/
    55 * Description: High-end WordPress security with identity, integrity, firewall, malware detection, vulnerability inventory, quarantine, active containment, Emergency Lockdown, privacy-safe Operations telemetry and a modular Free/Pro architecture.
    6  * Version: 1.2.5
     6 * Version: 1.2.6
    77 * Requires at least: 6.6
    88 * Requires PHP: 8.1
    … …  
    1818}
    1919
    20 define( 'NIMBLE_SECURITY_VERSION', '1.2.5' );
     20define( 'NIMBLE_SECURITY_VERSION', '1.2.6' );
    2121define( 'NIMBLE_SECURITY_DB_VERSION', '1.0.0' );
    2222define( 'NIMBLE_SECURITY_FILE', __FILE__ );
    … …  
    6868require_once NIMBLE_SECURITY_DIR . 'src/Malware/MalwareScanner.php';
    6969require_once NIMBLE_SECURITY_DIR . 'src/Scanner/ScanOrchestrator.php';
     70require_once NIMBLE_SECURITY_DIR . 'src/Vulnerability/RuntimeAudit.php';
    7071require_once NIMBLE_SECURITY_DIR . 'src/Vulnerability/ComponentInventory.php';
    7172require_once NIMBLE_SECURITY_DIR . 'src/Vulnerability/AdvisoryRepository.php';

  • nimble-security/tags/1.2.6/readme.txt

    r3754209 r3758985  
    55Requires PHP: 8.1
    66Tested up to: 7.1
    7 Stable tag: 1.2.5
     7Stable tag: 1.2.6
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html

  • nimble-security/tags/1.2.6/src/Diagnostics/SystemDiagnostics.php

    r3684665 r3758985  
    22namespace NimblePlugins\Security\Diagnostics;
    33
     4use NimblePlugins\Security\Vulnerability\RuntimeAudit;
    45use NimblePlugins\Security\Core\Database;
    56use NimblePlugins\Security\Core\NetworkContext;
    … …  
    136137                global $wp_version;
    137138                $php_ok = version_compare( PHP_VERSION, '8.1', '>=' );
     139                /*
     140                 * "Supported runtime" used to mean "new enough to run this plugin".
     141                 * In a security product that reads as "nothing to worry about here",
     142                 * and PHP 8.1 passed it for ten months after its last security fix.
     143                 * The answer now comes from the same place the score gets it.
     144                 */
     145                $php_runtime = ( new RuntimeAudit() )->summary();
     146                $php_state   = ! $php_ok ? 'fail' : ( 'unsupported' === $php_runtime['state'] ? 'fail' : ( in_array( $php_runtime['state'], array( 'ending_soon', 'behind_patch' ), true ) ? 'warning' : 'pass' ) );
     147                $php_detail  = ! $php_ok
     148                        ? __( 'PHP 8.1 or newer is required.', 'nimble-security' )
     149                        : (string) $php_runtime['detail'];
    138150                $wp_ok = isset( $wp_version ) && version_compare( (string) $wp_version, '6.6', '>=' );
    139151                $openssl_ok = function_exists( 'openssl_encrypt' ) && in_array( 'aes-256-gcm', array_map( 'strtolower', openssl_get_cipher_methods() ), true );
    … …  
    148160
    149161                return array(
    150                         $this->check( 'runtime_php', 'Runtime', __( 'PHP runtime', 'nimble-security' ), $php_ok ? 'pass' : 'fail', sprintf( 'PHP %s', PHP_VERSION ), $php_ok ? __( 'Supported runtime.', 'nimble-security' ) : __( 'PHP 8.1 or newer is required.', 'nimble-security' ) ),
     162                        $this->check( 'runtime_php', 'Runtime', __( 'PHP runtime', 'nimble-security' ), $php_state, sprintf( 'PHP %s', PHP_VERSION ), $php_detail ),
    151163                        $this->check( 'runtime_wp', 'Runtime', __( 'WordPress version', 'nimble-security' ), $wp_ok ? 'pass' : 'fail', isset( $wp_version ) ? 'WordPress ' . (string) $wp_version : 'Unknown', $wp_ok ? __( 'Supported WordPress generation.', 'nimble-security' ) : __( 'WordPress 6.6 or newer is required.', 'nimble-security' ) ),
    152164                        $this->check( 'runtime_https', 'Runtime', __( 'HTTPS', 'nimble-security' ), $https ? 'pass' : 'warning', $https ? __( 'Active', 'nimble-security' ) : __( 'Not detected', 'nimble-security' ), $https ? __( 'Administration is served over HTTPS.', 'nimble-security' ) : __( 'HTTPS is strongly recommended for credentials and security administration.', 'nimble-security' ) ),

  • nimble-security/tags/1.2.6/src/Security/SecurityScore.php

    r3684665 r3758985  
    77use NimblePlugins\Security\Malware\MalwareStatus;
    88use NimblePlugins\Security\Vulnerability\VulnerabilityStatus;
     9use NimblePlugins\Security\Vulnerability\RuntimeAudit;
    910use NimblePlugins\Security\Response\RecoveryCoordinator;
    1011use NimblePlugins\Security\Response\IncidentRepository;
    … …  
    9798                        }
    9899                        $checks[] = $this->result( __( 'Software updates', 'nimble-security' ), __( 'WordPress, plugins and themes have no known update waiting in the local WordPress update state.', 'nimble-security' ), 10, $updates_current, 'vulnerability' );
     100                }
     101
     102                /*
     103                 * PHP carries no weight of its own, and that is on purpose.
     104                 *
     105                 * The weights above add up to 100. Giving the runtime a few points of
     106                 * its own would let a site keep a comfortable score while standing on a
     107                 * branch that stopped receiving security fixes - which is the one state
     108                 * no amount of hardening above it makes up for. So it caps the score
     109                 * instead, the way an open critical incident does, and is listed
     110                 * without weight so the reader can see what it found either way.
     111                 */
     112                $runtime = ( new RuntimeAudit() )->report();
     113                if ( 'unsupported' === $runtime['support'] ) {
     114                        $this->apply_cap( $score_cap, $score_cap_reason, 49, __( 'PHP no longer receives security fixes on this branch.', 'nimble-security' ) );
     115                }
     116                $checks[] = $this->result( (string) $runtime['title'], (string) $runtime['detail'], 0, (bool) $runtime['passed'], 'vulnerability' );
     117                foreach ( $runtime['exposures'] as $exposure ) {
     118                        $checks[] = $this->result( (string) $exposure['title'], (string) $exposure['detail'], 0, false, 'vulnerability' );
    99119                }
    100120

  • nimble-security/tags/1.2.6/src/Vulnerability/VulnerabilityStatus.php

    r3684665 r3758985  
    4040                        'open_findings'  => $counts,
    4141                        'inventory'      => $inventory,
     42                        /*
     43                         * The runtime every request passes through. It is decided offline
     44                         * from dates shipped with this release, so it is reported beside
     45                         * the feed-driven findings rather than mixed into them: the two
     46                         * know different things, and only one of them knows about
     47                         * individual advisories.
     48                         */
     49                        'runtime'        => ( new RuntimeAudit() )->report(),
    4250                );
    4351        }

  • nimble-security/trunk/changelog.txt

    r3754209 r3758985  
     1= 1.2.6 =
     2* PHP er nu en del af sikkerhedsbilledet. Komponentoversigten kendte plugins,
     3  temaer og WordPress selv - men ikke den ene software paa serveren, som hver
     4  eneste forespoergsel gaar igennem. Den 21. oktober 2026 blev to
     5  uautentificerede fjernudfoersels-fejl rettet i PHP, og pluginnet sagde ikke
     6  et ord om det fundament, det stod paa.
     7* Der advares nu, naar PHP-grenen ikke laengere modtager sikkerhedsrettelser.
     8  Udloebsdatoerne foelger med udgivelsen og afgoeres uden at spoerge nogen.
     9  En gren, der ikke staar i tabellen, meldes som ukendt - ikke som udloebet;
     10  at raabe op om en nyere PHP end udgivelsen kender, er ogsaa et forkert svar.
     11* Der oplyses, naar et nyere patch-niveau allerede var udsendt, da denne
     12  version blev bygget - med datoen, saa svarets alder foelger med svaret.
     13* Fire ting i selve koerselsmiljoeet flages: expose_php (versionen staar i
     14  hver eneste svarhoved), display_errors, allow_url_include, og om PHP kan
     15  starte kommandoer paa serveren.
     16* "PHP runtime" i diagnosticeringen sagde "Supported runtime" om enhver PHP
     17  fra 8.1 og op. Det er et kompatibilitetssvar, og i et sikkerhedsprodukt
     18  laeses det som "ingenting at komme efter her" - PHP 8.1 bestod den i ti
     19  maaneder efter sin sidste sikkerhedsrettelse. Den svarer nu det samme som
     20  scoren.
     21* En udloebet PHP-gren saetter et loft over sikkerhedsscoren i stedet for at
     22  koste et par point. Ingen haardhed ovenpaa goer op for et fundament, der
     23  ikke laengere bliver rettet.
     24* Hvad den stadig ikke kan: sige at en bestemt PHP-version er ramt af en
     25  bestemt saarbarhed. Det kraever et raadgivningsfeed. En tabel over
     26  patch-niveauer frosset ind i et plugin er foraeldet dagen efter naeste
     27  PHP-udgivelse, og et sikkerhedsprodukt, der beroliger stille, er vaerre end
     28  et der tier.
     29
    130= 1.2.5 =
    231* En besked paa Nimble Securitys egne skaermbilleder fortaeller at Pro findes, og

  • nimble-security/trunk/nimble-security.php

    r3754209 r3758985  
    44 * Plugin URI: https://nimbleplugins.com/nimble-security/
    55 * Description: High-end WordPress security with identity, integrity, firewall, malware detection, vulnerability inventory, quarantine, active containment, Emergency Lockdown, privacy-safe Operations telemetry and a modular Free/Pro architecture.
    6  * Version: 1.2.5
     6 * Version: 1.2.6
    77 * Requires at least: 6.6
    88 * Requires PHP: 8.1
    … …  
    1818}
    1919
    20 define( 'NIMBLE_SECURITY_VERSION', '1.2.5' );
     20define( 'NIMBLE_SECURITY_VERSION', '1.2.6' );
    2121define( 'NIMBLE_SECURITY_DB_VERSION', '1.0.0' );
    2222define( 'NIMBLE_SECURITY_FILE', __FILE__ );
    … …  
    6868require_once NIMBLE_SECURITY_DIR . 'src/Malware/MalwareScanner.php';
    6969require_once NIMBLE_SECURITY_DIR . 'src/Scanner/ScanOrchestrator.php';
     70require_once NIMBLE_SECURITY_DIR . 'src/Vulnerability/RuntimeAudit.php';
    7071require_once NIMBLE_SECURITY_DIR . 'src/Vulnerability/ComponentInventory.php';
    7172require_once NIMBLE_SECURITY_DIR . 'src/Vulnerability/AdvisoryRepository.php';

  • nimble-security/trunk/readme.txt

    r3754209 r3758985  
    55Requires PHP: 8.1
    66Tested up to: 7.1
    7 Stable tag: 1.2.5
     7Stable tag: 1.2.6
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html

  • nimble-security/trunk/src/Diagnostics/SystemDiagnostics.php

    r3684665 r3758985  
    22namespace NimblePlugins\Security\Diagnostics;
    33
     4use NimblePlugins\Security\Vulnerability\RuntimeAudit;
    45use NimblePlugins\Security\Core\Database;
    56use NimblePlugins\Security\Core\NetworkContext;
    … …  
    136137                global $wp_version;
    137138                $php_ok = version_compare( PHP_VERSION, '8.1', '>=' );
     139                /*
     140                 * "Supported runtime" used to mean "new enough to run this plugin".
     141                 * In a security product that reads as "nothing to worry about here",
     142                 * and PHP 8.1 passed it for ten months after its last security fix.
     143                 * The answer now comes from the same place the score gets it.
     144                 */
     145                $php_runtime = ( new RuntimeAudit() )->summary();
     146                $php_state   = ! $php_ok ? 'fail' : ( 'unsupported' === $php_runtime['state'] ? 'fail' : ( in_array( $php_runtime['state'], array( 'ending_soon', 'behind_patch' ), true ) ? 'warning' : 'pass' ) );
     147                $php_detail  = ! $php_ok
     148                        ? __( 'PHP 8.1 or newer is required.', 'nimble-security' )
     149                        : (string) $php_runtime['detail'];
    138150                $wp_ok = isset( $wp_version ) && version_compare( (string) $wp_version, '6.6', '>=' );
    139151                $openssl_ok = function_exists( 'openssl_encrypt' ) && in_array( 'aes-256-gcm', array_map( 'strtolower', openssl_get_cipher_methods() ), true );
    … …  
    148160
    149161                return array(
    150                         $this->check( 'runtime_php', 'Runtime', __( 'PHP runtime', 'nimble-security' ), $php_ok ? 'pass' : 'fail', sprintf( 'PHP %s', PHP_VERSION ), $php_ok ? __( 'Supported runtime.', 'nimble-security' ) : __( 'PHP 8.1 or newer is required.', 'nimble-security' ) ),
     162                        $this->check( 'runtime_php', 'Runtime', __( 'PHP runtime', 'nimble-security' ), $php_state, sprintf( 'PHP %s', PHP_VERSION ), $php_detail ),
    151163                        $this->check( 'runtime_wp', 'Runtime', __( 'WordPress version', 'nimble-security' ), $wp_ok ? 'pass' : 'fail', isset( $wp_version ) ? 'WordPress ' . (string) $wp_version : 'Unknown', $wp_ok ? __( 'Supported WordPress generation.', 'nimble-security' ) : __( 'WordPress 6.6 or newer is required.', 'nimble-security' ) ),
    152164                        $this->check( 'runtime_https', 'Runtime', __( 'HTTPS', 'nimble-security' ), $https ? 'pass' : 'warning', $https ? __( 'Active', 'nimble-security' ) : __( 'Not detected', 'nimble-security' ), $https ? __( 'Administration is served over HTTPS.', 'nimble-security' ) : __( 'HTTPS is strongly recommended for credentials and security administration.', 'nimble-security' ) ),

  • nimble-security/trunk/src/Security/SecurityScore.php

    r3684665 r3758985  
    77use NimblePlugins\Security\Malware\MalwareStatus;
    88use NimblePlugins\Security\Vulnerability\VulnerabilityStatus;
     9use NimblePlugins\Security\Vulnerability\RuntimeAudit;
    910use NimblePlugins\Security\Response\RecoveryCoordinator;
    1011use NimblePlugins\Security\Response\IncidentRepository;
    … …  
    9798                        }
    9899                        $checks[] = $this->result( __( 'Software updates', 'nimble-security' ), __( 'WordPress, plugins and themes have no known update waiting in the local WordPress update state.', 'nimble-security' ), 10, $updates_current, 'vulnerability' );
     100                }
     101
     102                /*
     103                 * PHP carries no weight of its own, and that is on purpose.
     104                 *
     105                 * The weights above add up to 100. Giving the runtime a few points of
     106                 * its own would let a site keep a comfortable score while standing on a
     107                 * branch that stopped receiving security fixes - which is the one state
     108                 * no amount of hardening above it makes up for. So it caps the score
     109                 * instead, the way an open critical incident does, and is listed
     110                 * without weight so the reader can see what it found either way.
     111                 */
     112                $runtime = ( new RuntimeAudit() )->report();
     113                if ( 'unsupported' === $runtime['support'] ) {
     114                        $this->apply_cap( $score_cap, $score_cap_reason, 49, __( 'PHP no longer receives security fixes on this branch.', 'nimble-security' ) );
     115                }
     116                $checks[] = $this->result( (string) $runtime['title'], (string) $runtime['detail'], 0, (bool) $runtime['passed'], 'vulnerability' );
     117                foreach ( $runtime['exposures'] as $exposure ) {
     118                        $checks[] = $this->result( (string) $exposure['title'], (string) $exposure['detail'], 0, false, 'vulnerability' );
    99119                }
    100120

  • nimble-security/trunk/src/Vulnerability/VulnerabilityStatus.php

    r3684665 r3758985  
    4040                        'open_findings'  => $counts,
    4141                        'inventory'      => $inventory,
     42                        /*
     43                         * The runtime every request passes through. It is decided offline
     44                         * from dates shipped with this release, so it is reported beside
     45                         * the feed-driven findings rather than mixed into them: the two
     46                         * know different things, and only one of them knows about
     47                         * individual advisories.
     48                         */
     49                        'runtime'        => ( new RuntimeAudit() )->report(),
    4250                );
    4351        }
Note: See TracChangeset for help on using the changeset viewer.