A CVE record describes a vulnerability, not a request, which is why this
channel is written by hand. A Nuclei template contains the request — path,
query, headers, body — because that is what it sends, so for thousands of CVEs
the shape a virtual patch needs is already written down.
What cannot come across is the template's matchers: they read the RESPONSE to
decide whether the target was actually vulnerable, and a WAF decides before a
response exists. So an imported rule is strictly weaker than the template it
came from — it recognises the attempt, not the exploitation. That is why they
land as action "log", which the engine now honours: observed, recorded as an
event, scoring nothing.
Also records what the importer skips rather than guesses: a CVE already
patched in compiled code, a request that is entirely template variables, a
literal under twelve characters, the site root. And what it corrects: one
leading path segment, because a template is written against a laboratory where
the application is mounted somewhere — /laravel52/vendor/phpunit/... would
have been published unable to match a real attack at /vendor/phpunit/...
Documentation only. cve.json is untouched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
CVE-CHANNEL.md showed the PHP upload-progress rule as its worked example, and
that CVE is patched in compiled code. The guard forty lines below the example
exists to refuse exactly that — both rules would fire, the scores would add,
and one attack would be reported as two. So the example a reader was most
likely to copy was the only example that could not be published:
published rule CVE-2026-109618-01 patches CVE-2026-109618, which the
compiled rule "php_upload_progress" already patches
The example is now a CVE that is not patched in code, extracted from this file
and run through the engine's own guard to prove it validates. A sentence beside
the example says why it is not the PHP one, instead of leaving the reader to
find the warning at the bottom after the refusal.
cve.json is untouched and its build_datetime is unchanged, so nothing an edge
node enforces changes with this commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
The channel delivered in 30 seconds: the nonce path went from 404 to 403 at
the edge, a near-miss path stayed 404 so the rule had not over-matched, and
the site root stayed 200 so nothing else had changed.
Withdrawal is a first-class operation here precisely because a patch written
in the hours after a disclosure is written against an advisory and not against
traffic. An empty rulesets array withdraws everything the channel owns, and
this exercises that path while nothing depends on it - which is the only
comfortable time to find out whether it works.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
The channel shipped in engine 3.0.47 and has never carried anything: every
agent fetches cve.json hourly and skips it unread, because the build stamp has
not moved since 23/10. A mechanism that has never delivered a payload is not
known to work, and the day to find that out is not the day after a disclosure.
So: one rule for a path carrying a random nonce. No real client requests it,
nothing legitimate can match it, and it is anchored at both ends — checked
against the path itself and against three near misses before publishing.
This is deliberately NOT the five PHP patterns from engine 3.2.0. Every agent
in the fleet is already on 3.2.0, so those rules would add no protection, and
this document says why that matters: a feed rule and a compiled rule both add
to the same anomaly score, so one attack would be scored twice and reported as
two rules. Verified rather than taken on trust - rules.go accumulates in
eighteen places and ruleset.go:1354 adds to the same total.
Withdrawn as soon as it is confirmed enforced, which also exercises the
withdrawal path this channel treats as a first-class operation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
ModSecurity defines 920120 with !@rx: its pattern describes a filename made only
of SAFE characters, and the rule fires when the filename does NOT match. A
quote, an apostrophe, a semicolon, an equals sign or a backslash in a filename
is an attempt to break out of the Content-Disposition header, and that is what
the rule exists to catch.
This format had no way to express a negation, so the rule was imported as a
plain pattern and means the exact opposite: it matched every legitimate upload
and missed every dangerous filename. It did no harm only because the engine
carried a built-in rule under the same ID — a different rule entirely, matching
content-type.*boundary.* on every ordinary multipart upload — which took
precedence.
The engine gained a `negate` field (3.0.61); this declares it. Both are needed:
the flag alone with no engine support does nothing, and engine support with no
flag leaves the rule inverted.
build_datetime bumped, because an agent skips a feed whose stamp has not moved
without reading it.
Rule 932180 "Restricted File Upload Attempt" targets filename, scores 10 and
blocks. Its pattern carries CRS's OS-pseudo-file list with no path anchor, so
bare words matched any uploaded filename:
module modules meminfo mounts misc mdstat mtrr loadavg locks version
uptime cmdline stat swaps slabinfo partitions pagetypeinfo
So release-version-2.zip, company-misc-notes.pdf and meminfo.txt were refused
as critical RCE attempts. Found because it blocked an image upload to our own
wiki, which sits behind EdgeGuard: the response carried x-edgeguard-id, the
console found the event by that id, and the match was `module-` in the
filename.
These names mean something as a PATH and nothing as a filename, so the branch
now requires a leading slash. The dotfile branch keeps its own (?:\b|^) anchor
and is untouched.
Measured against the previous pattern over a corpus of 51 names: 16 ordinary
filenames released, NOTHING newly blocked, and every true positive still
caught — .htaccess, .env, .aws/credentials, wp-config.php, /proc/version,
/proc/self/environ, ../../proc/modules, uploads/../../proc/kcore.
build_datetime bumped. An agent skips a feed whose stamp has not changed
without reading it, so a corrected pattern under the old stamp would reach
nobody.
A deliberately temporary rule, to prove that a rule published through this
channel reaches every edge node and is enforced, and that withdrawing it
stops the enforcement. It matches a parameter name no real request carries.
To be withdrawn as soon as the test is recorded.
Validated against the engine's TestPublishedFeedDoesNotDuplicateACompiledRule
guard.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
cve.json carries virtual patches: rules written against a named
vulnerability, published as data so that every edge node enforces them
within the hour instead of waiting for an engine release. Engine 3.0.47 and
later fetch it hourly.
It starts empty, which is a valid state and says "no virtual patches at the
moment" — the engine accepts an empty rulesets list as of 3.0.47, and
publishing one is also how the whole channel stands down.
Separate from rulesets.json rather than part of it: each has its own
build_datetime, so each is applied or skipped on its own, and a mistake in
one cannot take out the other. Publishing a patch should not mean
republishing a 357KB mirror of the Core Rule Set.
CVE-CHANNEL.md documents the format, the param_names target, how severity
becomes the anomaly score, and the two mistakes worth avoiding: publishing a
rule for a CVE the engine already patches in code (both fire and the scores
add), and forgetting that there is no backtest for a patch written in the
hours after a disclosure — which is why withdrawal is a first-class
operation here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
AndreandClaude Opus 5
Andre