{
  "build_datetime": "2026-11-04T15:00:48Z",
  "rulesets": [
    {
      "id": "edgeguard-cve",
      "name": "EdgeGuard CVE Virtual Patches",
      "version": "1",
      "source": "edgeguard-cve",
      "description": "Virtual patches for named vulnerabilities",
      "enabled": true,
      "priority": 1,
      "rules": [
        {
          "id": "CVE-2017-9841-N1",
          "name": "PHPUnit - Remote Code Execution",
          "pattern": "(?i)/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin\\.php",
          "targets": [
            "uri"
          ],
          "action": "block",
          "severity": "critical",
          "category": "cve",
          "cve": "CVE-2017-9841",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine \u2014 the decision is severity-derived score against the tenant threshold \u2014 so a sub-threshold rule neither blocks nor records anything."
        }
      ]
    }
  ]
}