DarkMoon v1.6.0 — Signal-driven vulnerability scanning

DarkMoon v1.6.0 — Signal-driven vulnerability scanning

This release makes the open-source engine find the vulnerabilities a version string already proves, without the slow, blind scans that used to block a campaign. The sub-agents now dispatch nuclei / vulnx the way a human pentester would: only once a product and version are confirmed, scoped to that product, and bounded in time.

🎯 Targeted vuln sweep — generic, signal-driven, fast

Every web/service specialist agent (36 of them) now carries one shared, bounded scanner-dispatch doctrine instead of the old "same generic -tags exposure,misconfig,tech-detect for everyone":

• Fires only on a confirmed product. No product in hand = no sweep. A scanner with nothing to aim at is exactly the blind, minutes-long scan we removed.
• vulnx first (cheapest, and it reports whether a Nuclei template even exists for each CVE, plus EPSS / KEV), then nuclei targeted to the exact CVEs that matched the observed version — seconds, not minutes. A broad -tags <product> pass runs only as the no-version fallback.
• ≤ 90s wall-clock budget, hard per-command timeouts; the campaign never blocks on a scanner.
• Non-destructive always — detection / cve-check templates only, never intrusive,dos,fuzz,bruteforce and never a payload that can crash or mutate the target.
• Secondary tech is a signal, not a side-quest: a product an agent doesn't own (a database banner, a reverse proxy, another framework) is recorded as a fact so the orchestrator dispatches the right agent — it is never scanned in place.

Each agent is parameterised by a single tech profile (its nuclei tags + vulnx query), so the doctrine is identical everywhere and extends to a new product in one line.

🐘 PHP runtime CVE check — catches PHP2Shell

Runtime CVEs sit below the application, where CMS modules never look and nuclei misses them until a template ships. Every PHP-family agent (php, WordPress, Drupal, Joomla, Magento, Moodle, PrestaShop) now fingerprints the PHP runtime and matches it against a runtime CVE table, starting with PHP2Shell — CVE-2026-109618 / CVE-2026-109619 (unauthenticated RCE, disclosed 2026-10-21). Memory-corruption bugs are proven by the version match against the vendor advisory and never exploited by design (no safe PoC); the finding carries the exact remediation from php.net.

🧪 Reliability & test hardening

• Executor ↔ workflow allow-list kept in sync by a drift test, so the two tool lists can't silently diverge. — thanks @kocaemre (#51)
• MCP workflow validation helper + suite (mcp/test_workflow.py). — thanks @RajGahoi (#52)
• PortScanWorkflow.scan_ports covered with a fake docker client. — thanks @maximilianfeix (#53)
• arm64 / Apple Silicon toolbox builds fixed (intel-opencl-icd installed on amd64 only).

📚 Docs

• OSS install/run and integration tutorials surfaced from the README and hero; consistent honesty pass on claims (evidence, not "proof").

---

Every scanner dispatch in this release is targeted, time-boxed and non-destructive by construction. As always, DarkMoon reports safe metadata only — severity, status, MITRE, CVE ids, version evidence — never exploits, secrets or tokens.