weblogchecker 0.2.2

Second-pass expert-review fix release.

Second-pass expert-review fix (N4) and family consistency.

• N4: the findings cap is now severity-aware. Finding keys
  are admitted against per-severity partitions of the
  100,000-key cap (info 5%, low 45%, medium 30%, high 20%)
  instead of one first-come pool, so a flood of low-signal
  findings (e.g. a botnet's shell probes, one key per source
  IP) can no longer consume the capacity for medium/high
  findings - a real shell finding late in a hostile log is
  still reported. Severity upgrades of admitted keys are
  never blocked. When any tracked state is truncated, the
  verdict headline itself now reads "INCOMPLETE RESULTS"
  (previously only findings_truncated and a NOTE said so),
  and the truncation note lists findings dropped by
  severity.
• Family consistency: JSON reports now carry
  schema_version: 1. (--version already existed.)
• Regression tests for N4 (reviewer's flood shape, medium
  flood, upgrade accounting, incomplete verdict with zero
  findings) and the report contract; 66/66 tests pass under
  both unittest and pytest, false-positive gate included.

weblogchecker 0.2.1

Expert-review fix release (L1-L4); no new analysis surface.

• L1 — performance: the brute-force tracker keeps O(1) running counters instead of rescanning history per entry: a 100k-entry log now processes in ~0.1s where the quadratic scan needed 80s for 40k entries.
• L2 — first-seen precision: a path counts as first-seen only when the log shows it was actually answered (at least one 2xx/3xx); never-answered paths (e.g. thousands of 404 probes) roll into a single count instead of individual phantom findings.
• L3 — bounded state, honest reports: tracked state is capped at 100k keys, and reports disclose truncation (findings_truncated) when the cap is hit rather than silently dropping evidence.
• L4 — proxy blind spot disclosed: when a log carries only proxy IPs, per-client analysis is limited and the report now says so in a NOTE. (--real-ip-field support deferred.)
• Regression tests for L1-L4; tests/__init__.py added. 60/60 tests pass under both unittest and pytest.

Signed sdist + wheel + CycloneDX SBOM attached; verify with pgp-key.asc (fingerprint BAA1 586A AD37 18C0 CE41 D288 FE23 A624 54E3 5307). (PyPI publication follows once the trusted-publisher registration is filed; GitHub releases are the distribution channel until then.)

weblogchecker 0.2.0

Baseline-diff orphan-executable detection: weblogchecker analyze suspect.log --baseline old.log reports executable paths that appear for the first time versus a trusted baseline log, scored on five stacked weak signals (answered 2xx/3xx, POST/PUT, referrer-less, at most 2 IPs, upload-style directory) with full evidence and the family delta vocabulary (NEW). First-seen alone is LOW; medium needs three signals, high four; confidence caps at medium; wp-admin-introduced paths are capped or dropped; baseline members are never flagged. FP gate extended: a normal busy WordPress baseline + later-log pair yields zero medium/high findings. Signed sdist + wheel + CycloneDX SBOM attached; verify with pgp-key.asc (fingerprint BAA1 586A AD37 18C0 CE41 D288 FE23 A624 54E3 5307).

weblogchecker 0.1.0

First release of weblogchecker, the access-log companion to phpscan.

What it does: streams Apache/nginx access logs you own (plain, .gz, or stdin) and reports compromise indicators - webshell interactions (c99/r57/FilesMan/b374k/WSO), the eval-stdin.php UnitTest shell from the October 2026 php2shell wave, executables answering inside upload directories, POSTs to static files, URI exploitation patterns, scanner user-agents, and wp-login/xmlrpc brute-force bursts including a possible-success pattern. Every finding carries severity, confidence, the raw log lines as evidence, and remediation. Exit codes: 0 clean / 1 indicators / 2 usage error.

Honesty rules: indicators are leads, not proof of compromise; failed attempts stay LOW; a bundled fixture of a normal busy WordPress day is asserted in tests to produce zero findings.

Install (PyPI pending publisher setup):
pip install git+https://github.com/PHPatch/weblogchecker.git
or use the signed artifacts below. Verify with pgp-key.asc - PHPatch Security, fingerprint BAA1 586A AD37 18C0 CE41 D288 FE23 A624 54E3 5307.

Stdlib only. No network. Read-only. MIT.