Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 12:54
· 2 commits to main since this release
v0.3.0
75f325f

Binary refresh - 24 October 2026

The downloadable binaries and SHA256SUMS.txt were rebuilt from main to include the PHP2Shell full-scan scope fix. Full scans now perform one passive assessment per explicit origin, using its root or /index.php response, instead of assessing every discovered URL. Redirect destinations and discovered subdomains are excluded from this check.

The version remains v0.3.0. The published v0.3.0 and engine/v0.3.0 source tags and automatic source archives remain at the original release commit. The refreshed executables print their build commit with --version and have updated checksums and GitHub build-provenance attestations.

Highlights

  • Add a dedicated PHP2Shell mode for CVE-2026-109618/CVE-2026-109619. --mode php2shell assesses the explicit target without crawling or running other modules.
  • Combine passive PHP version evidence with bounded multipart crash-signal checks. The report's Coverage section records baseline, control, probe, and stop diagnostics, including HTTP status and request size.
  • Enable per-host WAF-aware payload adaptation by default, with bounded variants, retained original payloads and matched controls. Header/protocol mutations remain separately opt-in.
  • Improve request fidelity, cancellation handling and verification evidence boundaries across the engine.

PHP2Shell safety and interpretation

Run this mode only against an isolated system you own or are explicitly authorized to test. Active requests can exhaust memory or terminate a PHP worker. A version banner or generic HTTP 500 is not proof of exploitation; an active memory-exhaustion signature is a crash signal, not verified code execution. Missing version evidence is inconclusive, not a clean result. See the README PHP2Shell guide and the PHP advisory.

Install with Go

To install the source containing the binary refresh's fix:

go install github.com/akha-security/akca/engine/cmd/akca@main

The following commands install the original tagged v0.3.0 source, which does not include the full-scan scope fix above:

go install github.com/akha-security/akca/engine/cmd/akca@v0.3.0
go install github.com/akha-security/akca/engine/cmd/akca@latest

Downloads

  • akca-windows-amd64.exe - Windows x64
  • akca-linux-amd64 - Linux x64
  • akca-linux-arm64 - Linux ARM64
  • akca-darwin-amd64 - macOS Intel
  • akca-darwin-arm64 - macOS Apple Silicon
  • SHA256SUMS.txt - SHA-256 verification manifest

Release binaries include GitHub build-provenance attestations and can be verified with gh attestation verify <binary> -R akha-security/akca.

Browser-backed checks require Chrome, Chromium, or Edge. Use AKCA only against systems you own or are explicitly authorized to test.

Full changelog: v0.2.9...v0.3.0

Assets 8
Loading