PenX v0.4.11

Availability: Download the current Windows installer or portable ZIP from the latest official PenX release, together with its SHA-256 checksums. GitHub-generated source archives are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

Independent field acceptance: NOT SIGNED OFF. Green CI checks validate automated contracts and packaged application smoke tests; they do not establish real Windows/Npcap behavior for all 12 scanners, installer upgrade/rollback, restored SQLite/MariaDB backups, or visual report quality. These checks remain tracked by #81 and #82. PHP2Shell version/header findings are not proof of RCE exploitation.

---

PenX v0.4.11 — release highlights

This release packages changes merged after the v0.4.10 Windows build.

Highlights

• Scan evidence and comparisons: Improved traceability from scanner observations to findings, more careful treatment of incomplete coverage and stronger endpoint-scoped finding identity.
• Headless scanning and CI: Non-interactive authorized collection with bounded execution, structured JSON/SARIF output and explicit exit codes for partial results, scanner errors and finding thresholds.
• Flexible scanner configuration: Typed profiles, independent scan preflight, bounded scheduling and configuration validation. Existing scanner consent requirements remain in place.
• Guided beginner scanning: A simpler flow for choosing explicitly authorized scopes and suitable scan profiles.
• Local AI review: Optional bounded local-model review of previously collected evidence with stronger input validation; review suggestions are not vulnerability confirmations.
• PHP2Shell checks: Offline review of configuration and log indicators plus a non-exploiting live HTTP header/version assessment. The live check does not execute an exploit and cannot confirm remote code execution or patch state by itself.
• Stability and repository security: Additional safeguards for metadata parsing, scan result integrity, artifact recovery, reporting, database edge cases and CI checks on main. Stale topic branches were cleaned up and main protection enabled.

Packaging and limitations

Windows downloads are published only after the immutable v0.4.11 tag triggers a successful Windows Release workflow, including the packaged EXE/installer smoke tests and SHA-256 generation. Do not treat a version bump or draft manifest as a published binary.

Independent field acceptance remains NOT SIGNED OFF. The Windows/Npcap/12-scanner matrix (#81), database restore / Windows upgrade / report recovery scenarios (#82) and some manual hardware/visual scenarios remain outstanding. The installer is not Authenticode-signed. External scanners and local AI models are not bundled.

Use PenX only with explicit target authorization; scanner output and model suggestions require independent validation.

Automatically generated change list

What's Changed

• Align v0.4.10 README, package drafts, and release status with published assets by @spk-c in #103
• Add non-exploiting PHP2Shell local log and php.ini triage by @spk-c in #104
• Add non-exploiting PHP2Shell check to standard live scans by @spk-c in #105
• fix: verify main pushes, repair ruleset checks and safely prune old branches by @spk-c in #106
• fix: correct ancestor comparison direction in merged branch pruner by @spk-c in #107
• release: prepare PenX v0.4.11 Windows build and notes by @spk-c in #108
• fix(release): make v0.4.11 publishing preflight reliable by @spk-c in #109
• fix(release): permit missing path-filtered package check, preserve full Windows gates by @spk-c in #111

Full Changelog: v0.4.10...v0.4.11

PenX v0.4.10

Availability: Download the current Windows installer or portable ZIP from the latest official PenX release, together with its SHA-256 checksums. GitHub-generated source archives are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• docs(packaging): publish v0.4.9 download references and pinned Scoop/WinGet drafts by @spk-c in #85
• feat(web): scoped Katana→ffuf mapping and persistent endpoint inventory by @spk-c in #86
• feat: Extend Katana/ffuf endpoint mapping with targeted safe GET probes by @spk-c in #87
• test: make Windows field acceptance for #81/#82 auditable by @spk-c in #88
• fix: harden scanner evidence, endpoint mapping and terminal output by @spk-c in #89
• fix: preserve passive evidence integrity and redact HTTP/report secrets by @spk-c in #90
• fix: redact native scanner JSONL URLs and error payloads by @spk-c in #91
• docs: improve PenX README layout, downloads and discoverability by @spk-c in #92
• feat: universal local LLM backend discovery and compatibility negotiation by @spk-c in #93
• Make scan comparisons coverage-aware and expose per-finding evidence by @spk-c in #94
• docs: remove outdated internal documents and refresh public guides by @spk-c in #95
• Fix broken CI after docs cleanup and retire obsolete release automation by @spk-c in #96
• docs: Phase 0 — repository audit, roadmap, and architecture plan by @spk-c in #98
• chore: remove obsolete public automation and historical manifests by @spk-c in #97
• ci: reduce GitHub Actions usage while preserving required checks by @spk-c in #99
• Phase 1: scan orchestration — plans, profiles, parallel executor, preflight, metadata v3 by @spk-c in #100
• Add offline PHP2Shell CVE-2026-109618/109619 release-posture advisory by @spk-c in #101
• Fix v0.4.10 release bootstrap and source/manifest version contract by @spk-c in #102

Full Changelog: v0.4.9...v0.4.10

PenX v0.4.9

Availability: PenX v0.4.7 Windows installer and portable ZIP are published, with SHA-256 checksums. Source archives generated automatically by GitHub are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• ci(release): one-shot v0.4.8 tag and tagged Windows release dispatch by @spk-c in #43
• ci(release): use authenticated Git push for audited v0.4.8 tag creation by @spk-c in #44
• docs(release): publish 0.4.8 download links, Scoop checksum and remove one-shot trigger by @spk-c in #45
• docs: clarify v0.4.8 field acceptance and closed tracking issues by @spk-c in #46
• fix: robust release metadata checks and fail-closed web target parsing by @spk-c in #47
• fix: reject alternative local-IP page URLs and invalid LLM endpoint configuration by @spk-c in #48
• fix(scanners): prevent empty output from being marked as evidence by @spk-c in #49
• fix(research): preserve valid search results while bounding untrusted provider output by @spk-c in #50
• fix(advisories): always close WordPress GitHub API responses by @spk-c in #51
• fix(scan-diff): reject invalid Nmap ports and avoid false port changes by @spk-c in #52
• fix(cve): fail closed on malformed CVSS and EPSS priority scores by @spk-c in #53
• fix(risk): preserve reviewed scores and techniques on partial override edits by @spk-c in #54
• fix(parsers): prevent reviewer or sample text from setting final risk level by @spk-c in #55
• fix(recovery): prevent partial scan and AI assessment backup files by @spk-c in #56
• fix(audit): eliminate cache and inventory stat/read races by @spk-c in #57
• fix(audit): prevent DNS rebinding in public HTTPS research by @spk-c in #58
• docs(audit): reconcile fixed findings and remaining Windows acceptance gates by @spk-c in #59
• fix(scanners): do not classify malformed Subfinder/Katana output as successful discovery by @spk-c in #60
• fix(trends): reject impossible and non-public Shodan IPs in scan diffs by @spk-c in #61
• fix(research): block multicast addresses at HTTPS URL and DNS socket checks by @spk-c in #62
• fix(vendor): prevent Debian tracker snapshot stat/read race by @spk-c in #63
• fix(reports): use fsynced exclusive publisher for JSON and SARIF by @spk-c in #64
• fix(ffuf): enforce wordlist byte limit on an opened non-symlink file by @spk-c in #65
• fix(reports): redact IPv6 literals from JSON/SARIF exports by @spk-c in #67
• fix(nvd): strictly validate CVE IDs and keep good candidates despite bad links by @spk-c in #66
• fix(analysis): bound scanner/search tool context returned to local LLM by @spk-c in #68
• fix(verification): prevent duplicate source annotations on repeated assessments by @spk-c in #69
• fix(osv): reject malformed external vulnerability identifiers by @spk-c in #70
• fix(llm): apply structured report budgets before JSON/schema traversal by @spk-c in #71
• fix(advisories): validate GitHub GHSA identities and linked advisory URLs by @spk-c in #72
• fix(priority): stale EPSS scores must not survive unsuccessful refreshes by @spk-c in #73
• fix(sources): refresh NVD and CISA KEV status caches after 24 hours by @spk-c in #74
• fix(nvd): enforce concrete CPE versions even when range bounds exist by @spk-c in #76
• fix(sources): expire in-memory NVD cache and isolate KEV membership sets by @spk-c in #75
• fix(reports): prevent manifest stat/read and symlink swap races by @spk-c in #77
• fix(analysis): cap reviewer evidence across many scanner sections by @spk-c in #78
• docs: remove REFACTOR_ACCEPTANCE.md by @spk-c in #79
• chore: clean stale docs, track remaining work, prune verified merged branches by @spk-c in #83
• release: prepare PenX v0.4.9 with CI-gated tagged Windows publication by @spk-c in #84

Full Changelog: v0.4.8...v0.4.9

PenX v0.4.8

Availability: PenX v0.4.7 Windows installer and portable ZIP are published, with SHA-256 checksums. Source archives generated automatically by GitHub are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• Refactor follow-ups: published v0.4.7 docs, model-client isolation and static coverage by @spk-c in #15
• Maintenance: add safe dry-run cleanup for merged GitHub branches by @spk-c in #16
• Fix PowerShell 5.1 merged-branch cleanup array enumeration by @spk-c in #17
• Issue #13: isolate local LLM POST transport and research progress from terminal by @spk-c in #18
• fix: eliminate false positives from legacy import inventory (#14) by @spk-c in #19
• fix: release HTTP connections after LLM model discovery by @spk-c in #20
• fix: reject malformed LLM SSE frames and redact port metadata by @spk-c in #21
• fix: fail closed on malformed NVD and CISA KEV API data by @spk-c in #22
• fix: avoid live scanner timeout crash after early output EOF by @spk-c in #23
• fix: close HTTP responses in HTML research fetcher by @spk-c in #24
• fix: prevent typed reasoning blocks from becoming LLM output by @spk-c in #25
• fix: fail closed on invalid scanner adapter return values by @spk-c in #26
• fix: exclude failed scanner evidence and cap model tool dispatch by @spk-c in #27
• fix: deduplicate CVE source requests within each assessment by @spk-c in #28
• fix: fail closed on malformed Censys services in passive recon by @spk-c in #29
• fix: reject malformed host ports and bracketed IPv6 targets by @spk-c in #30
• quality: audit all Python modules and exercise SQLite v2 restore/Windows scanner processes by @spk-c in #31
• fix: reject report staging symlinks and external renderer files by @spk-c in #32
• fix: use consistent SQLite read snapshots for session reports by @spk-c in #33
• fix: serialize concurrent report publishing and deletion per session by @spk-c in #34
• fix: read evaluation and distillation exports from one SQLite snapshot by @spk-c in #35
• fix: serialize concurrent evaluator imports before duplicate checks by @spk-c in #36
• fix: pin a consistent SQLite snapshot for training-data exports by @spk-c in #37
• fix: serialize finding deletion with correction, fix and evaluation writes by @spk-c in #38
• fix: bounded SQLite BUSY retries for safe session writer-lock acquisition by @spk-c in #39
• fix: address SQL, scanner, storage and report audit findings by @spk-c in #41
• fix(security): gate model web search, bound page downloads and isolate malformed NVD data by @spk-c in #40
• release: prepare v0.4.8 for audit-fix Windows release by @spk-c in #42

Full Changelog: v0.4.7...v0.4.8

PenX v0.4.7

Availability: v0.4.6 Windows installer and portable ZIP are published. Newer source code on main is not a downloadable binary until another successful tagged release. GitHub's automatic source archives are not executables.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• Refactor: wire Ctrl+C cancellation through the terminal scanner picker by @spk-c in #2
• Refactor quality: enforce Ruff and mypy for scanner selection and CLI modules by @spk-c in #3
• Refactor Pk08: isolate CVE source-client transports and provider orchestration by @spk-c in #4
• Refactor Pk04/Pk05: cooperative cancellation for Python network adapters by @spk-c in #5
• Refactor Pk11: verify Windows installer uninstalls and preserves user data in CI by @spk-c in #6
• Refactor Pk02: complete settings precedence matrix and safe Windows acceptance kit by @spk-c in #7
• Pk07: exercise real MariaDB dump/restore and summary integrity in CI by @spk-c in #8
• Pk11: smoke-test the non-invasive field evidence collector on Windows by @spk-c in #9
• Prepare PenX v0.4.7 maintenance release and correct stale download documentation by @spk-c in #10

Full Changelog: v0.4.6...v0.4.7

PenX v0.4.6

Availability: The new GitHub repository has no published Windows release yet. Use GitHub Releases only after verified binaries are attached. GitHub's automatic source archives are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• CI: run Python compatibility checks when release setup changes by @spk-c in #1

New Contributors

• @spk-c made their first contribution in #1

Full Changelog: https://github.com/spk-c/PenX/commits/v0.4.6