Penthera news https://penthera.org/news 2026-11-01T00:00:00Z Penthera 2.2.0https://github.com/danoszz/penthera/releases/tag/v2.2.02026-11-01T00:00:00ZWhat changed, in the changelog. Penthera 2.1.2https://github.com/danoszz/penthera/releases/tag/v2.1.22026-10-31T00:00:00ZWhat changed, in the changelog. State of the Web 2026, follow-up: is the front-door gap real, and what do bot challenges hide?https://github.com/danoszz/penthera/blob/main/docs/research/prereg/E20r-front-door-replication.md2026-10-30T00:00:00ZA follow-up with new groups of sites and a new check, registered before it ran. Aggregates only. Penthera 2.1.1https://github.com/danoszz/penthera/releases/tag/v2.1.12026-10-30T00:00:00ZWhat changed, in the changelog. State of the Web 2026: how do websites score on front-door checks?https://github.com/danoszz/penthera/blob/main/docs/research/prereg/E20-front-door.md2026-10-29T00:00:00ZHow do the most visited sites, and recent startups, score on the live check's passive front-door checks? Aggregates only. Penthera 2.1.0https://github.com/danoszz/penthera/releases/tag/v2.1.02026-10-29T00:00:00ZWhat changed, in the changelog. E17: the registered run on macOS and Ubuntu made no outside connection and gave the same result, for every command in scopehttps://github.com/danoszz/penthera/blob/main/docs/research/prereg/E17-offline-and-determinism.md2026-10-28T00:00:00ZURL scans are covered only with --offline: without it, a URL scan downloads the Retire.js database. git runs outside the guard. How we benchmarked Penthera against 25 free tools, losses includedhttps://penthera.org/blog/sealed-half-benchmark2026-10-28T00:00:00ZWe tuned on one half of four public datasets and scored once on the other, sealed half. What that method is, what it found, and how far to trust it. We benchmarked 10 free secret scanners on 2,220 labelled secrets. We came 2nd.https://penthera.org/blog/secret-scanners-creddata2026-10-28T00:00:00Zgitleaks, trufflehog, deepsecrets, Nosey Parker and five more on Samsung CredData's sealed half, with intervals, the limits, and where Penthera loses. E14: merging the free tools found more secrets but cost more than 0.02 precision, so --giants keeps Penthera-firsthttps://github.com/danoszz/penthera/blob/main/docs/research/prereg/E14-giants-combination.md2026-10-25T00:00:00ZDoes one report from Penthera and the free tools find more than Penthera alone, without losing more than a fixed margin of precision? The answer sets the default for --giants. Leaked secretshttps://penthera.org/benchmarks/secrets2026-10-25T00:00:00ZEvery tool, every interval, on the sealed half. Malicious npm packageshttps://penthera.org/benchmarks/npm-malware2026-10-25T00:00:00ZEvery tool, every interval, on the sealed half. Malicious PyPI packageshttps://penthera.org/benchmarks/pypi-malware2026-10-25T00:00:00ZEvery tool, every interval, on the sealed half. Injection bugs in JavaScript librarieshttps://penthera.org/benchmarks/js-injection2026-10-25T00:00:00ZEvery tool, every interval, on the sealed half. Penthera 2.0.0https://github.com/danoszz/penthera/releases/tag/v2.0.02026-10-25T00:00:00ZWhat changed, in the changelog. E11: Penthera 1.9.0 missed all five registered targets on the three public datasetshttps://github.com/danoszz/penthera/blob/main/docs/research/prereg/E11-public-benchmarks.md2026-10-24T00:00:00ZOne public benchmark per capability, with answer keys we had no hand in: secrets on Samsung CredData, code sinks on SecBench.js, malicious packages on DataDog's dataset. E11b: 2nd on secrets, tied 1st to 3rd on npm and PyPI malware, tied 1st to 4th on JS injectionhttps://github.com/danoszz/penthera/blob/main/docs/research/prereg/E11b-improvement-study.md2026-10-24T00:00:00ZTune on a dev half, then score a sealed test half once. Only the test half's numbers are published as the after. Penthera 1.9.0https://github.com/danoszz/penthera/releases/tag/v1.9.02026-10-23T00:00:00ZWhat changed, in the changelog. eMudhra's broken CA keys show in the public key, and the TLS check now looks for themhttps://github.com/danoszz/penthera/blob/main/docs/research/emudhra-weak-keys-2026-10.md2026-10-22T00:00:00ZEach private key was an integer below 256, so a passive handshake is enough to find it. A match is proof, so the finding is confirmed. GitLab's critical patch: a passive scan cannot read a self-managed GitLab's versionhttps://github.com/danoszz/penthera/blob/main/docs/research/gitlab-version-exposure-2026-10.md2026-10-22T00:00:00ZAsset fingerprinting is ruled out. The note proposes a rule that reads the version from the repository instead; no rule shipped. PHP's 21 Oct flaws: Penthera checks the version a site shows, and says when it cannot tellhttps://github.com/danoszz/penthera/blob/main/docs/research/case-study-php-2026-10.md2026-10-21T00:00:00ZReleased in 1.8.0. A hidden version is never reported as safe, and the fixed versions match the ones in OpenAI's own checker. E1: Penthera's accuracy on real codehttps://github.com/danoszz/penthera/blob/main/docs/research/prereg/E1-real-world-accuracy.md2026-10-20T00:00:00ZHow accurate is Penthera's static analysis on real web apps and agent setups its authors did not write? Precision and recall per category, each with a 95% interval. 2026 agent incidents: six gaps for Penthera, from verifier integrity to agent sandboxeshttps://github.com/danoszz/penthera/blob/main/docs/research/agent-incidents-2026.md2026-10-20T00:00:00ZAgents under evaluation reached real systems they were never meant to touch. Each lesson ends in an action, and the draft study E8 tests one of them.