Techhack — Developing the Future — Blog http://localhost:3000/blog Techhack builds and maintains its own software products, from security tooling to consumer apps. en VulnScan AI v0.4.10 http://localhost:3000/blog/vulnscan-ai-v0-4-10 http://localhost:3000/blog/vulnscan-ai-v0-4-10 Sun, 26 Jul 2026 16:46:22 GMT The interactive menu's "Network scan" entry (option 3) silently returned to the menu when networktargets wasn't configured yet. It printed an explanatory hint but never paused before the next screen redraw, so on curses terminals the hint was wiped before it could be read. Fix

  • The interactive menu's "Network scan" entry (option 3) silently returned to the menu when network_targets wasn't configured yet. It printed an explanatory hint but never paused before the next screen redraw, so on curses terminals the hint was wiped before it could be read.

Docs

  • The menu command reference was missing compliance, network and audit from its list of covered commands.

  • The website's command table gained a dedicated row for scan --scanner network (it previously only appeared as a scanner chip, unlike every other first-class command).

331 tests, bandit clean.

View this release on GitHub

]]> VulnScan AI v0.4.9 http://localhost:3000/blog/vulnscan-ai-v0-4-9 http://localhost:3000/blog/vulnscan-ai-v0-4-9 Fri, 24 Jul 2026 16:38:51 GMT Recommends: weak dependencies (like nmap for the network scanner) only info offers to install nmap for the network scanner

Recommends: weak dependencies (like nmap for the network scanner) only
auto-install on a fresh dnf install — an upgrade of an already-installed
vulnscan-ai does not retroactively pull in a newly added weak dependency.

vulnscan-ai info now explains exactly why the network scanner is
unavailable (missing network_targets config, missing nmap, or both)
instead of just printing "unavailable", and when nmap is the only thing
missing it offers to install it right there via dnf install -y nmap
(interactively, TTY only) or prints the command to run yourself otherwise.

328 tests, bandit clean.

View this release on GitHub

]]> VulnScan AI v0.4.8 http://localhost:3000/blog/vulnscan-ai-v0-4-8 http://localhost:3000/blog/vulnscan-ai-v0-4-8 Fri, 24 Jul 2026 16:38:42 GMT New network scanner: Network exposure scanner (10th scanner)

New network scanner: the first scanner that inspects hosts OTHER than the
one it runs on. Shells out to nmap -sV for host discovery, a scoped port
scan and service/version detection, then flags the same plaintext/legacy-
protocol and sensitive-service exposures as the ports scanner (shared risk
taxonomy, extracted into net_classify.py) — the same risk model, observed
remotely instead of via local ss. No CVE/CPE matching on detected service
versions yet (parked for a later phase).

Safety: gated on an explicit, config-only network_targets allow-list
(hosts/CIDRs you are authorized to test) — never a CLI flag, no env
override. The scanner stays genuinely unavailable until configured, and
prints an authorization reminder on every real invocation. Findings for a
target-bearing host are detection-only: remediation.py hard-refuses to
propose or execute commands against them, since a fix for a remote host
cannot run on this one.

New "Network scan" menu entry. Optional Recommends: nmap (degrades
gracefully if absent). 323 tests, bandit clean.

Install: see https://repo.techhack.nl

View this release on GitHub

]]> Chameleon-PQ v0.8.5 UPDATE http://localhost:3000/blog/chameleon-pq-v0-8-5 http://localhost:3000/blog/chameleon-pq-v0-8-5 Wed, 22 Jul 2026 18:20:26 GMT Rekey traffic now rides the outbound pacer under a traffic-shaping profile instead of bypassing it Rekey traffic now rides the outbound pacer under a traffic-shaping
profile instead of bypassing it (see 664115f): no more out-of-schedule
burst, and the tick loop no longer stalls (silencing the cover stream)
while a rekey is in flight.

Full Changelog: https://github.com/btdt1983/chameleon-pq/compare/v0.8.4...v0.8.5

View this release on GitHub

]]> abyss-top v1.1.0 http://localhost:3000/blog/abyss-top-v1-1-0 http://localhost:3000/blog/abyss-top-v1-1-0 Tue, 21 Jul 2026 15:05:02 GMT Guest table gains three additions, all pure /proc + /sys with no new dependencies: Guest table gains three additions, all pure /proc + /sys with no new
dependencies:

- STATE column: the QEMU process state (from /proc/<pid>/stat via sysinfo)
reduced to up / io / stop / dead, so a hung, SIGSTOP'd or defunct guest
stands out. This is the OS process state, not the libvirt domain state,
so a libvirt-"paused" guest still reads "up".
- UPTIME column: process run time, formatted compactly (e.g. 4d2h, 18h30m).
- TOTAL row: sums CPU / memory / disk / net across all guests.

Full Changelog: https://github.com/btdt1983/abyss-top/commits/v1.1.0

View this release on GitHub

]]> Chameleon-PQ v0.8.4 http://localhost:3000/blog/chameleon-pq-v0-8-4 http://localhost:3000/blog/chameleon-pq-v0-8-4 Mon, 20 Jul 2026 19:38:43 GMT fix(tunnel): restore small-batch inline fast path (regression fix) What's Changed

  • fix(tunnel): restore small-batch inline fast path (regression fix)

  • fix(tunnel): fix outbound seal ordering race (correctness bug)

  • fix(tunnel): raise INLINE_THRESHOLD to the proven 128 value

  • refactor(engine): reserve-then-parallel-seal crypto pipeline, wireguard-go style

Full Changelog: https://github.com/btdt1983/chameleon-pq/compare/v0.8.3...v0.8.4

View this release on GitHub

]]> VulnScan AI v0.4.7 http://localhost:3000/blog/vulnscan-ai-v0-4-7 http://localhost:3000/blog/vulnscan-ai-v0-4-7 Mon, 20 Jul 2026 19:38:03 GMT A adversarial review of the whole codebase; every real defect it surfaced is fixed. No user-facing surface change (no new commands, flags, or config keys). 0.4.7 — audit-driven correctness & security hardening

A adversarial review of the whole codebase; every real defect it surfaced is fixed. No user-facing surface change (no new commands, flags, or config keys).

Truthfulness (remediation engine)

  • Auto-rollback now reports honestly. A rollback whose file restore or service revert failed no longer stamps a clean rollback — the CLI and the audit log were reporting "reverted, service left healthy" on a half-reverted host.

  • Empty plans are no longer "applied". A prose-only fix plan (no commands) is no longer reported as applied; the dashboard apply path was writing a false applied audit entry for a no-op.

Security

  • Exported-script heredoc break-out closed. fix --export-script now uses a unique heredoc delimiter, so crafted/hallucinated file content can't terminate the heredoc early and inject commands the operator runs as root.

  • OVAL decompression-bomb guard. The OVAL feed is now decompressed with a size cap (it runs as root during update-oval / auto-refresh) and refuses a DOCTYPE.

Robustness — never abort the scan

  • Malformed CVE-feed JSON (NVD / EPSS / CISA-KEV) can no longer crash a whole scan; enrichment fails per-finding.

  • A package-less oscap advisory is no longer dropped on an empty-but-successful updateinfo set — that was silently hiding real, unpatched advisories.

Lower-severity

Null-tolerant report/dashboard rendering, version-ordered (not install-ordered) kernel-currency check, corrupt-config tolerance, string-aware model-JSON extraction, a capped dashboard request body, and more.

305 tests (+12 regressions), bandit medium+ clean.

Install / upgrade

Existing techhack-repo users: sudo dnf upgrade vulnscan-ai
Fresh install: https://vulnscan-ai.techhack.nl

View this release on GitHub

]]>