Changelog

One-line summary of every website update. Newest first — we ship small improvements often.

2026-07-24 NEW New tool: Actionable CVEs Dashboard (/tools/actionable-cves.php). The morning-triage bowl — the CVEs newly added to the CISA KEV catalog (someone is exploiting these right now), enriched with FIRST EPSS scores, alongside the highest exploit-probability CVEs today. Ransomware-linked entries and overdue fix dates are flagged; filter by keyword, ransomware-only, or a 7 / 30 / 90-day window; export CSV or JSON. The page sends nothing upstream: it serves one pre-computed feed refreshed server-side from KEV + EPSS at most every few hours via SSRF-guarded fetches, your IP is never forwarded, and all filtering runs in your browser.
2026-07-24 NEW Three new tools for email & domain security. DMARC Report Analyzer (/tools/dmarc-report-analyzer.php) turns the daily DMARC aggregate (RUA) XML your mailbox receives into a readable pass/fail-by-source view, flagging mail sent as your domain that failed both aligned SPF and DKIM — spoofing, or a legitimate sender you haven't authorized yet. 100% client-side; <code>.gz</code> reports are inflated in the browser, nothing is uploaded. Domain Security Posture Scanner (/tools/security-posture-scanner.php) grades one domain from A+ to F across security.txt, DMARC, SPF, MTA-STS, CAA, DNSSEC and HSTS in a single report. Subdomain Takeover Checker (/tools/subdomain-takeover-checker.php) finds dangling CNAMEs an attacker could claim, matching 20+ takeover-prone services and confirming with each service's unclaimed-page fingerprint. The latter two run their DNS and HTTP checks server-side through SSRF-guarded fetches; your IP is never forwarded.
2026-07-24 NEW New: a free, no-signup Developer API (/api/) for the everyday pure-logic transforms, so you can wire CyberRamen into playbooks, Slack bots and CI without opening the browser. Curl-able JSON endpoints under <code>/api/tools/</code>: defang / refang, hash identification, CIDR math, timestamp conversion, IOC extraction, and CVSS v3.1 scoring. No auth, CORS-enabled, rate-limited, CC BY 4.0 — pure logic only, so nothing is stored or forwarded. Docs with copy-paste <code>curl</code> examples at /api/.
2026-07-24 SITE Two ways to keep up and find things faster. Subscribe to our own feed — new tools and updates now publish as Atom (/feed.xml) and JSON Feed (/feed.json), auto-discovered by your reader, no email required. And a new site-wide search: a visible box on the homepage plus a dedicated /search page that works without JavaScript, is shareable and crawlable, and searches every tool by name, tag, or the job you're trying to do.
2026-07-24 SITE Send an artifact straight to the next tool. Many tools now show a “Send →” button in the “Still hungry? Try next” strip — look up a domain in DNS Record Lookup and carry it into WHOIS, DNS Mapper or the new Posture Scanner in one click (a single-shot, in-browser handoff: values only, never stored). Also new: every tool page now carries a small trust badge beside its title — “100% client-side” or “server-assisted” (your IP is never forwarded) — driven by the same manifest flag as the footer note, so the privacy story now reads consistently on every page.
2026-07-18 NEW New tool: Filigrane — Document Watermark (/tools/filigrane.php). Stamp a repeated, semi-transparent diagonal watermark across an ID card, payslip, bank statement, or PDF before sending it to a landlord, recruiter, or insurer — a deterrent against identity theft and a way to attribute a leaked copy. Accepts JPG / PNG / WEBP and PDF, single or batch, with grouped preset templates (identity, housing, employment, banking, insurance, admin), a live preview, adjustable opacity / angle / density / colour, an "always export as PDF" toggle, and download-all-as-zip. Auto tokens <code>[DATE_AUTO]</code> / <code>[TIME_AUTO]</code> resolve to the real send date at export. 100% client-side: the file is decoded in a <code><canvas></code> and downloaded back — no upload endpoint, no server storage, and the strict CSP (<code>connect-src 'self'</code>) makes phoning a file home technically impossible. No cookies, no localStorage, no analytics on the page, and a one-click Panic Clear. PDF.js is vendored locally (no CDN), version-pinned and SRI-checked. Concept inspired by the French government's Filigrane Facile (filigrane.beta.gouv.fr / DossierFacile).
2026-06-27 SITE Third security pass: completed the CSP nonce migration so external script tags load correctly under the strict policy, added rate-limiting to the remaining server-side tools, hardened a couple of feed parsers and one regex shape, and shipped a small PHP unit-test runner. The service worker no longer caches HTML pages. Pure-code — no user-facing tool behaviour changes.
2026-06-27 SITE Second security hardening pass: nonce-based Content Security Policy (no <code>unsafe-inline</code> for scripts), additional protections on server-side fetches, response-size caps on upstream data feeds, and removal of unused code paths. Pure-code — no user-facing tool behaviour changes.
2026-06-27 SITE Site-wide security hardening sweep: SSRF protections on all server-side fetches, IP-based rate limiting across the tool APIs, stricter Origin and CSRF checks on the anonymous benchmark submission, and CSPRNG-based UUIDs in the detection-rule builders. No user-facing tool behaviour changes.
2026-06-20 NEW New interactive section on Reporting Fraud in Luxembourg (/awareness/reporting-fraud-luxembourg/#templates): four downloadable + copy-to-clipboard complaint-letter templates that generate both French and English versions side-by-side from the same form. Templates: (1) Plainte for the Police Grand-Ducale, (2) bank dispute / reimbursement request, (3) incident summary sheet (with auto-generated next-steps by incident type), (4) CNPD / GDPR complaint (Article 77). Live preview, FR/EN toggle, print-as-PDF, per-template clear button. All data stays in <code>localStorage</code> under <code>cr_fraud_templates</code> — nothing is transmitted. Also new: International Reporting Map (/awareness/reporting-fraud-international/) — country dropdown covering 30+ countries (every EU/EEA member plus UK, US, Canada, Australia, Switzerland, Norway) with verified links to the local cybercrime portal, consumer-fraud authority, and GDPR / data-protection regulator, plus cross-border resources (ECC-Net, Europol, OLAF, Interpol, EDPB). Last-selected country saved in <code>cr_fraud_country</code>. Both pages cross-link; the LU page gets a "Not in Luxembourg?" banner at the top.
2026-06-20 CONTENT 10 new awareness pages, all consumer-facing and Luxembourg / EU-aware. The conversion engine: I've Been Hit (/awareness/ive-been-hit/) — calm, situation-by-situation recovery with the local reporting map. The LU / EU trio: Reporting Fraud in Luxembourg (decision tree across bank / plainte / SPAMBEE / CIRCL / CNPD / BEE SECURE / CSSF / cyberfraud.lu), EU Scam Patterns (fake SEPA refunds, fake CSSF / bank messages, parcel customs fees, cross-border crypto "advisors"), and Your GDPR Rights (the practical version — which article, what to write, escalating to the CNPD). New flagship monthly series: Scam of the Month (/awareness/scam-of-the-month/) opening with a preview teardown of the fake-CSSF / LuxTrust-tap pattern. Plus four standalone explainers — Quishing, Email Account Compromise, SIM Swapping, and Digital Legacy. All ten pages share one new stylesheet (<code>/awareness/assets/article.css</code>), a 🇱🇺 In Luxembourg callout component, and a soft non-salesy bridge to johlem.net at the bottom. Cards are now linked from the Security Awareness Hub.
2026-06-20 FIX WHOIS Lookup (/tools/whois-lookup.php) — the domain status badges ("clientTransferProhibited" etc.) were rendering in a near-invisible bright yellow (<code>#fc0</code>) on a faint yellow tint that washed out completely on the cream background. The "active" badge was also using the brand red instead of green. Both now use the theme tokens — <code>--color-warning</code> orange for locked/prohibited badges and <code>--color-success</code> green for active — with a matching border, bumped to weight 600 for legibility. Same fix applied to the DNSSEC "signed" indicator.
2026-06-20 IMPROVE Nmap XML Report Parser (/tools/nmap-xml-parser.php) — added a "Load sample" button next to Parse / Clear. One click fills the textarea with a realistic fake <code>-sV -sC -O</code> scan (a small <code>10.0.5.0/24</code> with a Linux web/db box, a Windows Server 2019 domain controller, a Raspberry Pi, and one host down) so new visitors can see what the host cards, severity hints, NSE script blocks and Markdown / CSV exports look like without running nmap themselves. Sample XML is embedded in the page; nothing fetched or uploaded.
2026-06-20 SITE Site-wide status colour audit. Swept every tool and GRC page for places where success / warning / error states used the wrong colour — most often the brand red <code>--color-accent</code> being reused as a generic "highlight" for success states, or hardcoded muted hex values (<code>#1e6b30</code>, <code>#9c2a1e</code>, <code>#9a5b13</code>, plus stray Bootstrap / Tailwind palettes like <code>#dc3545</code> / <code>#28a745</code> / <code>#ef4444</code>) drifting away from the theme. Roughly 45 files now use the canonical tokens <code>--color-success</code> (#2e7d32), <code>--color-error</code> (#b71c1c) and <code>--color-warning</code> (#e65100). Notable fixes: Port Lookup security badges, UUID Validator, Config Validator, Rewrite Tester, Password Generator (the "Strong" label was rendering red), HTTP Status Codes (2xx success now green, 5xx server error now red), Phishing Checker HTML report. Tools / GRC pages that used a deliberate 4+ tier severity scale (CVSS calculators, incident timeline, NIST CSF function colours) were left alone — those are scales, not binary status indicators.
2026-06-20 IMPROVE SSL Certificate Checker (/tools/ssl-checker.php) — fixed the trust-status colour coding. The "Excellent / Highly Trusted" label, the score number itself, and the &check; positive indicators ("Domain matches certificate", "Issued by trusted CA", "Strong key (2048 bits)", "Extended Validation") were all rendering in the brand red because the CSS reused <code>--color-accent</code> for the success state. They now use the existing theme tokens <code>--color-success</code> (green) and <code>--color-error</code> (red) consistently across the trust card, score circle, quick-info border, certificate details, SAN match badges, and the downloadable Text / HTML reports.
2026-06-20 FIX CIDR Calculator (/tools/cidr-calculator.php) — fixed three bugs in Range → CIDR mode that produced wrong results (and could hang the page) for any range with the high bit set, i.e. any IP ≥ 128.0.0.0. Signed-vs-unsigned 32-bit arithmetic was breaking the aligned-block search, the shrink loop, and the next-start advance. Verified with a 100-assertion offline test suite covering all three modes, /0 – /32 prefixes, classful boundaries, RFC 3021 /31 handling, private/loopback detection, and range coverage round-trips.
2026-06-20 IMPROVE CIDR Calculator (/tools/cidr-calculator.php) — added an "Export to .txt" button on the results panel. Downloads a plain-text report of the calculated network, address details, range, dotted-binary representation, and quick reference. Filename pattern: <code>cidr-<network>_<prefix>.txt</code>. 100% client-side — nothing is sent to the server.
2026-06-19 NEW New workflow: Phishing Investigation (/tools/workflows/phishing-triage.php). The first end-to-end chained recipe on the site — Phishing Checker → Email Header Analyzer → IOC Defanger → IOC Pivoting wired together around a shared in-memory case context. Each step still links out to its standalone tool (graceful degradation). The case is in-memory by default; an explicit toggle opts in to localStorage. Final export is CSV or STIX 2.1, mirroring the IOC Pivoting bundle shape. "Send to IOC Defanger" demonstrates a true handoff: the next tool pre-fills its input from the case via single-shot sessionStorage.
2026-06-19 SITE Discovery upgrade — phase 4. New homepage "Back to your bowl" / 最近 row remembers the last 8 tools you opened so you can jump straight back. Stored locally in your browser — tool NAMES ONLY, never inputs, never results. The same recents list seeds the Ctrl-K palette's empty state. One-click clear; opt-out toggle planned for the privacy page.
2026-06-19 SITE Discovery upgrade — phase 3. Press Ctrl-K / Cmd-K anywhere on the site to open a centred command palette that fuzzy-searches every tool by title, blurb, and tag (keyboard-navigable, focus-trapped, no dependencies). The /tools/ listing gets a faceted chip bar (client-side only, exports CSV / STIX, intent tags) with AND logic, live count, and shareable URL state. New homepage block "What's on your plate?" / 注文 lets you find tools by the artifact in hand — type a description or tap a chip (URL / Email / IP / Domain / Hash / CVE / Log / Cert) and the manifest answers with the matching tools. Editorial / graph-driven, no analytics.
2026-06-19 SITE Discovery upgrade — phase 2. Every tool page now ends with a "Still hungry? Try next" / 次の一杯 strip of 1–3 complementary tools. Curated picks come first (each tool entry in the manifest lists hand-chosen `related` slugs), then a produces→consumes graph fallback fills any remaining slots — so a tool that produces a domain naturally suggests tools that consume a domain. No tracking; no "most used"; purely editorial / graph-driven.
2026-06-19 SITE Discovery upgrade — phase 1. Site-wide tool manifest (/assets/data/tools.json, 126 tools, each with consumes / produces / related / jobs metadata) now powers a new homepage "New on the menu" / 新着 strip showing the 4 most recently added tools, plus per-tool privacy badges (◖ 100% client-side / ◗ server-assisted) on the /tools/ listing. Editorial only — no analytics, no tracking, no usage telemetry.
2026-06-11 NEW New tool: PGP / GPG Key Lookup (/tools/pgp-key-lookup.php). Find a public OpenPGP key by email, fingerprint, or 16-hex long key ID. keys.openpgp.org is the primary source (verified-email keyserver) with keyserver.ubuntu.com as automatic fallback — both are proxied server-side so the client IP is never forwarded upstream. The browser parses the returned key locally and lists every user ID with name, email and comment broken out separately, all aliases, every subkey with capabilities, plus a chronological timeline of creation, self-signatures, expiration and revocations.
2026-06-11 NEW 18 new tools added to the Tools Hub (107 → 125). Spicy Specials: Windows Event ID Lookup, Sysmon Config Builder, Log Parser Pattern Builder. Bento Box: EPSS Score Lookup, SSVC Decision Tree, DORA Register of Information Builder, NIS2 Self-Assessment, BIA / RTO-RPO Calculator, ISO 27001:2022 SoA Builder. Ramen Bowls: Email Auth (SPF/DKIM/DMARC) Record Builder. Pentester Platter: LOLBin / GTFOBins Browser, Reverse Shell Generator, Hashcat / John Rule & Mask Builder. Crypto Gyoza: CSR Generator & Decoder, HMAC Generator, SRI Hash Generator. Side Dishes: Cookie Security Analyzer. Robo Ramen: NIST AI RMF Checker. All client-side except EPSS Lookup (FIRST EPSS proxied, IP not forwarded) and SRI Generator URL mode.
2026-06-10 IMPROVE RSS feeds (/tools/cve-feeds.php) — added nine new feeds across a new CERT & Government category and the Threat Intel / Vulnerabilities sections. New: CERT-EU Security Advisories, CERT-EU Threat Intelligence, NCSC UK All Feeds, CERT.be Belgium, CERT Polska, NCSC-FI Daily Vulnerability Digest, CIS MS-ISAC Advisories, Palo Alto Unit 42, ZDI Upcoming Advisories, Full Disclosure (seclists.org). Removed Threatpost — publication shuttered by Kaspersky in September 2022. 37 active feeds total.
2026-06-10 SITE GRC Hub v2 — major release. Seven new modules join the hub: DORA Engine, Cross-framework Crosswalk, Risk Register, Evidence Request List generator, Policy Templates library, Board Reporting Pack and Anonymous CSF Benchmarking. New trust layer at /grc/methodology/ documents how every dataset was built; read-only JSON API at /api/v1/ exposes the data under CC BY 4.0; /llms.txt added for AI crawlers. All vanilla, no CDN, no tracking.
2026-06-10 NEW New tool: DORA Engine (/grc/dora-engine/). Five tabs covering Regulation (EU) 2022/2554: applicability and proportionality (Art. 2 / 4 / 16), Level 1 + RTS 2024/1774 self-assessment (49 items), Register of Information generator following the ESA ITS template (Implementing Reg (EU) 2024/2956) with LEI checksum and cross-table integrity, TLPT applicability, and major-incident classification helper with Art. 19/20 reporting-clock countdown per Delegated Reg 2024/1772.
2026-06-10 NEW New tool: Cross-framework Control Crosswalk (/grc/crosswalk/). 623 edges connecting NIST CSF 2.0, SP 800-53 r5 Moderate, ISO 27001:2022 Annex A, DORA L1 + RTS 2024/1774, NIS2 Art. 21 + Implementing Reg 2024/2690, GDPR security obligations and CRA Annex I. Pivot, framework-pair and "implement once / comply many" coverage views with documented exact / strong / partial / related weights.
2026-06-10 NEW New tool: Risk Register (/grc/risk-register/). ISO/IEC 27005-aligned, client-side, multi-engagement. 5×5 inherent vs. residual heatmaps with toggle, ENISA-derived threat catalogue, optional FAIR-lite triangular Monte Carlo (10 000 iterations in a Web Worker), CSV import with column-mapping wizard, Excel/CSV/Markdown/PDF exports.
2026-06-10 NEW New tool: Evidence Request List Generator (/grc/evidence/). Pick the frameworks in scope (NIS2, DORA, GDPR, ISO 27001, CRA, NIST) and get a deduplicated ERL — artifacts shared across frameworks appear once with all references listed. Excel export ships with tracker columns (Status, Date received, Reviewer, Notes). Client-facing Markdown / PDF cover letter included.
2026-06-10 NEW New tool: Policy Templates Library (/grc/policy-templates/). 12 SME-sized policy templates (Information Security, Incident Response, BCP/DR, Access Control, Cryptography, Third-Party Risk with the DORA Art. 30 clause checklist, Vulnerability & Patch, Logging & Monitoring, Acceptable Use, Backup, Awareness, Data Protection). YAML front-matter and per-clause trace IDs link directly into the Crosswalk. Customise-in-browser, Markdown / Word-friendly HTML / Excel traceability matrix exports.
2026-06-10 NEW New tool: Board Reporting Pack Generator (/grc/board-pack/). One click from your saved GRC state (CSF assessment, DORA Engine, Risk Register, Regulatory Calendar) to a board-ready PDF. Executive summary auto-drafted with computed values then editable. Maturity radar, top-10 residual risks, regulatory exposure, upcoming deadlines, methodology appendix. Snapshot feature compares maturity over time.
2026-06-10 NEW New tool: Anonymous CSF Benchmarking (/grc/benchmark/). Compare your CSF 2.0 maturity to anonymous aggregates by sector (NACE top-level), size band and region. Opt-in only — the literal JSON payload is shown to you before sending; nothing else leaves. Aggregates only render when n ≥ 20 (k-anonymity), falling back to parent slices otherwise. No IP, user-agent or sub-month timestamps stored.
2026-06-10 NEW New tool: NIST CSF 2.0 Self-Assessment moved to its own URL (/grc/csf-assessment/). Rate all 22 CSF 2.0 Categories on a 0–4 maturity scale (T0–T4), radar chart, function means, gap report. Scores live in your browser and feed the Board Pack and Benchmark modules. The previous /tools/compliance-db.php#assess panel keeps a notice pointing here.
2026-06-10 FIX Regulatory Calendar (/grc/regulatory-calendar/) — fixed the "No events match your filters" empty-table bug. The full table is now server-side rendered so it is visible without JavaScript, the default view automatically falls back to "All" when "Upcoming" is empty, and a live counter shows visible vs. total events.
2026-06-10 IMPROVE Regulatory Calendar adds ICS calendar export (single event and full calendar — opens in Thunderbird, Outlook, Proton Calendar), JSON export alongside CSV, and a fresher dataset schema (id, date precision, jurisdiction, source label, confidence). Seed data covers DORA, NIS2, GDPR, CRA and ENISA milestones with EUR-Lex source links.
2026-05-25 NEW New tool: AI/ML Threat Model Builder. 5-step wizard maps your system architecture (model type, data, capabilities, access, controls) to a curated catalog of 27+ threats. Cross-references STRIDE, MITRE ATLAS, and OWASP LLM Top 10 with calibrated risk levels and recommended control gaps. Markdown and JSON export.
2026-05-25 NEW New tool: Prompt Injection Playground. Practice 8 prompt-injection scenarios (direct override, persona substitution, RAG exfiltration, indirect via fetched page, payload smuggling, DAN-style jailbreak, blind extraction, multi-turn bypass) against a deterministic JS engine. No API, no telemetry. Progress saved locally.
2026-05-25 NEW New tool: LLM Red Teaming Checklist. 60 items across 6 phases (recon, prompt injection, output handling, excessive agency, data exposure, DoS) for practitioners running real LLM application assessments. Per-item status + notes, auto-save, Markdown engagement report.
2026-05-25 NEW New tool: OWASP LLM Top 10 Checker. Self-assessment across all ten OWASP Top 10 for LLM Applications risks (v1.1 2024/2025): prompt injection, sensitive information disclosure, supply chain, data poisoning, insecure output, excessive agency, system-prompt leakage, vector/embedding weaknesses, misinformation, unbounded consumption. Gap report with CSV / JSON / Markdown export.
2026-05-25 NEW New tool: CVSS v4.0 Calculator. Official FIRST scoring algorithm (lookup table + max-severity port) with Base, Threat, Environmental, and Supplemental metric groups. Real-time scoring, score-type detection (CVSS-B / BT / BE / BTE), vector string parsing, and URL parameter sharing. Sits alongside the existing CVSS v3.1 calculator.
2026-05-25 IMPROVE MITRE ATLAS Search now includes a Report Builder: add techniques as you browse, view your selection, and export a Markdown report covering all selected techniques with description, detection, mitigation, and atlas.mitre.org links. Selection persists in localStorage.
2026-05-08 NEW New tool: Interactive Google Dork Builder. Compose advanced search-engine queries with operators (site:, filetype:, inurl:, intitle:, intext:, ...), live preview, one-click Copy, and Launch buttons for Google / DuckDuckGo / Bing / Yandex / GitHub. Includes a preset gallery for OSINT and bug bounty.
2026-05-08 IMPROVE Phishing Checker now shows a transparent point-by-point score breakdown for every URL pattern check (which fired, which did not, and how many points each contributed). Added a stronger disclaimer: heuristic only, no antivirus/malware scan, no threat-intelligence/blocklist lookup, valid SSL is not evidence of legitimacy.
2026-05-08 NEW New tool: NIST CSF 2.0 Profile Builder. Score all 106 subcategories Current vs Target on a 0-4 scale, see gap analysis by Function and Category, export JSON / CSV / Markdown. Based on NIST CSWP 29.
2026-05-08 NEW New tool: NIST CSF 2.0 Tier Self-Assessment. Pick your Implementation Tier (Partial / Risk Informed / Repeatable / Adaptive) across the Risk Governance and Risk Management dimensions from CSWP 29 §2.4.
2026-05-08 IMPROVE Control Mapper now includes a Subcategory Browser tab covering all 106 NIST CSF 2.0 subcategories with full descriptions and inline ISO 27001 / DORA cross-walk chips.
2026-05-08 IMPROVE Added unified Copy / JSON / CSV / TSV / Markdown / Text export bar across IP Info, DNS Record Lookup, WHOIS, JWT Decoder, Email Header Analyzer, Regex Tester, Timestamp Converter, and CVE Feeds.
2026-05-08 FIX DNS Record Lookup CSV export now follows RFC 4180 (proper quoting & escaping for record names containing commas or quotes).
2026-05-08 SITE Launched this changelog page so visitors can track ongoing improvements at a glance.

Got a suggestion or spotted something broken? Email hello@cyberramen.com — we read every message.