Observed arrival · 2026-10-24
Bastion checks the PHP build behind the version string
An open-source, local PHP assessment tool for inventorying server builds, checking patch status, and looking for intrusion traces.
- For
- PHP server administrators and incident responders
- Worth noticing
- The sample distinguishes “vulnerable,” “likely,” and “fixed” instances and gives container rebuild guidance plus interim mitigations.
Field notes
The page lays out a four-step verdict path: read the PHP binary without executing it, compare upstream release and vendor-backport evidence, inspect package changelogs, then match a fix fingerprint. Its sample report separates vulnerable, likely, and fixed instances across CLI, FPM, CGI, containers, and system packages, with rebuild guidance and interim mitigations. The site labels the assessment read-only and says it makes no network calls; the displayed version is v0.1.0-dev.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue