BastionPHP/Bastion

Bastion is worth a look if you own a PHP host that may be running several PHP builds and you need to know which ones are actually patched against a specific advisory, not just what php -v prints. It is pre-release, with no published binary, and its advisory database is narrow, so treat it as an investigation aid rather than a general scanner.

The problem

A PHP operator who hears about a vulnerability usually runs php -v or checks the package manager, then hopes the version string reflects reality. That fails because distributions backport fixes without changing the upstream version, hosting panels install a second PHP alongside the system one, and a worker process may keep running an old binary that was replaced on disk. Bastion changes that step: it inventories PHP builds across packages, panels, containers and running processes, then evaluates upstream releases, package versions, vendor rebuild dates and patch fingerprints to say whether each one is fixed. The output is a per-build verdict with the evidence behind it, plus an option to trace intrusion indicators and package both into an offline HTML report.

What's different

Its central mechanic is an evidence-first verdict model rather than a yes/no version match. Each build gets fixed, vulnerable, likely-vulnerable or unknown, and the tool deliberately preserves unknown when the available evidence is insufficient instead of turning missing data into a clean bill of health. The same advisory rules run in the CLI and in a browser-based check, and the README says the Go and browser implementations share test vectors; the advisory data and trace signatures are checked into the repository, so the logic is reviewable.

The trade-off is scope and posture. Bastion inspects and reports; it does not patch, restart, remove files or quarantine findings, so you still carry out remediation yourself. It is also explicitly not a general PHP dependency scanner: the bundled database covers PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and the author states that finding a build does not imply vendor fix evidence exists for it. The README also warns that a patched build is not evidence an earlier intrusion did not occur, and a trace with no findings is not proof a host is clean.

Who should try it

Good fit: a sysadmin or incident responder on Linux who has a concrete reason to check PHP2Shell exposure across a host with panels, multiple PHP installs or containers, and who wants JSON/SARIF or an offline sample report to hand off. Poor fit: someone wanting a broad PHP vulnerability scanner, automated patching, or a Windows CLI workflow.

Requirements and limitations

You need Go 1.24+ and Make to build from source on Linux or macOS; there is no published binary yet. Elevated access improves coverage of other users' processes, container filesystems and system logs, though the README says you can start without sudo for files your account can read. Coverage is uneven: Linux has the broadest coverage, while process-namespace and /proc inspection are Linux-specific and macOS builds lack those checks. Discovery support and patch-proof coverage are different things. Reports can also include hostnames, paths and matching snippets.

HotRepo's take

HotRepo first recorded Bastion on 2026-10-24, and on the 2026-10-25 new-repository board (not the overall Trending board) it stood at 57 total stars, #14. That is a snapshot of a two-day-old repository, not a growth measurement, and the stored coverage is insufficient to judge persistence. Before adopting, check the advisory data against the PHP versions on your host.