Install, run and read the results

Install

One static binary for Linux and macOS, amd64 and arm64. The script picks the build for your platform from the latest release, checks its SHA-256 against SHA256SUMS and, if cosign is installed, verifies the Sigstore signature of that file. It installs to /usr/local/bin (or ~/.local/bin without root) and changes nothing else.

curl -fsSL https://larptard.github.io/bastion/install.sh | sh

Verify by hand

VERSION=v0.1.0
BASE=https://github.com/larptard/bastion/releases/download/$VERSION
curl -fsSLO $BASE/bastion_linux_amd64.tar.gz -O $BASE/SHA256SUMS -O $BASE/SHA256SUMS.sigstore.json
sha256sum --ignore-missing -c SHA256SUMS
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/larptard/bastion/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
gh attestation verify bastion_linux_amd64.tar.gz --repo larptard/bastion   # build provenance

From source

go install github.com/larptard/bastion/cmd/bastion@latest   # Go 1.24+
# or
git clone https://github.com/larptard/bastion && cd bastion && make build

Quick start

sudo bastion scan                       # every PHP build: patched or not
sudo bastion scan --images              # also every local container image
sudo bastion trace                      # signs of compromise in web roots, persistence, logs
sudo bastion report                     # both, as one offline HTML file
php -v | bastion check                  # assess pasted output, no root needed

Run as root for full coverage. Nothing is modified; remediation steps are printed for you to apply.

bastion scan

Finds PHP builds in the standard locations of distributions and hosting panels, in $PATH, in running processes (php-fpm, php-cgi, lsphp, FrankenPHP, Apache with mod_php, including processes still running a replaced binary), in Docker and Podman containers and other mount namespaces, and, on request, in container images. For each build it reads the version and build date from the binary, looks up the owning dpkg, rpm or apk package and its changelog, evaluates every advisory and, for builds that are not fixed, audits the interim mitigation settings in php.ini and PHP-FPM pools.

bastion trace [dir…]

Discovers web roots from nginx, Apache, LiteSpeed and Caddy configuration and the default paths of common panels, plus any directories you pass. It reports webshell signatures, PHP in uploads and images, .user.ini and .htaccess abuse, suspicious cron, systemd and shell start-up entries, /etc/ld.so.preload, extra UID 0 accounts, SSH keys for web users, executables in temp directories, global auto_prepend_file, and log indicators, then builds a timeline. The rule catalogue lists every check.

bastion report

Runs scan and trace and writes bastion-report-<host>-<time>.html: one file with inline styles, icons and data, no external requests, printable. It contains host details, so share it deliberately. Use --scan and --trace to build a report from saved JSON, for example collected from several servers. Sample report.

bastion check

Assesses text instead of the machine: the output of php -v, optionally with dpkg-query -W 'php*', rpm -qa 'php*', apk info -v or /etc/os-release. It uses the same engine as the online check, and recognises Plesk builds from /opt/plesk/php/ paths.

ssh web-01 'php -v; dpkg-query -W "php*"' | bastion check
bastion check --os ubuntu:24.04 'PHP 8.3.6 (cli)'

Output formats and exit codes

sudo bastion scan --json | jq -r '.instances[] | select(.assessments[0].status != "fixed") | "\(.target) \(.path) \(.assessments[0].status)"'
sudo bastion trace --format sarif > trace.sarif

Statuses

Advisory data

Each vulnerability is one JSON document in internal/advisory/data/, validated on load. Add a file and rebuild, or point --db at a directory to add or override advisories at run time. bastion advisories prints what is loaded.

{
  "schema": "bastion.advisory/v1",
  "id": "EXAMPLE-2027",
  "name": "Example",
  "product": "php",
  "published": "2027-01-01",
  "severity": "high",
  "cvss": { "version": "4.0", "score": 8.1, "vector": "CVSS:4.0/…" },
  "aliases": ["CVE-2027-0001"],
  "vulnerabilities": [{ "cve": "CVE-2027-0001", "ghsa": "", "title": { "en": "…" }, "url": "https://…" }],
  "summary": { "en": "…" },
  "branches": [
    { "branch": "8.5", "fixed": "8.5.20", "status": "supported" },
    { "branch": "8.1", "status": "eol" }
  ],
  "older_branches": "affected",
  "newer_branches": "fixed",
  "vendor_fixes": [
    { "distro": "ubuntu", "release": "24.04", "package": "php8.3", "fixed": "8.3.6-0ubuntu0.24.04.20", "format": "dpkg", "advisory": "USN-…", "url": "https://…" },
    { "distro": "rhel", "release": "9", "branch": "8.2", "package": "php", "fixed": "8.2.40-1.module+el9…", "format": "rpm", "advisory": "RHSA-…", "url": "https://…" }
  ],
  "vendor_policies": [{ "distro": "alpine", "source": "Alpine secdb", "checked": "2027-01-02", "url": "https://…" }],
  "build_date_fixes": [{ "environment": "Plesk", "branches": ["8.1"], "fixed_on": "2027-01-01", "source": "…", "url": "https://…" }],
  "changelog_markers": ["CVE-2027-0001"],
  "fingerprints": [],
  "mitigations": [{ "en": "…" }],
  "config_checks": [{ "setting": "memory_limit", "default": "128M", "safe": "-1", "text": { "en": "…" } }],
  "references": [{ "title": "…", "url": "https://…" }]
}

Webshell and obfuscation signatures follow the same approach in internal/trace/rules/content.json.