1.0.1

Security fix: upgrade if you run 1.0.0 as root

php-security-watch 1.0.0 could let a non-root user gain root. When run as root (the default systemd timer), 1.0.0 executed programs it found on the server to read versions and settings: php / php-fpm builds under /opt/*, /usr/local/php* and similar folders, node under ~/.nvm or other folders, python3, nginx -T, apachectl -S, sendmail, and the config tests run before a restart in fix mode. If one of those files, or any folder above it, belonged to another user or could be written by a group or by every user, that user could replace it and their code would run as root.

What 1.0.1 does

• A found program is run only when its real file (after following symlinks) and every folder above it belong to root (or to the user running the watch) and cannot be written by a group or by every user.
• Otherwise it is not run. The report shows a warning: Did not run <path>: <reason>, so running it as root could run someone else's code., with the exact fix (chown -R root:root ... && chmod -R go-w ..., or install it from the package manager).
• Node.js installed with nvm or n is still checked: its version is read from the folder name (.../versions/node/v20.1.0/bin/node) without running it.
• sendmail that is not safe is not run; the email step fails with a clear message (make it owned by root, or set SMTP_URL).
• In fix mode, a config test program that is not safe is not run, and the service is left running as it was.
• Programs the system runs by name from PATH (package managers, systemctl, journalctl, ss, docker) are unchanged.

Upgrade

curl -fsSL https://github.com/Zoaftware/php-security-watch/archive/refs/tags/v1.0.1.tar.gz | tar xz
cd php-security-watch-1.0.1
sudo ./install.sh

Full list of changes: CHANGELOG.md.

php-security-watch 1.0.0

First public release.

Added

• Eleven nightly checks: os, patches, reboot, php, services, runtimes, libraries,
  wordpress, news, intrusion and sites.
• Every PHP on the server is found (system packages, Ondřej Surý, Remi, cPanel EasyApache, Plesk,
  DirectAdmin, CloudLinux alt-php, /usr/local, Docker containers) and compared with php.net.
• Library advisories for Composer (Packagist) and npm, yarn, pnpm, Python and Ruby lock files (OSV).
• CISA "actively exploited" list matched against the software found on the server.
• Web shell signatures, PHP in upload folders, odd processes, web user crontabs and SSH keys.
• Site checks: every host still answers, TLS expiry, exposed .env, .git, phpinfo(), phpunit.
• Report mode (default) and fix mode: security updates plus tested, opt-in service restarts.
• Alerts by email (sendmail or SMTP) and webhook (Slack, Discord, Telegram, ntfy, JSON), only when
  something changes, plus a weekly digest and reminders for open findings.
• install.sh (systemd timer, cron.d or Alpine crontab) and uninstall.sh (--purge).