CVEfox by GetPageSpeed · free command-line scanner
CVEfox: check your Linux server for known PHP vulnerabilities
CVEfox reads the packages installed on your server and tells you which known vulnerabilities affect them, which fixes you already have, and the exact commands to fix the rest.
- Backport-aware: judges the package release, not the version number
- Signed rules, evaluated locally: your package list never leaves the server
- Fails closed: stale or unverifiable rules never give a clean result
$ cvefox scan
[VULNERABLE] Remi (CentOS 7): php74-php-common 7.4.33-15.el7.remi
Remi stopped building for CentOS 7 in June 2024, so every Remi EL7 build
predates the fix.
Fix: yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum upgrade 'php74-php*'
systemctl restart php74-php-fpm
Details: cvefox explain php2shell:php74-php:rpm
This scan reads installed packages, not running processes. If a PHP process
(php-fpm, httpd, lsphp) started before a fix was installed, restart it.
Checked: PHP2Shell (CVE-2026-109618, CVE-2026-109619).
Rules: revision 4, 39 minutes old, from feed. A clean result covers only
these checks.
Install CVEfox
CVEfox ships as a signed package in the free GetPageSpeed repository, so it updates with the rest of your system. It runs on x86_64 and ARM64.
RHEL, AlmaLinux, Rocky Linux 8 to 10 and Amazon Linux 2023
sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm sudo dnf -y install cvefox
CentOS 7 and Amazon Linux 2
sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm sudo yum -y install cvefox
Ubuntu 20.04 to 26.04 and Debian 12 to 13
sudo install -d -m 0755 /etc/apt/keyrings curl -fsSL https://extras.getpagespeed.com/deb-archive-keyring.gpg \ | sudo tee /etc/apt/keyrings/getpagespeed.gpg >/dev/null . /etc/os-release echo "deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/$ID $VERSION_CODENAME main" \ | sudo tee /etc/apt/sources.list.d/getpagespeed-extras.list sudo apt update && sudo apt install cvefox
Any other Linux: static binary
A single static binary for x86_64 (use cvefox-linux-arm64 on ARM). It needs Linux 3.2 or newer.
curl -fsSLO https://extras.getpagespeed.com/cvefox/releases/0.1.1/cvefox-linux-amd64 curl -fsSLO https://extras.getpagespeed.com/cvefox/releases/0.1.1/SHA256SUMS grep cvefox-linux-amd64 SHA256SUMS | sha256sum -c - sudo install -m 0755 cvefox-linux-amd64 /usr/local/bin/cvefox
Run a scan
cvefox scan
Each finding names the package, its vendor, the verdict and the fix. To see why CVEfox reached a verdict, pass its finding ID to explain:
cvefox explain php2shell:php74-php:rpm
Scan a server that cannot run CVEfox
For CentOS 6, minimal containers or air-gapped hosts, save the package list there and scan it anywhere CVEfox is installed:
rpm -qa > packages.txt # or: dpkg -l > packages.txt cvefox scan --inventory packages.txt
Automate it
| Exit code | Meaning |
|---|---|
0 | Every checked package is fixed |
1 | At least one package is vulnerable |
3 | Unknown, or no relevant package found |
2 | Usage error, or no usable rules |
Add --json for a machine-readable report, --offline to use only the cached rules, and run cvefox rules status to see which rules revision is in use.
What CVEfox checks
Today CVEfox checks for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the unauthenticated remote code execution flaws in PHP 5.4 to 8.5. It knows the fixed builds of every major PHP vendor:
Enterprise Linux
RHEL, AlmaLinux, Rocky Linux and Oracle Linux base and module streams, CentOS 6 and 7, Amazon Linux 2 and 2023.
Hosting stacks
Remi collections, CloudLinux alt-php and ea-php, cPanel EasyApache 4.
Debian family and more
Ubuntu, Debian, Ondřej Surý packages, Alpine Linux, and GetPageSpeed Everpatch builds.
New checks arrive through the same signed rules feed, so installed copies pick them up without an upgrade.
How CVEfox works
Version-only checkers fail on Linux servers because distro vendors backport security fixes without changing the version number. CVEfox instead compares each package's full release against the first fixed build from the vendor that built it, using that vendor's own version ordering: RPM, dpkg or apk.
The rules come from GetPageSpeed advisories, the same records behind our published security advisories. CVEfox downloads them over HTTPS, verifies their Ed25519 signature against keys built into the binary, and caches them. Each report states the rules revision and its age. A bad signature, expired rules or a failed download never turns into an all-clear.
Fixing what CVEfox finds
When your vendor has a fixed build, CVEfox prints its upgrade command. Old platforms often have none: Remi stopped building for CentOS 7 in 2024, and PHP 8.1 and older got no upstream release for PHP2Shell.
For those, GetPageSpeed Everpatch ships patched, drop-in compatible PHP builds for CentOS 6 and 7, EL8, EL9, Amazon Linux 2, Ubuntu and Debian, and CVEfox shows the exact install command. Personal, development and evaluation use is free. Commercial production use requires GetPageSpeed Ultra for up to 10 servers running your own services, or GetPageSpeed Fleet for client servers and larger fleets.
CVEfox FAQ
Is CVEfox free?
Yes. CVEfox and its rules feed are free to install and run on any number of servers, including commercial ones. When a scan finds a vulnerable package, it shows the fix: your vendor's update where one exists, otherwise a GetPageSpeed Everpatch build where we ship one.
Does CVEfox send my package list anywhere?
No. CVEfox downloads a signed rules file from extras.getpagespeed.com and evaluates it on your server. Your package inventory never leaves the machine. With --offline it uses the cached rules and makes no network request at all.
What does CVEfox check today?
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in PHP packages from RHEL, AlmaLinux, Rocky Linux, Oracle Linux, CentOS, Amazon Linux, CloudLinux, cPanel EasyApache, Remi, Ondřej Surý, Ubuntu, Debian, Alpine and GetPageSpeed. More checks will be added to the same signed feed as GetPageSpeed verifies them; existing installs pick them up automatically.
Why not just compare php -v with the fixed version?
Because distro vendors backport fixes without changing the version number. A RHEL, CentOS or Ubuntu build can report PHP 7.4.33 and still carry the fix, or report the same number and lack it. CVEfox compares the full package release against each vendor's first fixed build, with that vendor's own version ordering.
Does a clean result mean my server is secure?
No. A clean result means every package CVEfox checked carries the fix for the issues listed in the scan output, nothing more. It reads installed packages, not running processes, so restart PHP after an upgrade.
What happens if the rules are old or cannot be verified?
CVEfox fails closed. A bad signature, an expired rules file or a failed download never produces a clean result: the scan exits with code 2 and says why. Every report states the rules revision and its age.
Can I scan CentOS 6, containers or air-gapped servers?
Yes, with --inventory. Save the package list on the server that cannot run CVEfox (rpm -qa or dpkg -l), copy it to any machine that has CVEfox, and run cvefox scan --inventory with that file. CentOS 6 needs this route because its kernel is too old for the binary.
Can I use CVEfox in monitoring or CI?
Yes. Exit codes are stable: 0 means every checked package is fixed, 1 means something is vulnerable, 3 means unknown or nothing found, and 2 means a usage error or no usable rules. --json prints a machine-readable report.