BastionPHP / Bastion

# Bastion
### Know what is patched. See what was left behind.
Evidence-based PHP security assessment for operators and incident responders.
Website · Online check · Documentation · Sample report
 Recorded CLI output, condensed for readability. Full evidence · Recording details · Reproduce this image 
## Why Bastion exists
`php -v` cannot tell you whether every PHP build on a host is safe. A distribution may backport a fix without changing the upstream version. A hosting panel may carry a second installation. A worker may still be running code that was replaced on disk.
Bastion connects **discovery, patch evidence and intrusion indicators** in one local workflow. It reports the reason behind each assessment and preserves `unknown` when the available evidence is insufficient.
The current bundled advisory database covers **PHP2Shell**, tracked as CVE-2026-109618 and CVE-2026-109619. See the advisory data and its primary sources for the exact coverage. Bastion is not a general-purpose PHP dependency scanner.
## Start here
**Current status: pre-release.** There is no published binary release yet. Build from source on Linux or macOS with Go 1.24 or later and Make:
 [code] 
Choose the workflow you need:
 [code] 
Start without `sudo` if you only need to inspect files your account can read. Elevated access improves coverage of other users' processes, container filesystems and system logs. Use `scan --no-exec` to disable the `php -v` and container-exec fallbacks; image export still uses the container runtime CLI.
For a quick version or package assessment, use the browser-based check. Input is evaluated in the browser; it does not inventory your server. Windows users can use this check without installing the CLI.
## Four commands, one investigation
| Command | What it answers | What you get |
| :--- | :--- | :--- |
| `scan` | Which PHP builds are present, and what proves their patch state? | Paths, versions, package evidence, running processes, mitigation checks |
| `trace` | Are there observable signs of an intrusion? | File signatures, persistence findings, log indicators and a timeline |
| `report` | How can I review or hand off the investigation? | One self-contained HTML file combining scan and trace |
| `check` | What can be inferred from pasted version or package output? | A focused assessment using the same advisory rules |
 More workflows: images, offline filesystems and machine-readable output 
 [code] 
JSON reports use versioned schemas: `bastion.scan/v1` and `bastion.trace/v1`. SARIF output uses version 2.1.0. Exported reports can include hostnames, paths and matching snippets.
## Evidence before verdicts
The engine evaluates upstream releases, distribution package versions, vendor rebuild dates, changelog markers and patch fingerprints. Findings include the evidence that contributed to the decision. The decision engine and architecture guide are available for inspection.
| Verdict | Interpretation |
| :--- | :--- |
| `fixed` | The available evi