PHP Version Audit is a convenience tool to easily check a given PHP version against a regularly updated list of CVE exploits, new releases, and end of life dates.

PHP Version Audit is not: exploit detection/mitigation, vendor-specific version tracking, a replacement for staying informed on PHP releases and security exploits.

Running with docker is the preferred and easiest way to use PHP Version Audit.

Check a specific version of PHP using Docker: docker run --rm -t lightswitch05/php-version-audit:latest --version=7.3.12

Check the host's PHP version using Docker: docker run --rm -t lightswitch05/php-version-audit:latest --version=$(php -r 'echo phpversion();')

Run behind an HTTPS proxy (for use on restricted networks). Requires a volume mount of a directory with your trusted cert (with .crt extension) - see update-ca-certificates for more details. docker run --rm -t -e https_proxy='https://your.proxy.server:port/' --volume /full/path/to/trusted/certs/directory:/usr/local/share/ca-certificates lightswitch05/php-version-audit:latest --version=7.4.1

Not using docker? Not a problem. It is a couple more steps, but it is just as easy to run directly.

Install the package via composer: composer require lightswitch05/php-version-audit:~1.0

Execute the PHP script, checking the run-time version of PHP: ./vendor/bin/php-version-audit

Produce an exit code if any CVEs are found ./vendor/bin/php-version-audit --fail-security

Want to integrate with PHP Version Audit? That's certainly possible. A word caution, this is a very early release. I do not have any plans for breaking changes, but I'm also not committed to keeping the interface as-is if there are new features to implement. Docker/CLI is certainly the preferred method over direct invocation. $phpVersionAudit = new lightswitch05\PhpVersionAudit\Application(phpversion(), false);

$phpVersionAudit->hasVulnerabilities(); #=> true

$phpVersionAudit->getLatestPatchVersion(); #=> '7.3.12'



The data used to drive PHP Version Audit is automatically updated on a regular basis and is hosted on GitHub pages. This is the real meat-and-potatoes of PHP Version Audit, and you can consume it directly for use in other tools. If you choose to do this, please respect the project license by giving proper attribution notices. Also, I ask any implementations to read the lastUpdatedDate and fail if it has become out of date (2+ weeks). This should not happen since it is automatically updated… but we all know how fragile software is.

Get the latest PHP 7.3 release version directly from the rules using curl and jq: curl -s https://www.github.developerdan.com/php-version-audit/rules-v1.json | jq '.latestVersions["7.3"]'