Install and update

Install from a package

Each release ships three files, all named psf-security-patches and versioned by release date, YY.MM.DD-X.Y.Z (for example 26.11.04-1.0.0). Download them from the releases page on Codeberg or GitHub.

Check the files against the release's SHA256SUMS-<version>.txt before installing, then:

sha256sum -c SHA256SUMS-26.11.04-1.0.0.txt
sudo apt install ./psf-security-patches_26.11.04-1.0.0_all.deb       # Debian family
sudo dnf install ./psf-security-patches-26.11.04-1.0.0.noarch.rpm    # RPM family
/opt/psf-security-patches/php/php2shell-mitigate.sh check             # read only

Each file also has a detached GPG signature, FILE.asc. Import the release key from the release page and confirm its fingerprint reads 4BAD A1D9 A399 352C D651 B1D7 4D36 5028 B8E5 6739 before you trust a signature.

Where things go

• /opt/psf-security-patches/ holds the whole tree: each tool in its own folder (php/, nginx/, curl/ and so on) with its README, plus the governance documents and a VERSION file. Run the scripts from there.
• /opt/psf-security-patches/rhsa/rhsa.py is the Red Hat advisory checker, with its data and its README. On a Red Hat family host, /opt/psf-security-patches/rhsa/rhsa.py verify --rpm checks every installed package against Red Hat's published fixes, and man psf-rhsa documents it. It is a Python 3 program; the index of what it knows is REDHAT-ADVISORIES.md.
• /usr/lib/systemd/system/php2shell-watch.service is the live watcher's unit, pointed at the /opt path. It is installed but not enabled; see Watching live.
• Manual pages and an info manual: man psf-security-patches is the overview, and every tool has its own page named after its script, such as man psf-haproxy-check. info psf-security-patches has the same material as one manual. The pages are built from each script's own --help text when a release is built, so they always match the tool.
• Documentation website: it is online at privacysafe.app/docs/security-patches, and the packages install an offline copy: open /usr/share/doc/psf-security-patches/html/index.html in a browser (on RPM systems the folder is psf-security-patches-<version>). It starts with the newest vulnerabilities, groups the tools by kind of software, has a CVE index, a page on how the tools work, a glossary, one page per tool and per manual page, and a search that works offline. The offline copy loads nothing from other sites. It is built from the READMEs in this repository, so the READMEs are the documentation.
• License files: LICENSE and NOTICE come with the package (/usr/share/doc/psf-security-patches/ on Debian, /usr/share/licenses/ on RPM systems), and the .deb carries a copyright file. Everything is CC0 1.0 Universal.

Installing runs nothing: there are no install or removal scripts. The only dependencies are bash 4.0 or newer and coreutils. The Red Hat advisory checker also needs Python 3.8 or newer, which the packages recommend and do not require, so every other tool installs and runs without it.

Upgrading and removing

Install a newer release the same way and it replaces the old one in place. Releases before 26.10.30 were named psf-security-packages. The new package replaces them, so with apt or dnf there is nothing to uninstall first. To remove the tools:

sudo apt remove psf-security-patches     # Debian family
sudo dnf remove psf-security-patches     # RPM family

Removing the package deletes only the files it installed. It does not undo what a tool did to your system when you ran it, such as an ini drop-in, an AppArmor profile or a distrusted certificate. Use each tool's own cleanup, remove or restore command, described in its README, before you remove the package.

Each tool still targets the systems named in its own README: for example the PHP2Shell AppArmor mitigation is for Debian-family systems, and the cPanel variant is for EasyApache 4. See packaging/ for how releases are built and verified.

Root and sudo. Commands that change a machine (mitigate, rollback and the tool-specific ones) need root. Run them from a named admin account with sudo, for example sudo ./haproxy-check.sh mitigate, not from a root login: sudo records who made the change. A tool that is started without root says so and prints the exact sudo command to run, and a tool started from the root account while sudo is available prints a one-line note and carries on (PSF_NO_ROOT_NOTE=1 hides it). A hunt run without root sees only what that account can read, and says so instead of calling the result clean. The Claude Code extension tool's update, clean and keys work per user: run them as the account that uses the editor, not with sudo.

Updates

See the changelog for new tools and changes, newest first.

Important notice

These scripts are used on our production systems and undergo testing, but they may require adaptation for other environments. Review the source code before running any script, test changes in a non-production environment where possible, and maintain current backups. This software is provided without warranty.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.