Manual pages
Every script, and the Red Hat advisory checker, has a manual page, installed with the packages. Start with man psf-security-patches for the overview, then man psf-NAME for a tool, or read the whole set with info psf-security-patches. The pages below show the same text each script prints for --help.
| Page | What it covers |
|---|---|
| psf-apt-nov2026-check(8) | APT: a package download can be swapped after APT has verified it |
| psf-basercms-check(8) | baserCMS 5 admin SQL injection, path traversal and deserialization: read-only checker |
| psf-bind-check(8) | ISC BIND 9 GSS-TSIG memory corruption: read-only checker |
| psf-brotli-oct2026-check(8) | Brotli decoder out-of-bounds write, October 2026: read-only checker |
| psf-btcpayserver-nov2026-check(8) | BTCPay Server November 2026: check, recover, preserve, hunt, harden, tor |
| psf-claude-code-vsx-oct2026-check(8) | Claude Code extension SSH backdoor (Cursor marketplace, 29 October 2026): check, hunt, update, keys, clean |
| psf-collabora-code-oct2026-mitigate(8) | Nextcloud Collabora Built-in CODE Server command injection: mitigation |
| psf-couchdb-check(8) | Apache CouchDB admin-to-OS-command execution: read-only checker |
| psf-craftcms-check(8) | Craft CMS Twig create() blocklist bypass: read-only checker |
| psf-curl-oct2026-check(8) | curl HTTP/2 upload use-after-free, October 2026: read-only checker |
| psf-drf-check(8) | Django REST framework October 2026: checker with mitigation |
| psf-drupal-core-check(8) | Drupal core Field UI and Entity List remote code execution: checker with mitigation |
| psf-drupal-webform-check(8) | Drupal Webform remote code execution: read-only checker |
| psf-emudhra-macos-mitigate(8) | eMudhra intermediate CA compromise, macOS mitigation |
| psf-emudhra-mitigate(8) | eMudhra intermediate CA compromise, mitigation |
| psf-expat-check(8) | libexpat billion laughs detection delay: read-only checker |
| psf-ghostaction-oct2026-check(8) | GhostAction stage-2 developer-machine stealer: scan, hunt and contain |
| psf-gitea-check(8) | Gitea SSH certificate principal impersonation: read-only checker |
| psf-gitlab-check(8) | GitLab security releases of October 2026: read-only checker |
| psf-grav-core-check(8) | Grav CMS core allowlist bypass through Flex form overrides: read-only checker |
| psf-grav-login-check(8) | Grav CMS Login plugin invitation privilege escalation: read-only checker |
| psf-haproxy-check(8) | HAProxy truncated HTTP/2 PING frame denial of service: checker |
| psf-incus-check(8) | Incus October 2026 host-compromise flaws: read-only checker |
| psf-jenkins-check(8) | Jenkins plugin security advisory of 16 September 2026 (20 CVEs): read-only checker |
| psf-joomla-check(8) | Joomla core, September 2026 security release (16 issues): checker with mitigation |
| psf-jupyter-check(8) | Jupyter Server and nbconvert October 2026: read-only checker |
| psf-laravel-tokenguard-check(8) | Laravel TokenGuard authentication bypass: read-only checker |
| psf-libheif-oct2026-check(8) | libheif HEIF/AVIF decoder check |
| psf-linux-kernel-check(8) | Linux kernel ebtables SNAT out-of-bounds write: read-only checker |
| psf-linux-kernel-ireq-opt-check(8) | Linux kernel IPv4 TCP use-after-free, remote code execution with MPTCP |
| psf-linux-kernel-lpe-check(8) | Linux kernel local root quartet: checker |
| psf-linux-kernel-module-block(8) | Linux kernel module blocker: list, check, block, status, rollback |
| psf-litellm-escalation-check(8) | LiteLLM proxy admin escalation: read-only checker |
| psf-litellm-oct2026-check(8) | LiteLLM 1.107.0 supply-chain compromise: detect, hunt and contain |
| psf-magento-check(8) | Magento, Adobe Commerce and Mage-OS email-template RCE (BlockStrap): read-only checker |
| psf-nextjs-server-actions-check(8) | Next.js Server Actions denial of service: read-only checker |
| psf-nginx-oct2026-check(8) | nginx October 2026 security release: checker with optional workarounds |
| psf-nginx-ui-check(8) | nginx-ui restricted-directive bypass (authenticated RCE): read-only checker |
| psf-node-oct2026-mitigate(8) | Node.js October 2026 mitigation |
| psf-openapi-codegen-check(8) | openapi-typescript-codegen code injection, October 2026: read-only checker |
| psf-openssl-check(8) | OpenSSL DTLS handshake retransmission read (heap disclosure): read-only checker |
| psf-php-session-audit(8) | PHP session audit for the CVE-2026-115560 preconditions |
| psf-php2shell-cpanel-mitigate(8) | PHP2Shell mitigation for cPanel EasyApache 4 |
| psf-php2shell-edge-test(8) | PHP2Shell edge guard tester |
| psf-php2shell-mitigate(8) | PHP2Shell mitigation for PHP-FPM 7.0 through 8.5 |
| psf-php2shell-watch(8) | php2shell-watch: follow PHP and web server logs live and flag trouble |
| psf-pillow-oct2026-check(8) | Pillow 13.0.0 security release: read-only checker |
| psf-plex2shell-oct2026-check(8) | Plex Media Server "Plex2Shell" RCE chain: check and hunt |
| psf-pulsar-check(8) | Apache Pulsar October 2026: read-only checker |
| psf-rhsa(8) | Find Red Hat security advisories and check installed packages against them. |
| psf-roundcube-oct2026-check(8) | Roundcube Webmail 1.6.20 and 1.7.5 security release: read-only checker |
| psf-rsyslog-dynafile-audit(8) | rsyslog dynaFile path traversal: configuration audit |
| psf-ruby-regexp-oct2026-check(8) | Ruby Regexp compilation fixes, October 2026: read-only checker |
| psf-sagemaker-check(8) | Amazon SageMaker Python SDK default_bucket() takeover: read-only checker |
| psf-sentry-nextjs-check(8) | @sentry/nextjs tunnelRoute middleware bypass: read-only checker |
| psf-storybook-check(8) | Storybook dev server code injection from the local network: read-only checker |
| psf-tomcat-oct2026-check(8) | Apache Tomcat October 2026: request/response mix-up checker |
| psf-trafficserver-check(8) | Apache Traffic Server experimental plugins, October 2026: read-only checker |
| psf-vsftpd-ftps-ticket-check(8) | vsftpd FTPS data channel hijack (require_ssl_reuse bypass): checker |
| psf-wordpress-plugins-oct2026-check(8) | WordPress plugin checks, October 2026: eight plugins |
| psf-wordpress-pt-check(8) | WordPress core page-template path traversal: read-only checker |
| psf-wordpress-wp2shell-check(8) | wp2shell, WordPress core pre-authentication RCE: checker, hunter and mitigation |
| psf-wordpress-xss2shell-check(8) | WordPress XSS2Shell pre-auth XSS, October 2026: read-only checker |
| psf-yootheme-check(8) | YOOtheme Pro 5 unauthenticated remote code execution: checker |
| psf-zammad-check(8) | Zammad session hijack and local privilege escalation: read-only checker |
The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
