Our adviceApply the source backport, or restrict access until you upgrade.
No official patch for your version
PHP2Shell: PHP 7.4 to 8.1 got source backports only
A new service from Quackbase
Stack Watch
by QuackbaseEvery new CVE in your application stack, watched by experts.
We match every component in your libraries, containers, runtime, OS and self-hosted tools like GitLab or n8n against new CVEs around the clock. Then our experts tell you what to fix first.
Why now
When a big CVE hits,
can you answer fast?
What management asks the morning after
- “Are we affected?”
- “Which systems, and how bad is it?”
- “When will it be fixed?”
Most of the answer sits outside your own code: in the runtime, the OS and tools like GitLab or n8n that your team installed.
67,000+
new CVEs published in 2026 by the end of September
2×
new CVEs a month: 5,045 in January, 10,740 in August
141
exploited in the wild from January to August 2026, more than all of 2025
Attackers use AI to turn new patches into exploits. Recent: PHP2Shell (CVSS 9.2), Node.js (10 flaws), n8n “Ni8mare” (CVSS 10).
Sources: CISA via The Record (Sep 30, 2026), Google GTIG (Sep 2026)
Compared with the tools you may already use
Tools find flaws.
We tell you what to do.
| What you need | Dependency scanners (SCA) | Cloud security platforms | AI code security tools | Stack Watch |
|---|---|---|---|---|
| App libraries and containers | Yes | Yes | Your own code | Yes |
| Runtime and OS on your servers | Limited | Mainly cloud | No | Cloud or on-prem |
| Self-hosted tools (GitLab, n8n) | Limited | Partly | No | Yes |
| Who sets the priority | Automated scoring | Automated, cloud context | Not their job | Experts, with your business context |
| Workaround when you can’t patch | Upgrade advice | Upgrade advice | Code fixes | Advised for each system |
| VEX reviewed by an expert | Your team | Your team | Your team | Yes |
Already use one of these? Keep it. Stack Watch covers the server layers it misses and makes the call on what to fix first.
Based on public product information, Oct 2026. Features vary by plan.
How it works
AI does the legwork.
Experts make the call.
Your side
Your systems
- App libraries
- Container images
- Runtime and OS
- GitLab, n8n, etc.
Stack Watch
by Quackbase
Your side
What you get
- Alerts
- Fix order
- Monthly reports
- VEX statements
- 1
Generate SBOMs
Inventory every layer in the CycloneDX standard
Automated - 2
Analyze 24/7
Match against NVD, OSV, GitHub Advisories and vendor advisories
Stack Watch - 3
Triage and assess
AI sorts the findings first, then our experts decide what affects you
Stack Watch - 4
Recommend fixes
Fix order, target versions, or interim mitigations
Stack Watch - 5
Report and VEX
Monthly report plus formal vulnerability status documents
Stack Watch
What we watch
Four layers covered, not just code
-
Pull versions through read-only API tokens
-
Scan on the server or from the container image
-
Scan images in CI with Syft or Trivy
-
Generate an SBOM from code on every build
Illustrative scenario: PHP2Shell
If PHP2Shell hit your systems
-
Public
PHP releases the fix
CVE-2026-109618 and 109619 go public.
-
Automated
Engine flags your projects
Say it finds three: two in containers, one on a Linux server.
-
Stack Watch
Triage and impact
We check each one, e.g. two are internet-facing and one is already patched by its distro.
-
Stack Watch
We send fix guidance
For example: move to 8.3.36, and block the exposed endpoint until it ships.
-
Stack Watch
We verify and close
We re-check the fix and issue VEX statements for every project.
What you would get: a same-day answer to “are we affected?”, and a fix your team can ship safely.
Illustrative scenario.
Impact assessment
We look beyond the CVSS score
- CVSSHow severe is this flaw, technically?
- EPSSHow likely is exploitation in the next 30 days?
- CISA KEVIs it already being exploited in the wild?
- Config and exposureIs the vulnerable feature on in your config, and can attackers reach it?
- Business contextHow critical is this system, and what data does it hold?
PHP2Shell, CVSS 9.2Everything gets fixed, in the right order
| Your server | Do now | Then |
|---|---|---|
| Internet-facing, PHP 8.3.30 | Patch today | Verify and close |
| Behind a firewall that allows web traffic | Patch today: the firewall won’t stop it | Verify and close |
| Behind a WAF with PHP2Shell rules | Confirm the WAF rule is active | Patch within the week |
| Internal only, reached through VPN | Limit who can reach it | Patch in the next sprint |
| Distro build with the fix backported | Confirm the backport is in place | Record as fixed with VEX |
Scores alone mark all five “critical”. We tell you what to do first, and give every server an interim step until the fix is in.
Workarounds
When patching isn’t simple,
you still have options
New CVE
Our adviceMove to the smallest safe version, or change the config that exposes the flaw.
The fix would break your app
A major version jump can mean weeks of testing
Our adviceAdd a WAF rule, tighten access, or switch off the vulnerable feature.
You can’t take downtime yet
Peak season, a code freeze, or a release in flight
Real fix, on a set date
PHP2Shell versions: Tenable
Service scope
Six areas of coverage
01Full inventory
SBOMs and versions from code, container images, servers and self-hosted tools.
02Triage
Separate real findings from noise, so developers only get work that matters.
03Impact analysis
Can it really be exploited, and which systems or data would be hit?
04Fix guidance
What to fix first, which version to move to, or a workaround until you can patch.
05EOL alerts
Advance warning before your versions stop getting security patches.
06Fix verification
We re-check after you patch and close the item, with VEX statements for auditors.
What your team gets
- Portfolio dashboardSee the risk across every project on one page.
- Instant alertsCritical issues sent to your team by email or LINE.
- Monthly reportsPlain-language summaries for executives and engineers.
- Fix guidanceWhat to change for each vulnerability, and how.
- VEX statementsEvidence of vulnerability status for auditors.
- Dedicated advisorsSecurity experts ready to answer your questions.
Why Quackbase
Security experts
who also build software
We build, not just audit
Our engineers design and ship web, mobile and backend systems for clients, so we know how software works from the inside.
Advice on your real risk
We assess the actual risk to your systems and find workarounds when you can’t patch yet. Not just “please update.”
We think like attackers
Our consultants know how flaws really get exploited, so we can tell a real threat from a theoretical one.
Start with Stack Watch, then add other services as you need them: penetration testing, DevSecOps or software development.
Our commitments
Clear response times,
clear responsibilities
| When a new CVE affects you | Alert with advice within |
|---|---|
| Actively exploited (in CISA KEV, or flagged by government or vendor alerts) | 4 hours |
| Critical (CVSS 9.0 and up) | 1 business day |
| High (CVSS 7.0 to 8.9) | 3 business days |
| Medium and low | Monthly report |
If a flaw fits two rows, the faster one applies. PHP2Shell (CVSS 9.2) was exploited before KEV listed it, so it got 4 hours.
What counts as 1 project
One application: its code repo, its container images and the servers it runs on. Each self-hosted tool, like GitLab or n8n, is one project.
What we’re responsible for
Meeting these response times and the quality of our advice. Your team applies the fixes. Full terms are in the service contract.
Service options
Choose the model that fits
Managed
We run it in Thailand
We operate everything on servers in Thailand, with a separate instance for each client.
Best for: companies with in-house dev teams
Bundle
Add to current work
Add it to an existing pentest, DevSecOps or software development engagement with us.
Best for: current Quackbase clients
On-premise
Inside your network
Installed on your servers, so scan data stays in your company. Includes an annual support contract.
Best for: large enterprises with strict data rules
Every option includes setup, triage, impact assessment, monthly reports and the response times above.
Add-on: hands-on fix support hours
Getting started
We do the setup.
Your first project is free.
- 1
Free 30-minute call
We map your systems and pick the first project together.
- 2
Free pilot, set up by us
We add SBOMs to your CI, connect the API token and install server scanners. First triage report within 48 hours.
- 3
Full rollout
Every project goes live on the option you choose.
All you provide: approval to add our SBOM step to your CI, and a read-only server account. We never need your code.
Watch your first
project free
Book a 30-minute call to map what you run, and we’ll set up your first project. We reply within 1 business day.
Email us