Am I affected?
One Python file that checks your machine for the October 2026 PHP, Node.js, BIND, LiteLLM, GitLab and eMudhra issues, and tells you what to do about each one.
No dependencies, and nothing about your machine is sent anywhere. Python 3.8+ on macOS or Linux.
curl -fsSL https://amiaffected.now/run | sh
Rather read it first? run is ten lines; it fetches secinspect.py and advisories.json into a temp folder and runs them. Pass options after sh -s --:
curl -fsSL https://amiaffected.now/run | sh -s -- --html report.html # HTML report curl -fsSL https://amiaffected.now/run | sh -s -- --docker # also scan Docker images curl -fsSL https://amiaffected.now/run | sh -s -- ~/work # only search this folder
Exit code is 1 if anything is affected, so it can fail a CI job.
What it checks
| PHP | CVE-2026-109618 / 109619 (PHP2Shell), every PHP on PATH and in Homebrew |
| Node.js | The Oct 21 2026 release (10 CVEs incl. Brotli RCE) across PATH, nvm, Volta, fnm and Homebrew |
| BIND 9 | CVE-2026-94300 against ISC's affected ranges |
| GitLab | CVE-2026-110264 and 11 more on self-managed Omnibus |
| LiteLLM | The 1.107.0 backdoor: installed copies, lockfiles, malware files and bad Docker image digests |
| eMudhra CA | Whether each trust store (OpenSSL, certifi, Keychain, Java, Firefox, Windows) would accept the cracked intermediates |
On a Linux server
On Ubuntu, Debian and RHEL/AlmaLinux/Rocky it also checks the running kernel and the usual VPS software against each distro's own fixed packages, so a patched server isn't flagged just because the version number looks old.
| Linux kernel | Four bugs on CISA KEV (CVE-2026-46300 and others) and the remote TCP bug CVE-2026-98432 |
| Web servers | nginx (CVE-2026-15176 and more), Apache httpd 2.4.69 fixes incl. mod_http2 |
| Databases | MariaDB (CVE-2026-85746 and more), MongoDB (CVE-2026-82067) |
| Libraries | Brotli (CVE-2026-111497, CISA KEV) |
| Apps | WordPress core, Nextcloud's built-in Collabora server, Plex and Zammad (all CISA KEV) |