latentCVE Central
Investigate a CVE against a running application, review the evidence, and prepare an upgrade plan.
Gemini · PHP/Apache · Docker Compose · PostgreSQL
The report the agent created in the video, including its findings, change plan, and proposed verification steps.
Engineering brief
- Problem
- Determine whether selected CVEs affect the PHP runtime serving a configured application.
- My contribution
- A persistent investigation with bounded tools, upstream advisory retrieval, deterministic version comparison and a manual change plan.
- Key decision
- Use the observed web runtime and structured same-branch patch boundaries to propose one image update for both CVEs.
- Result & evidence
- One live Parcel Desk run: PHP 8.4.26, six passing application checks, two affected-version findings and a plan for PHP 8.4.27.
- Limitations
- Configured upstream PHP/Apache Compose targets only. No exploit reproduction, Internet reachability assessment, runtime update or post-change verification.
What it does
CVE Central connects vulnerability records to evidence from a configured application. Its agent inspects the running PHP version, deployment settings and ordinary application behavior, then compares the observations with upstream advisory metadata.
The captured Parcel Desk investigation assessed CVE-2026-109618 and CVE-2026-109619 together. All six application checks passed, but the observed PHP 8.4.26 runtime was affected by both. The resulting manual plan proposes PHP 8.4.27 within the same release branch.
Each phase pauses for review. This run produced an assessment and a change plan; no upgrade or exploit test was performed. The report includes the original investigation and the operating procedure.
How it is built
Follow the investigation to understand why passing functional checks can coexist with an affected runtime, how code constrains the model, and what evidence is still needed to close the finding.
php2shell: Are We Affected?