lightswitch05 avatar PHP Version Audit : Three Years and Running

Quick Stats

A little over three years ago, I released the first version of PHP Version Audit. In case you've never heard of it before, it is just a simple utility to check a given version of PHP against known CVEs or support end dates. The coolest part of it (in my opinion) is that it self-updates by parsing the PHP changelog twice a day, discovering any new releases and CVEs that have been patched. What makes it stand out from other CVE tools is that the source being the Changelog means that the CVE alert is available long before the NVE CVE database has been updated with the information. Now that it has been up and running for three years, I thought it would be fun to look at some stats of the project.

In the past three years, there have been 2,027 updates to the rules that drive PHP Version Audit. The vast majority of the updates being automatic on a cron schedule. Those automatic updates have parsed 34 CVEs from the changelog - across 102 version releases. PHP Version Audit has discovered CVE announcements on median of 5 hours after the Changelog update. The NVE CVE database gets updated with the CVEs on median of 260 hours - or almost 11 days after the Changelog update, making PHP Version Audit 98% faster than other tools that source from the CVE Database. I think that is pretty cool!

CVE Database update after php release announcement

PHP Version Audit update after php release announcement

PHP Version Audit was designed from the beginning to be self-updating. For the most part, that design has worked out great. However, there are always some hiccups or breakages that require fixing. Below is a graph showing the update frequency over the lifespan of the project. The longest the self-updating feature was broken was 7 days. I've made it where PHP Version Audit will throw a 'Stale' exception if its last update is over 2 weeks, so I'm happy to say I'm well within the grace period. While things did a have bit of a rocky start, it is pretty rare to go un-updated for longer then 24 hours.

Update Frequency

That is all for the stats! Thank you for reading. Earlier this year I released Node Version Audit, as it continues running it will be interesting to see how the stats compare with PHP in a few years. By the way, the only stat I don't know is if anyone is actually using this thing? I switched jobs recently and no longer use PHP, so while I enjoy keeping this project going, I no longer get to use it. It would be nice to know if someone out there is actually using it!