Your scanner returned a wall of findings: Ubuntu already fixed half through backports, while a KEV vulnerability in a public service got buried in the middle. Paid PatchFirst monitoring builds a P0–P3 work queue. The free check provides a rating and highlights your stack without finding details.
One free check: a rating, highlighted stack, and general blind spots. Monitoring is paid. Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50.
What we check
Currently: OS packages, exact dependency versions and recognized products. Coverage depends on agent permissions and available data.
Available now
OS packages: Debian, Ubuntu, Alpine, the RHEL family (Rocky Linux, AlmaLinux), openSUSE and SLES.
PHP: composer.lock.
Node.js: npm (package-lock.json), Yarn v1 and Berry (yarn.lock), pnpm (pnpm-lock.yaml).
Python: poetry.lock, Pipfile.lock, uv.lock, requirements*.txt pinned with ==; installed packages in discovered venv/site-packages.
Runtime and service versions recognized through the product catalog.
Container images by name and tag; image contents are not inspected and remain a blind spot. Unknown images and floating tags need manual review.
Direct and transitive dependencies are included; dev dependencies are labeled. Discovery is limited by permissions, time, file and package counts. Inexact versions and reached limits appear as blind spots.
Coming next
Ruby: Gemfile.lock.
Go: go.sum and binary build information.
Rust: Cargo.lock.
Java: Maven/Gradle lock files and jar manifests.
These ecosystems are not checked yet.
An old version isn’t the whole story.
One package already has a distro fix. Another came from a PPA and slipped through the check. They need different matching rules.
Stop chasing fixes you already have
Ubuntu can backport a fix to an older branch without changing the upstream version. PatchFirst checks distro packages through OSV using the source package and version, instead of relying only on upstream version ranges.
That helps reduce backport noise so you can focus on updates you actually need.
Keep third-party packages in scope
PatchFirst detects third-party repository markers in version strings, excludes those packages from distro OSV matching, and checks them against CVE.org as upstream software.
A real case from PatchFirst development: RCE in PHP 8.3.35 from the sury PPA, which OSV missed. Distro advisories alone weren’t enough.
For recent CVEs, PatchFirst also flags cases where the distro has not yet published an OSV entry for the package.
Monitoring turns findings into a work queue.
Risk = severity (0–10: distro priority, otherwise CVSS) × exploitability (KEV ×2, exploit ×1.4…) × exposure (public 1.0; possibly public 0.8; internal 0.6; local 0.45). For example, CVSS 7 + KEV on a public service = 7 × 2 × 1.0 = 14 → P0: fix today.
P0 and P1 come first
P0 means risk ≥14 or a KEV on a public component. The model’s target is one day. P1 comes next, with a one-week target. Any P0 caps the overall rating at 49.
P2 and P3 go into the plan
P2 has a one-month target; P3 covers the remaining findings. The report keeps the details: priority helps order the work, while the engineer decides how to apply each fix.
Monitoring looks beyond the package list.
Installing an update isn’t enough if the old kernel is still running. And a floating image tag doesn’t provide a reliable version to check.
New kernel installed. Reboot pending?
PatchFirst analyzes the running kernel. If a newer kernel is installed, it adds a separate finding that a reboot is needed.
Keep databases private
Publicly accessible databases, Redis, and Docker API become separate findings. Port numbers stay on the owner’s server. The agent infers exposure from bind addresses and a public IP, without an external probe.
Blind spots stay visible
Unrecognized images and floating tags such as latest or 17 are marked as blind spots.
Application dependencies are covered too.
PatchFirst checks composer.lock, npm/Yarn/pnpm and Python pip/poetry using exact versions, including transitive and dev dependencies. Lock-file labels identify projects; collection limits appear as blind spots. Ruby, Go, Rust and Java are not supported yet.
No root. Inspect what gets sent.
The agent is a single file: a standalone binary or a Python zipapp. For monitoring, the installer adds a user cron job that runs every 6 hours.
Review the payload first
Use dry-run to see what the agent would send. For a free check, you can generate anonymized JSON, review it, and paste it into the check page yourself.
Python is optional: the binary includes name encryption. The Python variant requires python3-cryptography for name encryption. It collects technical inventory without access to your database contents.
Anonymized before upload
Hosts become UUIDs; IPs become a public-address flag. Paths and private names become HMAC labels. When name encryption is enabled, the name dictionary is encrypted with a separate key the service never receives. Otherwise, the agent sends no dictionary.
Anonymized inventories and reports are stored in PostgreSQL in readable form for the service. Backups use a separate recipient encryption key. Read about data handling →
You can leave names unset: the dashboard will show “Server 01”. You can also choose an alias such as web-1: it is stored openly. Do not enter a domain, IP address, company or customer name. For protection, enable name encryption in Account: your browser will move existing names into an encrypted dictionary and the service will delete the open copies.
Limitations
Priority is a model estimate, not a breach probability. Sources can be wrong or delayed.
Verify findings, firewall rules, and reachability: the agent makes no external probe.
Unidentified software is a blind spot. PatchFirst does not replace an audit or penetration test.
During analysis, PatchFirst sees versions and technical details. The connection IP is used only in memory for brute-force protection and is not retained.
Reports are in your dashboard, without external notifications. Payment is arranged manually through the dashboard contact.
Start with one host
See which components need attention.
A one-time check is free: run a command for a report link, or submit anonymized JSON. The report contains a rating, component names and installed versions with severity highlights, and general blind spots. Specific vulnerabilities and what to patch first are part of paid monitoring. Ongoing monitoring is paid. Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50.
