Package scanners tell you what to upgrade. FirstWatch reads the advisory and tells you why you're exposed, what partially protects you, and proves every claim.
Every verdict is capped by what the evidence can prove. It can't be talked into reassuring you.
FirstWatch tells you whether you're exposed, not whether you've already been attacked.
Pick an example, then compare a version-string check and a package-aware check with what FirstWatch finds, and why.
php8.4-fpm was on apt hold, so the last upgrade patched the CLI that php -v reports (8.4.27) but left the FPM that serves traffic at 8.4.16.
A version-string check compares one PHP version number to the advisory, the way banner-based scans and quick php -v checks do. The package-aware check is our own code-only version of what package scanners do: each installed dpkg version against the distribution's fix record. It is not the output of any of those tools.
1 of 2 engine packages affected
php8.4-fpm is at 8.4.16-1~deb13u1; Debian fixed both CVEs in 8.4.27-1~deb13u1.
Fix
sudo apt-mark unhold php8.4-fpm && sudo apt-get update && sudo apt-get install --only-upgrade php8.4-fpm php8.4-commonphp8.4-fpm is on hold, which is why upgrades skipped it. Unhold, upgrade, then restart PHP-FPM.
Debian ships this fix in trixie-security. If apt finds nothing newer, add deb http://security.debian.org/debian-security trixie-security main to your apt sources, then run it again.
For each package and CVE: the evidence that let the verdict stand, or the rule that downgraded it. The rules can only make a verdict less reassuring.
Stands because: Debian's own security data, checked through OSV, lists php8.4 8.4.27-1~deb13u1 as fixed for CVE-2026-109618. The installed version was read from dpkg.txt:6.
Stands because: Debian's own security data, checked through OSV, lists php8.4 8.4.27-1~deb13u1 as fixed for CVE-2026-109619. The installed version was read from dpkg.txt:6.
Stands because: Debian's own security data, checked through OSV, lists php8.4 8.4.16-1~deb13u1 as still affected.
Stands because: Debian's own security data, checked through OSV, lists php8.4 8.4.16-1~deb13u1 as still affected.
Re-checked instantly by the same safety engine, against this run's recorded evidence. No model call.
8.4.27-1~deb13u1 from dpkg
Safety ledger: 11 rules checked · 0 downgrades
fixed in distro
fixed_in":"8.4.27-1~deb13u1"
fixed in distro
fixed_in":"8.4.27-1~deb13u1"
8.4.16-1~deb13u1 from dpkg
Safety ledger: 11 rules checked · 0 downgrades
still affected
status":"affected"
fpm susceptible, no complete exploit demonstrated
susceptible, though no complete FPM exploit has been demonstrated
GHSA-w8hw-w9fx-j79w advisory
still affected
status":"affected"
FPM validated
Session lifecycle RCE was validated against mod_php and FPM.
GHSA-6wmf-4rv5-p3rp advisory