For my rust applications, I use "cargo audit" which checks all dependencies against the CVEs. For my typescript and javascript applications, deno audit and/or yarn npm audit.
For the rest of the stack `debsecan` does exactly what you want on Ubuntu: report CVEs for installed software.
I'm not overly keen on the tooling: as far as I can tell the whole industry is prone to flagging false positives as "vulnerabilities" rather than "potential vulnerabilities" and it's a bit too easy to turn those reports into a tick-box "you must update now because the tool says so". But they also do flag true vulnerabilities. And they pay for teams of security researchers to find and fix issues, not least because that's good marketing.
Some have free licenses, many don't.
Sometimes build time is too slow (e.g., a repo that doesn't receive updates every day or so).
Maybe it would be worth it to have an agent that knows your stack, reads the top threads on hn all day long and messages you when it thinks there is something serious going on that could impact you.
PHP2SHELL, in particular, made me expand my weekly security review to include my external network resources.
The natural conclusion for this seems to be realtime monitoring CVE and pre-CVE vulnerability indications in exposed stacks.
I hope that someone has some sort of a reasonable approach here / I would love to help work on something open source if not
Examples of the type of alternate questions to ask in 2026 may include:
- Does my software/system have a robust architecture where a failure of one component (e.g. RCE in a PHP process) has a minor impact, rather than a catastrophic impact? For example, a minor impact might be just the opportunity for an attacker to chain a PHP RCE with kernel LPE for some common syscall, rather than mass loss of every user's data to the attacker. I raised some PHP web application specific ideas in another thread at [1] but the answer to this question is product-agnostic and should consider microservices architecture vs. monolithic web application with access to everything, and use case/requirements development that considers matters such as users wanting to isolate their own access. For example, allowing bank users read only login for bank accounts vs. separate login for making transfers. Or implementing business process changes such as delayed commit for sensitive user actions--e.g. force delay a bank transfer by 24h and notify the user via various means giving them a chance to undo the transfer before they no longer can.
- How can I keep up-to-date with the latest software/system security architecture trends? What is the equivalent of [2] for learning about architecture patterns to potentially use for a simple eCommerce site, HR/finance web application, etc in 2026? For components of a web application such as interpreter, database server, etc--what options exist for each and how good is the project's choice of software languages, dependencies, etc to offer the strongest security protections in 2026? When was the last time I checked if someone had written an interpreter for PHP, Python, etc in Rust, SPARK, or whatever, or written an interpreter with much more comprehensive unit testing included?
- How quickly can my users or I detect security incidents / deviations of system behaviour from typical state? For example, [3] was discussed on HN today as once such detection mechanism where canary tokens are deliberately littered throughout a system or dataset. The security incident may have already happened, but early detection forces an attacker to burn their vulnerability chain quickly on their most highly prized target and not be able to use it against a mass of targets over a long duration of time.
[1] https://news.ycombinator.com/item?id=50184239
But, certainly do your own threat assessment and develop and implement whatever plan works for you.