Real-time early warning for security vulnerabilities
Know in real time if the next vulnerability hits you. And what to do right now.
Connect your GitHub repos. We analyze your stack all the way down to the runtime, watch every source where vulnerabilities surface first, around the clock, and only alert you to what actually affects you. With a concrete fix for your setup.
PHP2Shell hits 3 of your systems
- api-backendPHP 8.3.35Dockerfile:3
- billing-servicePHP 8.3.35docker/php/Dockerfile:1
- admin-portalPHP 8.3.21.github/workflows/deploy.yml:18
Fix: PHP 8.3.36
Timeline
- 02:41First signal
- 03:07Confirmed
- 03:09Alert to you
- Hosted in Germany
- 100% GDPR compliant
- ISO 27001 certified
- Read-only GitHub access
The problem
The vulnerability is public. And you are the last to know.
On October 21, 2026, PHP2Shell went public: remote code execution without login, in every PHP version since 5.4. Attacks were running before the patch was out. Dependabot and friends stayed silent because the flaw sits in the runtime, not in your packages. Teams spent hours on X, Hacker News and blogs just to answer one question: Does this affect us?
Before the patch
Attacks were running before a fix was available.
Runtime
SCA tools check packages, not the PHP version on your server.
6 to 12 times a year
an event like this hits a typical stack: Log4Shell, xz, regreSSHion, PHP2Shell.
In the same week as PHP2Shell, a Node.js RCE, a GitLab vulnerability with CVSS 10 and a compromised PyPI package came out as well. Nobody can track this manually.
Attackers work in real time. So do we.
The time between the first hint of a vulnerability and the first attack is often just hours. Stackwatch watches those hours for you.
How it works
Four steps. Two minutes to set up.
- 1
Connect
Connect GitHub via OAuth, read-only. Pick your repos. Done in two minutes.
- 2
Map your stack
We read Dockerfiles, lockfiles, CI and infra configs and build your stack map: runtimes, frameworks, packages, servers, providers. With version, confidence and evidence.
- 3
Watch in real time
Vendor feeds and advisory databases every minute, plus security research and social signals, where vulnerabilities surface hours before the CVE. An AI classifies every signal and separates rumor from confirmed report.
- 4
Alert, fix, verify
Only on a real match: an alert in Slack, Teams, by email or SMS, with a fix for your configuration. For critical issues with an active exploit, an AI agent calls you. After the patch, we verify automatically.
The difference
Dependabot sees your packages. We see your stack.
| Aspect | Dependabot / SCA | Stackwatch |
|---|---|---|
| What gets checked | Dependabot / SCAPackages from the lockfile | StackwatchThe whole stack: runtime, framework, packages, server, provider |
| PHP2Shell detected | Dependabot / SCANo | StackwatchYes, PHP version from Dockerfile and config |
| Relevance | Dependabot / SCAEvery CVE in every package | StackwatchOnly if your version and your usage are affected |
| Speed | Dependabot / SCAAdvisory database, often days later | StackwatchReal time, including signals before the CVE |
| Outcome | Dependabot / SCAA pull request nobody reviews | StackwatchAlert with fix and workaround, escalation up to a phone call |
| After the patch | Dependabot / SCANothing | StackwatchAutomatic verification |
We actually analyze the repo: which interpreter runs, behind which web server, which features are enabled. That is how we can tell whether an exploit works against you or only exists on paper.
What happens in the background
We read everything. You only see what hits you.
Vendor feeds
php.net, nodejs.org, framework releases
Advisory databases
GitHub Advisories, OSV, NVD, CISA KEV
Distributions
Debian, Ubuntu, RHEL, Alpine
Security research
Blogs of leading research teams
Social signals
Hacker News, Reddit, Mastodon, Bluesky, X
Supply chain
Compromised packages, provider breaches
Social signals are hints, not facts. An alert only counts as confirmed once a primary source backs it. We label rumors as rumors.
Escalation and evidence
An alert is only done once someone has responded.
Escalation that gets through
Critical with an active exploit? Then your phone rings. An AI agent reads you the vulnerability and the immediate action, and you acknowledge with key 1. No response within five minutes: the next person in the chain. At night and on weekends, too.
Incoming call
Stackwatch alert agent
Agent: This is Stackwatch with a critical alert. PHP2Shell, actively exploited, affects api-backend and two other systems.
Agent: Immediate action: update PHP to 8.3.36. Press 1 to acknowledge this alert.
You: Key 1
Agent: Thank you. Acknowledged at 03:16, recorded in the audit log.
Audit log for your auditor
Every alert, every acknowledgement, every status change with timestamp and person. Exportable as CSV and PDF. Exactly the document ISO 27001 and NIS2 audits ask for.
| Time | Event | Person |
|---|---|---|
| 03:09:42 | Alert triggeredSystem | System |
| 03:14:50 | Call, no responseJ. Becker | J. Becker |
| 03:14:51 | Escalated to next personSystem | System |
| 03:16:08 | Acknowledged via key 1M. Weber | M. Weber |
| 04:02:17 | Patch verifiedSystem | System |
Security and trust
You give us access to your repos. We take that seriously.
Hosted in Germany
All data stays in German data centers.
100% GDPR compliant
DPA under Art. 28 GDPR, no sharing, no trackers.
ISO 27001 certified
Riddle Technologies AG is certified. Processes, access and incident handling are audited, not just promised.
Read-only
We read manifests, configs and the parts of your code that show how your software runs. Never secret values, no write access.
Pricing
Priced fairly by repo. Every feature in every plan.
You pay per connected repo, not per seat. Unlimited users, alerts and channels. Higher plans add more repos and enterprise features like SSO. We never hold back core features. We publish prices when the beta starts. Everyone on the waitlist gets beta terms.
More on pricing- Per connected repo
- Unlimited users, alerts and channels
- Beta terms for the waitlist
FAQ
Common questions. Straight answers.
Waitlist
Be ready before the next vulnerability hits.
Sign up. We will get in touch personally as soon as the beta starts.