Updates to scanner

PHPGuard/ContentView.swift

@@ -64,7 +64,7 @@ struct ContentView: View {
                 stat("Scanned", "\(Set(store.results.filter { $0.error == nil }.map(\.serverID)).count)", "checkmark.shield")
                 stat("Findings", "\(store.results.filter { $0.error == nil }.prefix(store.servers.count).reduce(0) { $0 + $1.findings.count })", "exclamationmark.triangle")
             }
-            Text("Audits are read-only. CVE matching, package backport verification, Docker inspection, and compromise detection are not implemented in this initial build.")
+            Text("Read-only PHP inventory, APT upgrade checks and running Docker container discovery. CVE matching and vendor backport verification remain unimplemented; no server is certified secure.")
                 .foregroundStyle(.secondary)
             Button("Scan all servers") { store.scanAll() }.buttonStyle(.borderedProminent).disabled(store.servers.isEmpty)
             Spacer()
@@ -100,6 +100,10 @@ struct ContentView: View {
                         dataSection("PHP-FPM services", result.fpmServices)
                         dataSection("Nginx FastCGI routes", result.nginxUpstreams)
                         dataSection("Installed packages", result.packageVersions)
+                        dataSection("Available PHP package upgrades", result.availableUpdates)
+                        Text("Package assessment: \(result.packageAuditStatus)").foregroundStyle(.secondary)
+                        dataSection("PHP detected in running Docker containers", result.dockerPHP)
+                        Text("Docker assessment: \(result.dockerAuditStatus)").foregroundStyle(.secondary)
                         Text("Findings").font(.title2.bold())
                         ForEach(result.findings) { finding in
                             VStack(alignment: .leading, spacing: 4) {

PHPGuard/Models.swift

@@ -27,6 +27,10 @@ struct AuditResult: Codable, Identifiable {
     var fpmServices: [String] = []
     var nginxUpstreams: [String] = []
     var packageVersions: [String] = []
+    var availableUpdates: [String] = []
+    var dockerPHP: [String] = []
+    var packageAuditStatus = "Not checked"
+    var dockerAuditStatus = "Not checked"
     var findings: [Finding] = []
     var rawOutput = ""
     var error: String? = nil

PHPGuard/SSHScanner.swift

@@ -22,6 +22,27 @@ enum SSHScanner {
     printf '===FPM===\n'; systemctl list-units --all --type=service --no-legend --no-pager 2>/dev/null | grep -E 'php[0-9.]+-fpm' || true
     printf '===NGINX===\n'; grep -Rh 'fastcgi_pass' /etc/nginx/sites-enabled/ 2>/dev/null | sort -u || true
     printf '===PACKAGES===\n'; dpkg-query -W -f='${Package} ${Version}\n' 'php*-fpm' 'php*-cli' 2>/dev/null || true
+    printf '===UPDATES===\n'
+    if command -v apt >/dev/null 2>&1; then
+      apt list --upgradable 2>/dev/null | grep -E '^php[^ /]*/' || true
+    else
+      printf 'Package manager not supported\n'
+    fi
+    printf '===DOCKER===\n'
+    if command -v docker >/dev/null 2>&1; then
+      ids=$(docker ps -q 2>/dev/null)
+      if [ -z "$ids" ]; then
+        if docker info >/dev/null 2>&1; then printf 'No running containers\n'; else printf 'Docker access unavailable\n'; fi
+      else
+        for id in $ids; do
+          name=$(docker inspect --format '{{.Name}}' "$id" 2>/dev/null | sed 's,^/,,')
+          version=$(docker exec "$id" sh -c 'php -r '''echo PHP_VERSION;''' 2>/dev/null' 2>/dev/null)
+          if [ -n "$version" ]; then printf '%s %s\n' "$name" "$version"; fi
+        done
+      fi
+    else
+      printf 'Docker not installed\n'
+    fi
     printf '===END===\n'
     """#
 
@@ -81,6 +102,10 @@ enum SSHScanner {
         result.fpmServices = fields["FPM"] ?? []
         result.nginxUpstreams = fields["NGINX"] ?? []
         result.packageVersions = fields["PACKAGES"] ?? []
+        result.availableUpdates = fields["UPDATES"] ?? []
+        result.dockerPHP = (fields["DOCKER"] ?? []).filter { !$0.hasPrefix("Docker ") && $0 != "No running containers" }
+        result.packageAuditStatus = result.availableUpdates.contains("Package manager not supported") ? "Unsupported package manager" : "APT upgrade inventory (not a security advisory assessment)"
+        result.dockerAuditStatus = fields["DOCKER"]?.first(where: { $0.hasPrefix("Docker ") || $0 == "No running containers" }) ?? "Running containers inspected where accessible"
         if result.phpVersions.isEmpty {
             result.findings.append(Finding(severity: "Info", title: "No PHP CLI detected", detail: "No PHP binary found in standard paths; this does not exclude bundled runtimes or containers."))
         }
@@ -91,7 +116,13 @@ enum SSHScanner {
                 result.findings.append(Finding(severity: "Warning", title: "Legacy PHP detected", detail: "\(line). Verify vendor support and distribution security maintenance."))
             }
         }
-        result.findings.append(Finding(severity: "Info", title: "CVE assessment not performed", detail: "Installed package versions must be checked against current vendor advisories and backported fixes. A version string alone cannot establish vulnerability."))
+        for line in result.availableUpdates where line.hasPrefix("php") && line.contains("/") {
+            result.findings.append(Finding(severity: "Warning", title: "PHP package update available", detail: line + ". Review the package changelog and vendor security notice before classifying CVE exposure."))
+        }
+        for line in result.dockerPHP {
+            result.findings.append(Finding(severity: "Info", title: "PHP runtime in Docker", detail: line + ". Container image security status requires a separate image/advisory assessment."))
+        }
+        result.findings.append(Finding(severity: "Info", title: "CVE status unverified", detail: "Version strings and available upgrades do not establish CVE exposure. Ubuntu backports, package origins, and current vendor advisories require independent verification. No server is labelled secure based on this scan."))
         return result
     }
 }

README.md

@@ -1,38 +1,18 @@
-# PHPGuard — macOS PHP Inventory Auditor (Phase 1)
+# PHPGuard — Phase 2
 
-Native SwiftUI macOS application for **read-only** PHP inventory scans over SSH.
+Native SwiftUI macOS application for **read-only** SSH inventory of PHP installations on Linux servers.
 
-## Open and run
+## New in Phase 2
+- APT PHP package upgrade inventory (no automatic updates)
+- PHP version discovery inside accessible running Docker containers
+- Per-server findings and status of package/Docker checks
+- Existing SSH inventory, scan history, and JSON export retained
 
-1. Unzip and open `PHPGuard.xcodeproj` in Xcode 16 or later.
-2. Select the PHPGuard scheme and **My Mac** destination.
-3. Set your signing team in Signing & Capabilities if required.
-4. Build and Run (⌘R).
-5. Add a server (SSH hostname, username, port and optional identity file).
-6. Ensure you can first connect from Terminal using SSH and that its host key is in `~/.ssh/known_hosts`.
-7. Click **Scan now**. Scan history and JSON export are available.
+## Security interpretation
+**This is not a CVE scanner yet.** Available upgrades are not necessarily security updates; the absence of upgrades is not evidence of safety. Vendor backports and security advisories must be checked before labelling an installation vulnerable or patched. Docker inspection only checks running containers with a `php` executable accessible on PATH. No compromise detection is performed.
 
-The app uses `/usr/bin/ssh` with `BatchMode=yes` and strict host key checking. It does not store passwords or change remote systems. SSH keys must already be configured. For the initial release, the app runs unsandboxed so it can invoke the system SSH executable and access existing SSH configuration.
+## Open in Xcode
+Unzip the archive, open `PHPGuard/PHPGuard.xcodeproj`, select My Mac, and build. macOS 15+; the build has not been verified in Xcode in this environment.
 
-## Implemented
-
-- Native macOS SwiftUI navigation and dashboard
-- Add/edit/remove SSH servers; optional private-key path
-- Concurrent read-only scans of PHP CLI binaries, PHP-FPM services, Nginx FastCGI routes, Debian/Ubuntu PHP package inventory
-- Local JSON persistence and history
-- JSON report export
-- SSH error reporting and strict host key checking
-
-## Not yet implemented
-
-- Live CVE feeds, Ubuntu package backport verification or definitive vulnerability status
-- Docker and Apache scans
-- Intrusion detection and web-log investigation
-- PDF reports, scheduled scans, notifications, automated patching
-- Integration with PegasusMonitor
-
-**Important:** This version is an inventory tool, not a complete vulnerability or compromise scanner. It intentionally does not label a server secure solely from a version string.
-
-## Privacy
-
-Server definitions and scan results are stored in `~/Library/Application Support/PHPGuard/`. Scan reports may contain internal hostnames and package inventory. Do not publish them publicly.
+## SSH
+The app invokes `/usr/bin/ssh` with BatchMode and StrictHostKeyChecking. Configure working key-based SSH access in Terminal first. Remote scripts are read-only; APT's upgrade listing may refresh no metadata and uses currently cached package lists. Docker access depends on remote user permissions.