Vulnerability checks
How 3R Monitor finds the vulnerabilities that affect the software actually installed on your servers, and when it emails you.
The Security page lists the vulnerabilities that affect your servers: which server, which software, the installed version and the version that fixes it. Each agent sends the master an inventory of the software installed on its server, and the master matches it against the latest published vulnerabilities. You only see the ones that affect you.
How software is checked
There are three methods, one for each place software comes from, each with the most accurate data for it:
| Where the software comes from | How it is checked | Data |
|---|---|---|
| Official distribution repositories: PHP, Apache, OpenSSL, the kernel… every system package installed with apt, dnf or apk | Package versions are compared with the distribution's security advisories. Distributions backport fixes to older version numbers (for example Debian's 8.2.20-1~deb12u1 may already be fixed), so comparing upstream versions would give many false alarms. | OSV.dev records for Debian, Ubuntu, AlmaLinux, Rocky Linux and Alpine |
| Main services compiled yourself, installed with aaPanel, or from third-party repositories (ondrej/sury, Remi, the official MySQL repository…) | By upstream version. New vulnerabilities use the affected ranges the vendor gives in the CVE record (checked every hour, so they are found the day they are published); older ones use NVD. | CVE Program (cvelistV5), NVD |
| Website project dependencies | composer.lock, package-lock.json and yarn.lock (without development dependencies), found automatically under /var/www, /www/wwwroot, /home/*/public_html and the site directories in the Apache and Nginx configuration | OSV.dev records for Packagist and npm |
It also warns when a software branch or the operating system has reached end of life and gets no more security updates (data from endoflife.date). For branches that are no longer maintained and that the vendor doesn't list, critical vulnerabilities are marked Possibly affected.
CISA KEV and CISA's own assessments mark the vulnerabilities that are exploited in the wild.
Emails
| Vulnerability | When it is emailed |
|---|---|
| Exploited in the wild, or critical (CVSS ≥ 9) with a fixed version available | Right away, in the combined alert email |
| Others at or above the configured level (default: high and above) with a fixed version | In a daily digest at 8:00, panel time zone. The digest also lists what was fixed the day before. |
| Not yet patched by the distribution (nothing to upgrade to) | Not sent on its own, and hidden in the panel by default. Critical ones still appear in the daily digest. |
Group recipients only get the vulnerabilities of their group's servers. Change the level and the hour in Settings → Vulnerability checks.
The vulnerabilities that need action now also scroll in a red bar across the top of the Overview, for signed-in users, until they are fixed or ignored. × hides the bar in this browser tab until something changes.
With AI assessment
With AI vulnerability assessment turned on, the AI judges each high, critical or exploited vulnerability against what actually runs on the server, and decides instead:
- Urgent ("Needs action today"): emailed right away and shown in the red bar;
- Important ("Fix in the next maintenance window"): in the daily report;
- Not urgent ("Low risk on these servers"): only in the panel.
With AI report emails on, the daily digest is part of the AI daily report. Urgent ones count toward the AI's emails per day, and with on-call on they are emailed only after the on-call engineer has checked them. If the AI fails or isn't available, the rules above apply.
How often
- The agent uploads a new inventory when software changes (something is installed or upgraded, or a lock file changes), and the master checks it right away.
- Full recheck with the latest data every 6 hours; CVE changes are checked every hour, and each changed record is downloaded once a day.
- Scan now on the Security page starts a check immediately.
Working with the list
- The tabs show the Open vulnerabilities, those Fixed (30 days) and the Ignored ones.
- Filter by server, severity and type, or search by CVE, software or server. Hide those with no fixed version yet is ticked by default.
- Each vulnerability is a card. On the left, the severity and the CVSS score. On the right: the title, the CVE number (a link to its public page), the type and when it was found; whether it is Exploited in the wild (with the date it was listed in CISA KEV), Used by ransomware or Possibly affected; with AI assessment, the AI assessment with its reason and what to do (Suggested); and the Affected servers: the package, the installed version → the fixed version (or "No fixed version yet"), and the servers. Servers with the same package and versions share one line. Details shows the description, the exploitation status, the references and, for each server, the component, versions, source and location.
- Vulnerability emails use the same card.
- System packages are listed under their source package (for example
perlorbrotli); "installed as …" shows the packages actually installed on the server (for exampleperl-baseorlibbrotli1). Those are the ones to upgrade. The AI on-call can upgrade them for you after your approval. - Ignore a vulnerability you don't need to act on, for all servers or for one, with an optional reason (for example "this feature is not used"). You won't be reminded again. Stop ignoring brings it back.
- Data sources and how matching works shows when each source was last updated.
- Software inventory lists each server's operating system, packages and projects, and when its inventory was last received; Inventory shows the details.
What is sent out
Only software names and versions, for example php8.2 8.2.20-1~deb12u1 or laravel/framework 10.48.2. Never host names, IPs or file contents. To turn the checks off: Settings → Vulnerability checks.
An optional NVD API key (free from nvd.nist.gov) in the same settings makes looking up older vulnerabilities faster.
Notes
- Supported systems: system packages on Debian, Ubuntu, AlmaLinux, Rocky Linux and Alpine. On other systems, the main services and the project dependencies are still checked.
- Projects in other directories: add them in Servers → Settings → Project directories, or set
project_dirsin the agent'sagent.conf. - The master server itself is only checked if it also runs the agent (install it as "master + agent").
- To see the inventory a server's agent uploads, run
sudo 3rmonitor inventoryon that server.