Patch-tracker for PHP, LiteLLM and GitLab exposures

What to build

A lightweight web dashboard for agencies and small IT shops that lets them register their exposed endpoints (PHP sites, self-hosted GitLab instances, LiteLLM gateways) and get an automated daily cross-reference against newly disclosed CVEs, with a plain-English patch-priority list and direct links to fixes or changelogs.

Small agencies and solo sysadmins running many self-hosted PHP, GitLab, and LiteLLM instances have no dedicated security team to track which of the constant stream of new CVEs actually applies to their stack, creating room for a cheap, narrow-scope patch-prioritization tool.

Demand

IT shops and agencies that run dozens of client PHP sites or self-hosted GitLab/LLM gateways want a cheap, always-on way to know 'what do I need to patch today' without hiring security staff — demand is current because PHP2Shell-style exploit chains, LiteLLM, and GitLab CVEs are actively being disclosed right now.

• Hacker NewsEngagement

  "PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch" — 56 points, 13 comments on HN, indicating high engagement from a technical sysadmin audience around this exact patch-tracking pain point.

• Opportunity brief (internal signal annotation)Analysis

  Internal note frames the gap as agencies/small IT shops managing many PHP sites, self-hosted GitLab, or LLM gateways lacking dedicated security tooling to map their stack to newly disclosed CVEs.

Stack

• NVD/CVE API
• GitHub Security Advisories API
• Python + FastAPI
• PostgreSQL
• Playwright or simple HTTP fingerprinting for version detection
• Resend or Postmark for patch-alert emails

Solo + AI difficulty

The hard part is building reliable, low-false-positive version fingerprinting across three very different stacks (PHP, GitLab, LiteLLM) without hammering customer servers; the easy part is the CVE feed ingestion and alerting UI, which can lean on existing NVD/GitHub advisory data. A scrappy MVP covering just one stack (e.g. GitLab, which has clean version endpoints) is feasible in 1-2 weeks solo with AI-assisted coding; covering all three well enough to trust is closer to 4-6 weeks.

Entry threshold

Buildable solo in 1-2 weeks on top of public CVE/NVD feeds and simple network or dependency fingerprinting; no licences needed, though reliable vulnerability data sourcing and avoiding false positives takes iteration.

Window

3-6 months

Where to find first users

• r/sysadmin and r/devops
• Hacker News Show HN post
• Agency/dev-shop Slack and Discord communities (e.g. WebDevStudios-style agency groups)
• Direct outreach to WordPress/PHP agency directories

Competitors

• Shodan
• Censys
• Tenable Nessus
• Qualys

Counter-signals & risks

• Vulnerability scanning and CVE-matching tools already exist (Shodan, Censys, Nuclei templates, GitHub/GitLab Dependabot, Qualys, Tenable) and may already cover PHP, LiteLLM, and GitLab detection, reducing differentiation for a new entrant.

• Historical match is 'none', meaning there's no track record showing this specific opportunity has been validated by prior similar signals or market activity.

• LiteLLM is a comparatively niche and fast-moving project; building reliable version/CVE fingerprinting for it may have a small addressable market relative to engineering effort required.