Questions,
answered.

Run the binary with sudo. It compares installed packages and the running kernel against Canonical’s USN data, including fixes available only through ESM, and lists the matching notices.

Run it with --cve CVE-ID. It reads Canonical’s CVE data for the release and answers each CVE: affected with a fix available, affected with no fix released, fixed in the installed version, or not affected.

This covers CVEs Ubuntu has not fixed yet, which the normal scan leaves out because every host has hundreds of them in the kernel alone.

Yes. Go records the Caddy version, the Go toolchain and every plugin module in the binary, and the tool reads that without running it, including a Caddy running in a container. Builds that are not Ubuntu’s own package are compared against Go’s vulnerability database, so a vulnerable plugin or an old Go toolchain is reported as well as Caddy itself.

A build copied over /usr/bin/caddy from the caddy package, or put there by caddy upgrade or caddy add-package, is not the package’s build even though dpkg still lists the file. The tool compares the binary’s version and md5sum with the package’s, judges a mismatch as its own build, and warns that the next apt upgrade puts the stock build back without the plugins.

Yes, if HTTPS on the IP gives out a real certificate. Censys and Shodan connect to every IPv4 address without a server name and index the certificate they get, which comes from the default server. The tool makes the same handshake at each HTTPS port and address and reports a certificate that names a domain as High.

The fix is a default server that refuses such handshakes (nginx ssl_reject_handshake on, 1.19.4 and later) or presents a self-signed certificate for localhost.

Comparing version numbers is not enough, because Ubuntu backports fixes: nginx 1.18.0 may already be patched. Apt packages are compared against Canonical’s OVAL data. Self-compiled, upstream repository and PPA builds are compared against data from nginx.org and php.net.

The tool also reports common dangerous settings, webshell signatures and PHP files in upload directories.

It reads the BPF filters on packet sockets, the same data as ss -0pb, and reports a filter containing published BPFDoor magic values as Critical.

A variant with other values will not match that rule, but unpackaged programs that hold packet sockets and unknown processes that filter port 53 are still reported. Processes posing as kernel threads or system services are reported too.

The scan is read-only and runs at low CPU and idle I/O priority, using at most 2 CPUs. The kernel may load the af_packet_diag module, the same as running ss -0, and --no-netlink turns that off.

The tool also makes TLS handshakes, without a request, to the host’s own HTTPS ports. On hosts with many files, limit the filesystem scan with --fs-timeout or skip it with --skip-fs.

No. It only downloads public advisory data, using plain GET requests that send no information about the host. --offline stops it from using the network at all.

Yes. Copy Canonical’s OVAL file to the host and pass --offline --oval-file. The report warns you when the data is more than 14 days old.

Run it with sudo for full coverage. Without root it still runs, but items it cannot read are marked “Not checked” and the report warns you.

It is built and validated only for Ubuntu 18.04, 20.04, 22.04, 24.04 and 26.04. On anything else, the report warns that the tool has not been validated there.

No. A rootkit that controls the kernel can falsify anything a local tool sees, and signature checks miss customized samples. If you suspect a compromise, boot from clean media and perform offline forensics.