https://cybertoolchain.io/tools/checksec-sh New releases and features in checksec.sh, tracked by The Cyber Toolchain. en Wed, 17 Jun 2026 09:22:41 GMT https://github.com/slimm609/checksec.sh/releases/tag/3.2.0 https://github.com/slimm609/checksec.sh/releases/tag/3.2.0 Wed, 17 Jun 2026 09:22:41 GMT checksec.sh 3.2.0 adds SafeStack, sanitizer, RISC-V CFI, W^X, and stack-clash detection plus a CI gate and parallel scanning. • Adds SafeStack detection for ELF binaries. • Extends CFI hardening detection to i386 CET and RISC-V Zicfilp/Zicfiss (landing pads and shadow stack) for RV32 and RV64. • Detects sanitizer instrumentation (ASAN, UBSAN, MSAN, TSAN, LSAN) via compiler-rt symbol prefix scan. • Adds Selfrando detection via the `.txtrp` section. • New W^X segment check (`SeparateCode`) asserts no `PT_LOAD` segment is simultaneously writable and executable. • Adds stack-clash protection detection via annobin `.gnu.build.attributes` notes (authoritative on RHEL/Fedora/CentOS toolchains). • New RPATH/RUNPATH inspection classifies each entry as bad (relative/empty/world-writable), warning (`$ORIGIN` or nonexistent), or safe (absolute). • Adds annobin-based FORTIFY and GLIBCXX assertion detection. • New `--fail-if` CI gate exits non-zero when a required check is not in a good state. • Adds parallel directory scanning (`RunListChecksParallel`) over a bounded worker pool (default `GOMAXPROCS`). • Adds `--no-warnings` and `--color` flags; warnings now include filename context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checksec-sh https://github.com/slimm609/checksec/releases/tag/3.2.0 https://github.com/slimm609/checksec/releases/tag/3.2.0 Wed, 17 Jun 2026 09:22:41 GMT checksec 3.2.0 adds SafeStack, sanitizer, W^X, Selfrando, and stack-clash detection plus a --fail-if CI gate and CSV output. • Adds SafeStack detection for ELF binaries by scanning for the `__safestack_init` symbol. • Extends CFI hardening detection to i386 CET and RISC-V Zicfilp/Zicfiss (landing pads and shadow stack), covering both RV32 and RV64. • New sanitizer detection (ASAN, UBSAN, MSAN, TSAN, LSAN) via compiler-rt symbol prefix scan. • New Selfrando detection via the `.txtrp` ELF section. • New W^X segment check (`SeparateCode`): flags any `PT_LOAD` segment that is both writable and executable. • New stack-clash protection detection via annobin `.gnu.build.attributes` notes (authoritative on RHEL/Fedora/CentOS; reports Unknown otherwise). • New RPATH/RUNPATH entry classifier: rates each entry as bad (relative/empty/world-writable), warning (`$ORIGIN`/nonexistent), or info (safe absolute). • New annobin-based FORTIFY/GLIBCXX assertion detection. • New `--fail-if` flag: exits non-zero when any specified check (comma-separated keys, e.g. `relro,canary,pie`) is not in a good state — enables use as a CI gate. • Parallel directory scanning (`RunListChecksParallel`) over a bounded worker pool (default `GOMAXPROCS`), reducing open syscalls on a recursive `/usr/bin` scan from ~18k to ~2k. • New `--no-warnings` flag suppresses warning output; new `--color` flag controls colorized output (`auto`, `always`, `never`); warnings now include filename context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checksec-sh https://github.com/slimm609/checksec.sh/releases/tag/3.1.0 https://github.com/slimm609/checksec.sh/releases/tag/3.1.0 Sun, 21 Dec 2025 01:38:04 GMT checksec.sh 3.1.0 adds ARM PAC/BTI and x86 SHSTK/IBT checks, BIND_NOW detection via DT_FLAGS_1, kernel module support, and header suppression. • Adds ARM PAC/BTI and x86 SHSTK/IBT (CET) detection for file-level security checks. • Detects BIND_NOW via DT_FLAGS_1 (DF_1_NOW) in addition to the legacy DF_BIND_NOW flag, improving RELRO full-binding detection accuracy. • Supports checking kernel modules (.ko files) as targets. • Supports binaries with no sections (e.g., stripped or static binaries). • New flag to disable headers and banners in output, enabling cleaner scripted/automated use. • Redirects warnings to stderr, separating diagnostic output from structured results. • Improved command usage descriptions and built-in examples in the CLI help output. • Adds package formats (RPM, DEB, etc.) via goreleaser for easier installation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checksec-sh https://github.com/slimm609/checksec/releases/tag/2.7.1 https://github.com/slimm609/checksec/releases/tag/2.7.1 Sun, 09 Jun 2024 01:28:00 GMT Adds cosign keyless signature verification capability to checksec.sh binary checks • Adds `cosign` keyless signature support for verifying the integrity of binaries and scripts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checksec-sh