An independent response guide, with its limits stated

What this site covers

This is a response publication, not a news service. It covers the work that follows a disclosure: finding the runtime that actually serves requests, choosing the right update, proving that the running service changed, and recording the result for the next person.

• Assess: hostnames, SAPIs, package sources, container images and owners.
• Patch: distribution packages, source builds and images, with the restart evidence that a package alone does not provide.
• Verify: package, process, traffic and business evidence, in that order.
• Hand over: a local workbook, original collaboration templates and dated sources.

How the content is checked

• Each source is read in full, not summarised from a search result.
• The publication date and the date it was checked are both recorded.
• Claims are labelled confirmed, conditional or not verified. A distribution's backport is not assumed to match an upstream version threshold.
• Operational guidance names the environment and the conditions where it applies.
• A change to wording, a table or a source assessment is dated on the revisions page.

What this publication is not

• It is not affiliated with the PHP project, any security vendor, any hosting provider or any government agency.
• It does not provide an incident response service, a vulnerability reward programme or legal advice.
• It does not scan your servers, inspect your logs or certify that a system is safe.
• It does not claim professional certifications, client engagements or research findings that are not documented.
• It does not sell a product or accept payment for a favourable assessment.

Corrections

If a claim is wrong, send the page, the sentence and the source that contradicts it to [email protected]. Corrections that change a conclusion are dated on the revisions page. Broken links and inaccessible pages are also welcome.

The site is a static publication. There is no account system, no tracking script and no server-side collection from the workbook. See the privacy page for what the hosting platform still processes.