Editorial methodology

Pages are written from primary sources: the PHP advisory and release announcements, the two GitHub security advisories, php.net support and end-of-life tables, and vendor notices that were opened during the 22 October 2026 review.

A distribution package is called fixed only when that vendor's own notice listed the package version. Upstream version numbers are not treated as proof of a backport. Minimal source branches for PHP 7.4, 8.0, and 8.1 are described as source backports, not as tagged releases.

Pages with incomplete vendor evidence use the editorial status "partial". Operational steps that follow from the advisory, such as restarting the web SAPI after a package update, use the status "guidance". Neither status means an independent laboratory retested the vendor build.

The site does not publish exploit requests, payload structure, or scanning instructions.