Information reviewed： · Published by Tsumira Japan (SourceArt Ltd)
Check upstream support and your package supplier’s maintenance separately. An older number does not prove a package is unpatched, and a hosting contract does not by itself establish ongoing security support.
Identify who supports the package
Upstream PHP branches have defined support windows. Operating-system and extended-support vendors can provide fixes under separate conditions. Identify the supplier for your actual package.
Record the plan, package, distribution and maintenance end date. Distinguish software remaining executable from a commitment to provide security updates.
Confirm backports with evidence
A backport applies a fix while retaining an earlier branch or upstream number. The public string alone may not reveal the change.
Match the installed package to the supplier’s security notice for the relevant CVE. If the mapping is unclear, ask support which notice applies to your server.
Separate immediate patching from migration
First confirm the immediate remedy. Then assign responsibility and time for compatibility review, testing, migration and handover before maintenance ends.
If an old application cannot run on the target runtime, compare code changes, component replacement and supported maintenance. Assess long-term operation as well as the immediate change.
Questions and answers
Can the version determine the full risk?
It is a clue. Supplier fixes and the actual runtime still need review.
How do we begin migration planning?
Inventory sites, components, support dates, owners and customer journeys that require testing.
Official references
Official guidance and interfaces can change. Confirm your actual plan, configuration and the supplier’s latest notice. This guide does not certify the security or patch status of any individual environment.
Need help with your site?
We can help clarify the information and scope. Paid work begins after you approve the scope and cost.