Evidence, corrections and updates
Primary PHP advisories take precedence over summaries. Research demonstrations are identified separately from confirmed general exposure. We revise content when the underlying guidance changes and show a review date. Report mistakes or missing evidence by email with the page URL and a primary-source reference. We do not publish guessed package revisions, invented test results or unsupported claims of safety.
How assessments are made
Manual checks compare full stable versions within the four published branches. Vendor builds need both CVE advisories; unknown builds stay unknown. The optional public website check collects reported versions and platform clues, never exploit proof. Missing headers, a CDN or one patched replica cannot establish safety for every runtime. Review dates describe editorial checks, not live threat intelligence.
Translations and language parity
The site is available in 18 languages. Version numbers, CVE identifiers and code remain unchanged across translations. Technical meaning takes priority over literal wording. If a translation appears ambiguous, compare the linked primary advisory and send a correction. None of the translations is an official translation of the PHP project’s security guidance.