Site record

What changed on this site, and when

This is a revision log for the response kit. It is not an incident timeline, and it does not date events in the disclosure. It records only substantive changes to this site's guidance.

Entries 2 Latest 24 October 2026

A date is added only when the wording, a table, a source assessment or a tool behaviour changes. Rebuilding the site or automatically stamping every page with today’s date is not a revision.

2026-10-24

Site identity, contact address and container evidence corrected

The public site now uses one identity and one contact address: php2shell.co.uk and contact@php2shell.co.uk. The footer, About, Contact and Changes pages no longer present another site as part of this publication's identity. The Contact page adds a copy-email control with success and manual-fallback feedback. The workbook now writes each edit synchronously and reports its save state accurately; mobile totals are compact with a table scroll hint. The container playbook now distinguishes base image digest, application image ID, repository digest and platform manifest, and the build checks reject foreign site identities and wrong mailto addresses.

Cloudflare Email Routing is configured for contact@php2shell.co.uk; an end-to-end external delivery test has not been recorded. This entry does not claim a received test.

Pages affected: / · /understand/ · /assess/ · /patch/ · /verify/ · /environments/managed-hosting/ · /environments/wordpress/ · /environments/containers/ · /workbook/ · /templates/ · /references/ · /changes/ · /about/ · /contact/ · /privacy/

Sources reviewed: php-advisory-2026-10-21 , php-supported-versions , ubuntu-usn-8948 , debian-dsa-6574 , docker-digests , docker-multi-platform , docker-engine-api

2026-10-23

Response kit published

First release of the independent response kit: four-step response path, three environment playbooks, a local workbook with CSV export, and three collaboration templates. All sources were read in full on the publication date, including PHP's 23 October informational advisory on session upload progress.

Session upload progress (CVE-2026-115560) is included as an informational advisory, not as a third confirmed exploit in the 21 October disclosure.

Sources reviewed: php-advisory-2026-10-21 , php-session-2026-10-23 , ghsa-oom , ghsa-stale , php-supported-versions , php-changelog-8 , cloudflare-waf-php2shell , ubuntu-usn-8948 , debian-dsa-6574 , redhat-cve-109618 , docker-php-versions , wordpress-php-docs , php-fpm-config , php-session-config