PHP WEBSITE REMEDIATION AND HANDOVER
Blank buyer worksheet from WAYF. Created 22 October 2026.
Guide: https://wayf.ai/blog/php-website-maintenance-upgrade-or-migrate/

Use one record per service/environment. This is a handover aid, not a security certification. Leave unknowns marked unknown. Do not record passwords, tokens or other secrets.

SERVICE AND OWNERS
Website/service:
Environment and publicly reachable endpoints:
Business owner and contact:
Hosting/platform owner and contact:
Website engineering owner and contact:
Security/incident-response contact:
Authority to deploy or isolate the service:

EXPOSURE AND REQUIRED CHANGE
Advisory/CVE and authoritative URL:
Applicability checked at (date/time/timezone):
Actual serving runtime/package/image before change:
CMS/application and relevant dependencies:
Inventory of serving nodes, containers, old services and bundled PHP:
Fixed vendor release/package and supporting advisory:
Known compatibility constraints:
Current containment or mitigation, its limitations and owner:

RELEASE AND FUNCTIONAL ACCEPTANCE
Agreed change scope:
Deployment reference and date/time/timezone:
Serving runtime/package/image after change:
Evidence every serving instance uses the fix:
Worker restart/replacement confirmation where required:
Important journeys agreed for verification:
Results and evidence links (do not pre-fill as passed):
Recovery approach and decision owner:
How recovery avoids reopening known exposure:

SEPARATE SECURITY ASSESSMENT
Suspected compromise or reason for further investigation:
Evidence-preservation and containment coordination:
Qualified responder, scope and status, if engaged:
Evidence reviewed and limitations:
Unresolved security questions and owners:
Patching does not establish that there was no prior compromise.

HANDOVER
Patch/deployment status and evidence:
Functional verification status and evidence:
Compromise assessment status (separate from patch status):
Remaining exceptions, owner and due date:
Business acceptance by and date:
Next update owner and escalation path:
Support end dates and next upgrade decision: