Guides
How to Check if PHP Is Patched on Ubuntu (Not Just the Version Number)
Ubuntu backports PHP security fixes without changing the upstream version. Learn to read your php package version, the changelog and the Ubuntu CVE tracker to see what is really patched.
PHP CVE Backports Explained: Why “Outdated” PHP May Be Secure
Why scanners flag distro PHP as vulnerable when it is already fixed, how Debian and Ubuntu version strings encode backported patches, and how to compare them correctly.
composer.lock Vulnerability Check: Find Known Security Advisories in PHP Dependencies
Check every package pinned in composer.lock against public advisory databases (OSV, FriendsOfPHP, GitHub advisories) with composer audit or an online self-check.