Patched is a claim.
Current state is evidence.
The urgent PHP update answers one question: what remediation should be applied. Boards, buyers, insurers, MSPs and counterparties still need a different answer: what is actually true now, what evidence supports it, what remains unknown and when should it be checked again?
After the emergency patch, assurance fragments.
A vendor statement, package build, visible runtime string, WAF rule and production deployment can each be useful evidence — but they are not interchangeable.
Remediation
What action was intended or applied?
Current state
What is serving now, with what provenance?
Freshness
When does that evidence become stale enough to re-check?
Major authorities converge on action, verification and continued monitoring.
PHP
The PHP project says updating to fixed releases is the complete solution for the two critical 21 October flaws; mitigations exist for incomplete update paths.
NCSC
UK guidance focuses on identifying affected systems, updating, prioritising internet-facing exposure, assessing compromise where appropriate and continuing to monitor third-party updates.
These organisations do not endorse ECZ-ID. Their public guidance establishes the operational problem; ECZ-ID supplies an independent evidence-currentness layer after and between those actions.
Provider updates show why provenance matters.
| Public signal | What it demonstrates |
|---|---|
| KnownHost explains vendor backports can leave the visible PHP version unchanged after a security fix. | A version string alone is not enough; package build and vendor provenance matter. |
| Silverstripe reports some completed patch deployments without a platform manifest version uplift. | A manifest can lag the effective serving state. |
| 123 Reg publishes product-by-product remediation states across managed services and VPS responsibility boundaries. | Provider, service type and responsibility model change the answer. |
| Big Wet Fish publishes fleet-by-fleet progress across hosting stacks. | State changes over time; one global claim may not describe every estate. |
| Mutual describes different remediation paths across Craft Cloud, Servd and VPS environments. | Infrastructure context determines the evidence path. |
Source links: KnownHost · Silverstripe · 123 Reg · Big Wet Fish · Mutual.
The useful output is not a green badge. It is a bounded record.
Known
Evidence directly supports the statement at the recorded time.
Supported
The statement is supported by supplied provider or package evidence, with provenance retained.
Unknown
The evidence does not support a stronger conclusion. Unknown remains unknown.
A Current-State Receipt should record subject identity, observed or supplied evidence, source/provenance, timestamp, scope, claim boundaries, unknowns and a re-check trigger. It does not claim a site is safe, uncompromised, approved or permanently current.
Six questions worth asking before relying on “we patched it”.
01 · Subject
Which exact website, runtime, estate or service does the statement cover?
02 · Evidence
What evidence supports the current state rather than the intended action?
03 · Provenance
Is the evidence from upstream, vendor package, provider control plane, runtime observation or another source?
04 · Unknowns
What has not been observed or cannot currently be established?
05 · Freshness
When was the evidence recorded and what event makes it stale?
06 · Re-check
Who is responsible for checking again after material change?
Turn remediation into evidence you can rely on.
Already patched? Start with a £195 Current-State Review. Need remediation? Patch & Verify™ is £395. Need the evidence position kept active? Website Trust Continuity™ starts at £39.99.
Current-State Review · £195Patch & Verify™ · £395Website Trust Continuity™