ECZ-ID · FIELD CHECKLIST · 2027 EDITION

The first 24 hours after a critical PHP alert.

Patch fast. Preserve the evidence. Keep claim boundaries intact. Establish what must be checked again.

0–60 minutes · establish exposure and ownership

Identify the affected estate. Hostnames, applications, managed services, VPSs, legacy systems and internet-facing exposure.

Identify responsibility. Provider-managed, agency-managed, internal team or mixed.

Read the upstream/provider advisory. Do not substitute a social post or generic scanner result for the actual remediation path.

Prioritise exposed systems. Official UK and EU guidance emphasises internet-facing systems.

1–6 hours · remediate and retain proof

Apply the fixed release, vendor package/backport or managed provider remediation appropriate to the environment.

Retain package/build output, deployment/change record, provider advisory and timestamps.

Restart/reload services where the remediation path requires it and record the action.

If compromise is suspected, preserve the incident path separately; “patched” does not mean “historical compromise excluded”.

6–24 hours · prove current state

Subject

What exact site/environment does this evidence cover?

Provenance

Upstream, vendor package, provider statement, deployment record or runtime observation?

Unknowns

What has not been established?

Freshness

Timestamp the evidence and define the event or age threshold that makes it stale.

Do not fail a patched system solely because the visible upstream version appears unchanged; vendor backports can retain version strings.

Do not describe WAF protection as equivalent to updating the vulnerable runtime.

Issue a bounded receipt of what is KNOWN, SUPPORTED and UNKNOWN.

Set the next re-check trigger: package/runtime change, provider update, deployment, supplier/control change or freshness expiry.

Reference guidance: PHP · NCSC · ENISA · CERT-EU. Citation is not endorsement.

Need ECZ-ID to do the next step?

Already patched · £195

Current-State Review: turn supplied evidence into a dated picture of what is known, unknown and worth re-checking.

Need remediation · £395

Patch & Verify™: supported remediation, health checks, runtime evidence and documented re-check.

Keep it current · from £39.99

Website Trust Continuity™: one-off 30-day, monthly subscription or annual prepaid evidence-currentness route.

Managing client estates · £395 pilot

MSP Founding Partner Pilot™: establish a repeatable client-estate Current-State Proof workflow.

Check it. Fix it. Prove it. Keep it current.

Choose website package Website Trust Continuity™

PHP Critical Response — 24-Hour Checklist — 2027 Edition