The PHP vuln advisory is a textbook example of how to do it right. Huge props to them! https://www.php.net/archive/2026.php#2026-10-21-5 Specifically, it details: - what went wrong - what is and isn't known about who is affected (e.g. for the OOM one, Apache mod_php definitely is, FPM may be but isn't known) - what mitigations are available if patching/updating is not possible, and whether they are partial or full - sufficient information to roll your own further mitigations if needed (e.g. I think you could setup policies to terminate the process on OOM rather than letting it continue to the vulnerable OOM handler)