So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The window for the secure version and the major version release are scheduled in the same week, which one should the site follow first?

📅 2026-11-01 👁️ 0

When the fixed security version window and the annual major version release are scheduled in the same week, which one should the site follow first? Follow the security version. The security version closes known exploitable entry points, with minor changes and quick verification;The major version adjusts the data structure and template behavior, the cost of verification is high, and the cost of delaying for one week is usually much less than squeezing two things into the same maintenance window. The Drupal official fixes the core security version window on the third Wednesday of each month, and at the same time, the release of Drupal 12 is scheduled for the week of December 7, while the previous generation Drupal 10 will no longer have new versions released after December 9, and the two types of dates overlap in the same month.

The date criteria for the three things

Before scheduling, first distinguish among the three types of dates. The security version window is an expected fixed week, and the announcement usually gives a time interval in advance, making it convenient to arrange manpower. The major version release is an annual milestone, usually accompanied by changes in default themes and runtime environment requirements. The termination date of the previous generation branch determines whether you can still get security fixes, it is not an optional date.

The repair rhythm of AnQiCMS can be directly referenced: v3.6.6 fixed the SQL injection issue existing in the list sorting parameters in the release notes, as well as the issue that login credentials can be forged when switching sites, and it is recommended to rotate the full-site request signature key and change the administrator password after the upgrade. This type of update belongs to a security version and is not considered with the functional schedule.

Why are security versions placed at the front

In the same week, prioritize the release of the secure version, for there are three reasons. First, the nature of the risk is different: unpatched injection or credential forgery issues are objects that are actively scanned, while compatibility issues with major versions only affect your own site. Second, the extent of changes is different: the secure version generally only touches related processing logic, with minimal rollback impact. Third, the cost of verification is different: the secure version focuses on verifying login, list sorting, and critical background processes, while major versions need to verify templates, fields, and batch tasks.

How to evaluate the cost of delaying the major version by one week

The cost is mainly two: the new capability is delayed by one week to go online, and if the termination date of the previous generation branch is in the same week, the delay will briefly fall on the unsupported line. In the second case, the risk exposure should be judged by whether there are new security bulletins after the termination date, rather than by days. When evaluating, consider these two factors together with the current traffic structure and frequency of background changes on the site to determine whether the delay is acceptable.

The schedule also needs to consider the deployment form. Sites deployed using the Docker image anqicms/anqicms or Baota panel, aaPanel, often involve image rebuilding and configuration migration, requiring a longer window than the secure version; the default listening port and proxy forwarding configuration are prone to drift during rebuilding, and these need to be verified and completed in the following week.

The schedule needs to reserve two-factor authentication.

The first step is to verify the copy: Run the same version and data copy in an isolated environment, check the key process and static resources. The second step is to conduct sampling verification after release: Randomly select home pages, list pages, detail pages, and form submissions according to page types, and confirm that the status and jumps are normal.

There should be a backup as a safety net between the two steps. The backup capability within the station covers data and static files, and the recovery drill should be scheduled in advance, not found temporarily when an issue occurs.

Question: Can the security version and major version be done at the same time?Answer: It is possible but not recommended. When two things are changed at the same time, it is difficult to locate the cause of the exception, and the rollback will also cancel the security fix.

Question: The previous generation branch has just expired, won't delaying the major version be more dangerous?Answer: After the expiration, what you can't get is the fix of the new version, and the risk accumulates with subsequent announcements. Prioritize the security version and put the major version in the next window to minimize the exposure.

Question: How to determine the length of the maintenance window?Answer: Reverse the verification steps: leave time for replica verification, release, and sampling verification, and then reserve time for rollback. Don't start backup and verification at the end of the window.

Related articles

Components that cannot be found in the vulnerability library, can they be considered risk-free?

A component that cannot be found in the public vulnerability library cannot be considered risk-free, as it is often just that the scope of collection and naming criteria do not match. The vulnerability library categorizes entries by core, extension, and theme, and verifies them one by one. Self-built and commercial components are often not included. This article provides three reasons for not finding them, the handling criteria for the worst-case scenario, and how to turn the asset list into an executable mitigation action sequence.

2026-11-01

Allowing customization of the position of the style, why does the style content also need to be filtered?

The reason for filtering the style content at the position where custom styles are allowed is that styles are not just a presentation layer: attribute names and values can be used to change the page display or make external requests. Filtering needs to cover the three segments of selectors, attribute names, and values, and be coordinated with sensitive word filtering, content review, and background role permissions. This article uses the bypass of the style attribute filter in the official repair list as an entry point to explain the criteria.

2026-11-01

The confirmation process for members changing their email addresses is bypassed, and what else does the account side need to verify?

The confirmation process of changing the member's email binding is bypassed, which means the bypasser has obtained the password recovery channel. The account side needs to verify not only this logic. This article explains why property changes require two-way confirmation, how user groups and access permissions should be tightened, the role of email reminders in the process of handling, and provides four records to be checked after the repair.

2026-11-01

The alias of the article address can be listed externally, where should the list interface receive it?

The article address alias can be enumerated externally, usually requiring two conditions to be met: the alias can be guessed according to a regular pattern, and the list interface allows bulk pagination return. Therefore, the bottleneck is on the interface side rather than the page side, and it is necessary to limit the scale of single returns, set the exposure range according to the domain, and tighten the access to unpublic content. This article explains the conditions for enumeration, what list is exposed, and the location to be checked for internal interface.

2026-11-01

The garbage station update in September took nearly fourteen days to end, when is it suitable for review?

This round of garbage content update in September started in the late month and was marked completed in the early October, lasting for more than thirteen days. Before the update was completed, the ranking reading was the intermediate state within the rolling period, which cannot be taken as a conclusion; the time suitable for review should meet two conditions: the official panel is marked completed, and the data after the completion day returns to a stable interval. The waiting period should first check basic items such as robots and site maps.

2026-11-01

Only a little over 30% of the pages referenced in the AI overview come from the top ten, so should we still pay attention to the ranking?

A large-scale study shows that only about 30% of the pages referenced in AI overviews are also in the top ten natural search results, while this proportion was about 75% a year ago. The decline in overlap does not mean that the ranking has become ineffective: the ranking is still the entry point, but is no longer a condition for reference. The focus should be on which issues the reference hits, whether paragraphs can be extracted separately, and whether the keyword library and anchor text can stably identify the content.

2026-11-01

Most llms.txt files have never been requested, and is it still worth maintaining them?

The analysis of logs from more than 100,000 sites shows that 97% of the llms.txt files have never been requested, with reading concentrated in a few sites. This result does not mean that the file is useless, but rather that it does not solve the two issues of being discovered and intercepted. Whether to continue maintaining it should be judged by looking at whether there are corresponding requests in the access logs of your own site, rather than by looking at whether the file has been uploaded.

2026-11-01

The adoption rate statistics of the two llms.txt files are very different, which decision口径 should be adopted?

Two studies that were checked on the same day are very different: The adoption rate is 8.3% when statistics are taken from the top ten thousand domain names, and it reaches 49.2% when statistics are taken from more than two thousand sites. The difference does not come from who made a mistake in the calculation, but from the denominator range and the method of judgment. When making decisions, do not take the average of the two numbers, but first see which category your site falls into among the samples, and then confirm whether the口径 can be used by checking the three-step verification method.

2026-11-01