So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Only leave security fixes and not stop supporting, when should the scheduling of the runtime environment be?

📅 2026-11-01 👁️ 0

After the PHP version enters the stage of only security fixes, what should be the timeline for scheduling the site runtime environment - the answer is to calculate from the expiration of active support, rather than from the day of final cessation of maintenance.The official version support page on the day's table, the active support for PHP 8.2 ends on December 31, 2024, and the security support ends on December 31, 2026;PHP 8.3 active support ends on December 31, 2025, security support ends on December 31, 2027;PHP 8.4 is actively supported until December 31, 2026, and securely supported until December 31, 2028;PHP 8.5 is actively supported until December 31, 2027, and is securely supported until December 31, 2029.Many teams write the schedule in the last column before that day, resulting in the entire window being on a branch that only fixes security issues.

What kind of issues does the difference between two-phase support fall on

Stage What will be fixed What will no longer be fixed What phenomena the site will encounter
Active support Functional defects and security vulnerabilities None Compatibility issues have official patches to follow
Only security support Security vulnerabilities Functional defects, dependency adaptation Extended errors can only be bypassed, behavior differences will no longer be changed
Maintenance has stopped None None No patches will be released for new vulnerabilities

Differences are not visible in everyday life, but once encountered, they appear in clusters: compatibility issues with new databases or extensions will no longer be repaired by anyone; a dependency library changed its behavior, and the official branch will no longer follow up; while security fixes will still be released regularly, so the phrase 'still receiving patches' is easily misinterpreted as 'still supported'. When judging the schedule, it is more practical to regard only security support as expired.

Which date should the schedule be traced back from?

Using the end date of active support as the trigger point, leave enough preparation time in advance: first verify the performance of the program and extension in the new version in the test environment, then schedule the maintenance window, and finally make the formal switch. The runtime version and program version should be scheduled together, as their expiration dates are often out of sync. Handling them separately will cause a line to remain on the old branch for a long time.

The deployment method of the self-built system determines the fallback means. For Docker image deployment, fallback only requires switching back to the previous image tag, provided that the historical tags are still available; for one-click deployment using Baota panel or aaPanel, fallback depends on panel backups and site directory snapshots; for manual LNMP deployment, fallback relies on your own configuration and database backup. It is also necessary to review the default listening port and reverse proxy rules after switching to avoid not being accessible from the external network after the upgrade is completed.

Backup and regression preparation before the upgrade

You must back up both data and static files; if either is missing, it is not considered a complete backup. Attachments uploaded, thumbnails generated, and theme templates all belong to the static file section. Sites that only back up databases are most commonly found to be empty in this area during recovery. After the backup is completed, it is really necessary to restore it to an isolated environment to see if it can be brought up. The practice of only generating files without verification will expose risks only when an incident occurs.

Regression checklist written by link: background login and captcha, article creation and publication, column and list page, image upload, form submission, interface reading. Note the performance before each upgrade, compare item by item after the upgrade, and first judge whether the change is due to version behavior change or configuration omission.

Items to check after going online

At least three things to check after the switch is complete: the reported runtime environment version of the program is indeed the new version; there are no new compatibility alerts in the error log within a business cycle; the rollback path is available, and the mirror tag or backup file can still be found. Write these three into the change record, and the next schedule will have a reference time cost.

Common questions

Why are you in a hurry to upgrade when the version that only supports security is still releasing security patches?Because the functional defects and dependency adaptation are no longer fixed. Security patches only solve the disclosed problems and cannot handle the changes in extended behaviors and compatibility breaks for you.

Can you only upgrade the runtime environment without upgrading the program?Yes, but it depends on the version support range of the program. The compatibility with old files will also be terminated, and both lines need to be confirmed together.

How early should the scheduling be prepared?It depends on whether you can complete a full recovery drill before the due date. Verification of the test environment, application for maintenance windows, and acceptance of backups will all take time.

What should I do if there is no backup?First, perform a backup of the data and static files, verify the recovery, and then proceed with any upgrades. The loss caused by upgrades that cannot be rolled back is usually greater than the delay in upgrading.

Related articles

Several hours after the patch is released, someone starts probing. How should the affected version range be used to determine the emergency sequence?

After a few hours of patch release, if there is detection traffic, don't rush to change the content. Use the affected version range to confirm whether you are within the scope. Take the example of an unauthorized local file inclusion, the version of the fix and the span of the historical range determine the emergency queuing order: confirm the version, tighten the entrance, upgrade, backup and acceptance, and leave evidence for each step to review.

2026-11-01

40 percent of websites use the same website-building program, does a higher proportion make it safer?

The same website-building program is used on nearly 40 percent of websites, a higher proportion indicates a mature ecosystem, a long patch chain, and higher benefits from automated scanning. However, it is not a security indicator itself. The truly verifiable capabilities are injection and cross-site protection, content-side filtering, and user group and permission stratification. These should be written into the acceptance checklist when choosing options.

2026-11-01

AI crawling is divided into three categories: retrieval, training, and agency. Each site needs to decide on its own which category to choose.

After AI crawling is divided into retrieval, training, and agency categories, the site needs to decide on a category-by-category basis: retrieval category brings the opportunity to be cited, training category does not produce immediate feedback, and agency category represents the user's current visit. Using a common switch will block the inclusion, and this article provides the order of judgment by category, as well as where the background robots configuration and llms.txt generation fall.

2026-11-01

The language version is automatically redirected based on the visitor's IP address, how should a multilingual site guide?

A multilingual optimization guide released in October 2026 categorizes the most common errors as technical settings: automatic redirection based on IP address or browser language, missing return links, translation of only navigation, standard tags redirecting all languages to English pages, metadata and URL not translated, machine translation not reviewed. The correct approach is to keep the default landing page accessible, allowing users to switch explicitly and return the same way, with AnQiCMS's multilingual site configuration and full-page HTML translation配合 301 redirect management to implement.

2026-11-01

Static site generator and content system mixed, which pages are suitable for pre-generation

Static site generator compiles content into files during the build phase, with extremely low read cost, but it needs to be regenerated every time it is changed; enterprise content systems are suitable for pages that can be changed at any time and have permission. When both are used together, allocate according to the type of page: documents and landing pages are pre-generated, comments, forms, and member content remain on the dynamic side, and then use pseudo-static rules to unify the address style.

2026-11-01

Where does the difference lie in the content selection system of government portals and corporate official websites in terms of audit permissions and backup?

The emphasis of the content selection system of government portals and corporate official websites differs: the former prioritizes pre-publication review, sensitive word filtering, and permission stratification, while the latter prioritizes publication efficiency and column management. The backup range should cover data and static files, and recovery should be practiced at different rhythms. This article provides a checklist for the two types of sites.

2026-11-01

AI answers mention the brand but do not provide a link, should the mention rate and citation rate be counted separately?

In AI answers, when mentioning a brand without providing a link, should the mention rate and citation rate be separated? Yes. Mention is the brand name appearing in the answer, and citation is the answer accompanied by a link to the source. These are different events, and merging statistics will understate or overstate visibility. This article explains the misjudgment caused by the difference in measurement criteria, provides a ledger field for separate recording, and describes two things that can be improved on the content side.

2026-11-01

Only about 10% of sites have installed llms.txt, can this number indicate that it is useless?

Only about one-tenth of the sites have installed llms.txt, can this adoption rate number indicate that it is useless? No. A low adoption rate indicates that it is not yet a common practice, and an unclear relevance indicates that it is not a lever for citation volume, neither of which equals invalid. This article separates the sample and scope boundaries of two studies, provides a way to judge it as a reading path rather than a ranking method, and explains how to cross-verify whether it has been read using crawl logs and site maps.

2026-11-01