So Outside Technology Security CMS
AnQiCMS
Online Demonstration

There are only branches of script languages for security repairs, so the operator needs to pay attention to which two dates?

📅 2026-11-01 👁️ 0

After the script language branch enters the stage of only receiving security fixes, the two dates that the site operator needs to pay attention to are the date of stopping active support and the date of stopping security fixes. Once the former arrives, functional defects will no longer be repaired, only key security issues will remain; once the latter arrives, even security patches will no longer be provided. The time between the two dates is the migration window, treat it as a 'still usable' margin, which is the most common time misjudgment

Differences in the definitions of the two support stages

The definition on the official version support page is clear on the day: the scope of the active support stage is 'Reported bugs and security issues are fixed and regular point releases are made', that is, all defects and security issues will be repaired and small versions will be released regularly;A release that is supported for critical security issues only. Releases are only made on an as-needed basis

The difference is in two sentences: one is 'critical', where common defects no longer move; the other is 'as-needed', where the publishing version does not have a fixed rhythm, you may not get the small version, and you can only migrate directly to the next branch.

The two dates to keep an eye on

Branch Only the closing specifications of the security phase are repaired The actions of the operator
An earlier branch Verify that the security support ends on December 31, 2026 on the day The migration plan should be arranged the same year
The middle branch Security support ends on December 31, 2027 Enter the observation period, verify compatibility
Newer branch Security support ends on December 31, 2028 Routine maintenance is sufficient
Latest branch Security support ends on December 31, 2029 Focus on the end date of active support

There is an earlier 'end of active support' date for the same branch. The time you really need to get to work is not the security support deadline, but the end of active support: from that day on, you have to bear compatibility issues and functional defects yourself, and wait until the security support deadline to migrate, usually only a few weeks are left to do a complete regression.

The time difference between the announcement and the fix

The upstream will send a preview in advance and ask for reserved time. In the other document checked on the same day, the security release window was announced in advance and stated 'Reserve time to update PHP as soon as the release is available', directly naming the preparation period to the webmaster. When seeing such announcements, the correct reaction is not to wait for the patch to come out and then look, but to prepare the recovery point and test environment between the announcement day and the window day.

A few days between the preview and the landing are often the most cost-effective preparation time of the year: at this time, there is no pressure from failures, and decisions do not have to be made in a few hours.

Collaboration on the side of the operating environment

The口径 on this side of the self-built program is different. AnQiCMS is a Go language program, the delivery form is compiled binary plus configuration file, the operating environment mainly depends on the deployment method: when container deployment, the operating environment goes with the image, when panel deployment, it goes with the version provided by the panel, and the port and reverse proxy configuration remains unchanged at the 8001 level.

This means that the risk of 'language branch disabling' is manifested on the self-built side as the outdated mirror base layer, the processing method is to rebuild the mirror instead of waiting for the upstream to release patches. It is more reliable to write the base image version and the rebuild frequency into the inspection items than to remember the deadline of a certain language.

Common questions

Q: Can the branch only repaired in the security stage continue to run in the long term? A: It can for a short period, but you have to bear the functional defects, and the security patches become on-demand release, with an uncontrollable waiting period.

Q: Does migration have to be across major versions? A: Not necessarily. First, check the compatibility and dependencies of the target branch, and crossing one version is usually less risky than accumulating two versions.

How do you turn two dates into actionable items? Answer: Set a reminder on the calendar for 'End of active support one quarter before' and schedule a rollback drill at the same time.

Related articles

The upstream releases a high-risk patch every six to eight weeks, how long should the maintenance window of the site be set?

The upstream program releases a high-risk patch every six to eight weeks on average, the maintenance window should not be set according to 'accumulate a batch and then change'. The window should be short and the frequency stable: control the amount within a few hours, schedule in advance according to the patch rhythm, leave a recovery point before the window, only move one layer within the window, leave a verification record after the window, and use scheduled release to stagger the content schedule to avoid the window period.

2026-11-01

How to calculate the hidden labor cost into the annual cost, besides the monthly computing power cost of building a program for several tens of dollars

The monthly computing power cost of building a content management system is just the accounting cost, and the hidden labor cost should be calculated into the annual cost per head per hour: patches and upgrades, backup and rollback drills, daily inspections and fault recovery are all converted into hours, and then multiplied by the mixed working hour unit price. The sample checked that day shows that the labor cost can reach several times the computing power cost, and the built-in backup and batch replacement capability compresses these steps of working hours.

2026-11-01

The website package with a low price for the first year's renewal doubles, and the price difference appears in which month.

The first-year low price, the renewal plan is almost doubled, the price difference does not appear in the first month, but is raised to the monthly bill in one go when the renewal cycle changes, and the sample checked on the day is about nine dollars more in the first year, and the renewal price rises to seventeen to twenty dollars. By separating the first-year price and the renewal price into two columns and recalculating the annual expenditure from the second year, the plans are truly comparable.

2026-11-01

Shared hosting costs as little as a few dollars per month, when is it necessary to switch to a virtual private server

Shared hosting's lowest-tier monthly fee is just a few dollars, do you need to switch to a dedicated virtual server without looking at the number of website pages, but rather at three resource curves: whether the response time is extended during peak hours, whether the resident memory is at the top, and whether the concurrent peak is queuing. The domain annual fee and hosting monthly fee should be calculated separately; when the program-side memory usage is low, the same type of load can maintain a lower tier.

2026-11-01

Nine out of ten new vulnerability entries in a year are due to extensions rather than the core, how can the list prove itself?

In the tens of thousands of newly discovered vulnerabilities, ninety percent are in extension components rather than core programs. To ensure that the site's component list is clean, rely on three sets of accounts: what components are installed, the version of each component in use, and the source and maintenance status of each component. First straighten out the list before talking about patching ahead of time. The built-in SQL injection and XSS protection only covers the input layer and cannot replace component version verification.

2026-11-01

When promoting lightweight programs with less than 400 KB of code, what three factors should be considered when selecting?

Promoting lightweight programs with less than 400 KB of code, when selecting, in addition to the repository size, you also need to look at three items: the runtime resident memory and single-machine bearing capacity, the data table structure and the scope of functional coverage, and the deployment form and recovery cost. The code size only indicates the size of the release package, and when the functional gap needs to be filled with extensions, the saved volume will become a new risk area and maintenance hours.

2026-11-01

Paragraphs with statistical numbers are more likely to be selected by AI, and which step of content scheduling needs to be changed?

Paragraphs with statistical numbers and quotes have higher visibility in AI answers, the adjustment needed in content scheduling is the paragraph writing style: one paragraph should answer only one question, key numbers and sources should appear in the same paragraph, and the title should be written according to the user's question. When the output volume is large, consistency is maintained by keyword libraries and automatic tags, not by manual editing and monitoring article by article.

2026-11-01

Only a few of the AI crawler requests are for real-time answers for users, is it worthwhile to block the entire site?

Among the requests of AI crawlers, only a few are for real-time retrieval of content for users, and it is not cost-effective to block the entire site: According to the distribution of purposes verified on that day, training accounts for the majority, while real-time retrieval only takes up a small proportion, but that part carries real users. A more stable approach is to group and handle by purpose in the robots.txt file, tighten training, allow retrieval, and use interference codes to control batch collection, and test the number of requests and return status before and after the change.

2026-11-01