Experiments

2 published2 verifiedUpdated 2026-08-27

SC-002Verified

php -v cannot tell you whether you are patched against PHP2Shell

Two throwaway containers, one CVE, opposite version behaviour: Ubuntu patches without changing the version string, Rocky rebases to the fixed release.

phpsecuritypackagingbackports

Read the evidence

SC-001Verified

We froze a 2007 Joomla site without freezing its attack surface

A reproducible migration log: 442 discovered routes, a script-free archive, explicit redirects, and the evidence behind every decision.

migrationsecuritystatic sitesnginx

Read the evidence