Patch with evidence.
Recover with care.

A response workbook for site owners and operators. Learn what to ask, what a version number proves and what stays open after a patch.

Try the evidence lab ↗

Free · Fictional data · No account · No installation

Security snapshot · 23 October 2026

The original CVE-2026-109618 and CVE-2026-109619 release minima are PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. They do not settle the separate CVE-2026-115560 notice. Recheck current PHP and vendor guidance before any real change. This teaching lab does not inspect or repair a site.

Read the primary PHP notice ↗

01 / BROWSER PRACTICE

Same evidence. Different conclusions.

Start with the first example. Read the fields, run the check, then switch to “The wrong runtime” and explain what changed.

Fictional scenario

The web version meets the original two release minima. The separate notice still needs evidence.

Inspect the fictional inventory

{
  "schema_version": 1,
  "source": "synthetic-teaching-inventory",
  "observed_at": "2026-10-23",
  "environment": "live-demo",
  "operator": "managed-host",
  "runtime": {
    "scope": "web",
    "version": "8.3.36",
    "service": "fpm",
    "evidence_date": "2026-10-23",
    "matches_environment": true,
    "workers_restarted": true
  },
  "vendor_backport": {
    "asserted": false,
    "reference": null,
    "scope": "unknown",
    "evidence_date": null,
    "matches_environment": null
  },
  "new_notice": {
    "upload_progress_disabled_at_startup": null,
    "workers_restarted": null,
    "no_runtime_handler_switch_reviewed": null,
    "scope": "unknown",
    "evidence_date": null,
    "matches_environment": null
  },
  "compromise_indicators": null,
  "backup": {
    "files_available": null,
    "database_available": null,
    "matched_pair": null,
    "isolated_restore_rehearsed": null
  }
}

All calculations happen in this browser. No target, upload or connection to your website is requested.

Choose a fictional scenario, then run the evidence check.

02 / OPTIONAL LOCAL PRACTICE

Your own copy. No server changes.

Download and extract the MIT-licensed kit into a new folder. Read README and SCHEMA first. Python 3.12.14 is the reference runtime; there are no third-party runtime packages.

Download source kit ↙File hashes Download Git bundle Read the instructions

The Git bundle is the same public source with a main branch and v1.0.0 tag. After downloading it, Git users can run git clone ./wordpress-recovery-companion-1.0.0.bundle wordpress-recovery-companion. No hosted GitHub repository is claimed.

Computer

On Windows, open the extracted folder in File Explorer, type powershell in its address bar and press Enter. On macOS/Linux, open Terminal in that folder. Paste one line at a time. The website cannot open a local terminal for you.

python3 scripts/generate_inventory.py --scenario fixed-web-new-notice-unknown --output practice-inventory.json
python3 scripts/triage_inventory.py --inventory practice-inventory.json --output practice-report.json
python3 scripts/triage_inventory.py --inventory practice-inventory.json --format markdown --output practice-report.md
python3 scripts/triage_inventory.py --inventory practice-inventory.json --format ticket --output host-message.txt
python3 scripts/rehearse_backup.py --output-dir practice-rehearsal
python3 -m unittest discover -s tests -v

Exit 0 means the local operation completed, not that a site is safe. Exit 2 means invalid input, a file problem or an existing output. Use a new empty practice folder for another run. The scripts refuse overwriting.

For a real minimal operator-entered record, use the local route in SCHEMA, keep files outside Git and retain confidential evidence in your authorized private system. Never put passwords, site dumps, backups or customer records in this lab or a public repository.

03 / READING ROUTE

Choose the role you have today.

Site owner

Chapters 1–4: find the operator, ask scoped questions and keep unknowns visible. Chapters 6–8 explain recovery and escalation. Chapter 12 joins the record.

Agency coordinator

Map each environment to an operator. Use the checklists for host replies, backup pairing, compatibility and incident questions. Avoid combining unrelated sites into one “fixed” status.

Server operator

Use the exact vendor update route, verify the running web workers, assess the separate notice, preserve the patched rollback boundary and record actual observations.

Explain it back

Which question does the version field answer? What evidence is still missing? Why can a patched site still need incident recovery?

04 / SOURCES & LIMITS

Keep the snapshot in context.

The book contains a dated source register, defensive procedures, fictional examples and AI-created text, code and diagrams reviewed against those sources. No live host, restore, exploit or security certification was performed. Software and advisories change; this companion is not a vulnerability feed.

Errata: support@qentra.tech. Send the edition, chapter and a fictional reproduction. Do not send credentials, identity documents or customer data.

All books & practice →