So You Received a Security Report. Now What?

A guide for PHP project maintainers, from the PHP Foundation Ecosystem Security Team You maintain a PHP project. Someone (maybe Volker from the PHP Foundation, maybe an independent researcher) has just told you that your project may have a security vulnerability. You might be feeling overwhelmed, or unsure whether you can trust the report, or simply unsure what the correct next step is. Take a breath. Nothing bad has happened. A report is not a breach. It is a head start: someone is telling you…