A small website also has the responsibility of delivering continuous maintenance.
On October 21, PHP officially released a security bulletin involving two serious vulnerabilities, and provided repair versions such as 8.4.27. ChinaOPC completed the online runtime upgrade on October 23, and checked the records to confirm that the actual Web process uses 8.4.27. This is a maintenance work performed and is not a simulated customer project.
AI assists in data verification, script preparation and result checking; maintenance is still based on official announcements, actual server status and reviewable output. This article only discusses working methods and does not disclose login information, business configurations or steps that can be used for attacks, nor does it provide automatic upgrade commands that apply to all websites.
Confirm the version, to confirm the program that actually handles web page requests
A common misjudgment is: when the terminal displays a new version, it is assumed that the web page has also been upgraded. Command line programs, web service configurations, and old processes that are still running may point to different locations. In addition to checking the default command, ChinaOPC also checks the running version through private FastCGI requests and checks the actual program paths of all related work processes.
For outsourcing or collaborative maintenance, you can ask the other party to write "what location was checked" into the delivery record. Only the installation receipt does not mean that the switch has taken effect; just taking a screenshot of the version cannot replace the actual service status.
The backup must be able to correspond to the state before the upgrade.
Before this switch, the website data, operating configuration and original service definitions were retained, and then the website source code list was checked. The goal is to understand where the change came from and what part can be recovered if the check fails. The backup contains sensitive content and remains in a restricted location and has not been uploaded to public web directories.
Small teams can list the backup time, corresponding version, completion mark and recovery person as fixed maintenance items. The existence of the backup file and the fact that it has been verified to be recoverable are two different conclusions; this article only describes the inspection records that were actually completed at that time, and does not write down the recovery drill that was not performed this time.
After the page is normal, check the business dependencies
This upgrade checked the database connection, test session continuous reading and writing, normal image uploading and image processing, and compared the original extensions and configurations. The public entrance also checks the homepage, columns, parks, maps, backend login and submission pages. Test using independent sessions and non-public files, clean up and review materials after completion.
These checks correspond to the real dependencies of the website and have clear boundaries: no test articles are published or deleted in the production backend, and no attack loads are used to stress test the line. A normal login page does not mean that all management processes have been accepted, and limited inspections cannot prove that the server has never been invaded.
Delivery also includes how to update next time
Since the system software source did not provide a repair package at that time, ChinaOPC used the official source code to build an independent runtime and checked the download hash. This solves the need for immediate upgrades, but also brings subsequent maintenance responsibilities: only updating system packages, not necessarily the runtime of the actual service.
Therefore, delivery records should also indicate the location of active programs and configurations, update methods, use of older versions, and recovery limitations. For those who plan to rely on AI to maintain their own business systems, what is really worth reusing is this kind of evidence and responsibility arrangement. One smooth upgrade cannot be understood as long-term unmaintenance.
Extended reading: How to connect project delivery records; Acceptance and costs of continuing services.