Ask for patch evidence.

By Tyler Mayberry · Cirlet. Published October 22, 2026. This is a preparation worksheet; the worked examples are fictional.

“We updated it” leaves important questions unanswered. For a website advisory that may affect your agency, request a dated record of applicability, the installed fix and what was verified afterward. Your provider should establish the technical facts.

Send these questions.

1. Does the advisory affect a component you operate for our agency? Name the component and deployment.
2. Which vendor advisory and affected versions did you compare it with?
3. What version or mitigation is actually running now, and when was it applied?
4. What evidence supports that answer? A package/deployment record or provider confirmation may be appropriate; do not send secrets.
5. What service check was performed after the change? Is any residual action or maintenance window needed?
6. Who owns the next action, and when will the answer be reviewed?

Keep the states distinct.

Use “not affected, with evidence,” “fix verified,” “mitigation applied, further work needed” or “not yet established.” An unanswered question is not proof of compromise. A patch record alone does not establish whether earlier exploitation occurred.

A fictional handoff

The agency asks its hosted website provider whether a named component is affected. The provider confirms the deployed version and supplies a dated change record plus a post-change service check. The agency records the provider as owner. If the provider cannot establish the version, the status stays unknown; the agency does not invent a green result.

Use an actual advisory.

For the October 21 PHP example, read the dated advisory briefing and its evidence limits. The CISA advisory reported no observed exploitation at publication; a critical vulnerability is not evidence that your agency was attacked.

Reference: CISA’s October 21 PHP patching advisory. The question checklist is Cirlet’s provider-handoff worksheet.