The PHP vuln advisory is a textbook example of how to do it right. Huge props to them!

https://www.php.net/archive/2026.php#2026-10-21-5

Specifically, it details:

- what went wrong

- what is and isn't known about who is affected (e.g. for the OOM one, Apache mod_php definitely is, FPM may be but isn't known)

- what mitigations are available if patching/updating is not possible, and whether they are partial or full

- sufficient information to roll your own further mitigations if needed (e.g. I think you could setup policies to terminate the process on OOM rather than letting it continue to the vulnerable OOM handler)