Home / Articles / Application behaviour policies / Versions / v1.2.0
Application behaviour policies: what changed in v1.2.0
From v1.1.0 (2026-10-22, 97ba9ddcc) to v1.2.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 5 changed in place, 70 unchanged. About 0 words added and 191 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot ay-grant.webp | images/ | What a remote code execution flaw does to the grant: before, an anonymousa visitor can requestrequests pages before, and submit a form; after, on an unpatched server, the same visitor runs commands as the application, with everything it can reach: its files, its database, its mail, its secrets, its network and the systems that trust it.after. | concept
16 unchanged paragraphs, under In short {#in-short}, The question in front of the offline sites {#question}, What the compromise map shows {#compromise}
!shot ay-layers.webp | images/ | From attempts to a named compromise, as of 20:50 UTC on 22 October: millions of attempts against sensors, honeypots and edges; three security vendors reporting exploitation without naming a victim; one named organisation saying it was attacked,October, with the attack stopped; and none saying php2shell wassources the wayPHP in.site Behindwatches it,behind 184 vault sources, 773 watched pages from 474 publishers in 57 countries, 3,444 news items scanned and 295 named sites probed every 30 minutes.it. | comparison
27 unchanged paragraphs, under Three readings of the silence {#silence}, Is this where everyone should be looking? {#watching}, The same method, a different subject {#method}…
!shot ay-three.webp | images/ | Three policies for an application: behaviour, what it can reachdecision and what it is for,workflow, with the gap and blast radius per row; decision, who accepts each row's blast radius and who decides to bring the site back; workflow, the order things happen in, from patching and mapping to cutting rows, naming signals, deciding and restoring.row. | concept
5 unchanged paragraphs, under A worked example {#example}
!shot ay-map.webp | images/ | An application behaviour policy for an invented council website on PHP: ten rows of reach, from serving pages and the contact form to writing its own code, the database, mail, outbound network, the internal network, cloud credentials, administrator sessions, backups and payment keys; for each, whether it is in the mandate, the blast radius, whether there is a way back,with the barrier today and the cut. | comparison
7 unchanged paragraphs, under Our own sites, as a measured contrast {#ours}, Bringing a site back {#bring-back}
!shot ay-back.webp | images/ | Bringing a site back, in order: patch;patch, map the reach;reach, cut the cheap rows;rows, name the signals;signals, thedecide, owner decides on the blast radius that remains; restore; andrestore, read the footprint, in the first hours and then weekly.footprint. | concept
13 unchanged paragraphs, under What is new, and what is not {#new}, What this does not claim {#limits}, Where this comes from {#sources}