Home / Articles / Software is now a product / Versions / v1.1.0
Software is now a product: what changed in v1.1.0
From v1.0.0 (2026-10-25, 3b8ae9586) to v1.1.0 (2026-10-25, 9b4a89d1f), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 50 unchanged. About 0 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
1 unchanged paragraph
Summary: Lauren Zabierek shared a card on LinkedIn about the EU's new Product Liability Directive, 2024/2853: the 1985 directive never named software, and the new one makes it a product, subject to strict, no-fault liability that a EULA cannot waive, for products placed on the market after 9 December 2026. I asked under herthe post how it applies to SaaS, so I read the directive itself. Software is a product "irrespective of the mode of its supply", and the recitals name SaaS. Updates matter: a manufacturer cannot escape liability by saying the defect came later if it is due to software, an update, or a lack of updates needed to maintain safety, while the product is in its control; and an attacker's exploit does not reduce its liability. But the directive is narrower than it sounds. Only natural persons can claim, and only for death or injury, property not used only for work, or data destroyed or corrupted that is not used for work. A data leak is not on the list, and a company cannot claim for its own losses. Applied to php2shell, the PHP project is out of scope; a vendor or SaaS that leaves a known, fixed flaw unpatched and lets attackers wipe consumers' files is likely in. Patching does not bring an old product into scope, but a new one that is not patched has no defence. Here is what the articles say, and the questions they leave.
10 unchanged paragraphs, under In short {#in-short}, Why I read it {#why}
Lauren Zabierek shared a card on LinkedIn that summarises the new directive. Under herthe post I asked whether there was a mapping of how it applies to SaaS. Rather than wait, I read Directive (EU) 2024/2853 itself, articles and recitals, and tested it against the story we have been following on the PHP site. This is a briefing and a list of questions, from an engineer reading the text. It is not legal advice, and courts in 27 member states will decide what it means.
37 unchanged paragraphs, under What the articles say {#articles}, php2shell, under the new rules {#php}, Will it stop companies updating? {#incentives}…
• Lauren Zabierek's post is quoted from the card in herthe screenshot; the rest of the post needs a sign-in.
2 unchanged paragraphs, under Where this comes from {#sources}