PHP versioning and security information

Hi, I'm trying to figure out if the version of php that I am running is secure against all known exploits and I am finding that task very difficult. I haven't been able to find a security page on either http://www.php.net/ or http://www.zend.com/ My questions are: - is php 4.2.3 vulnerable to any known security issues? - what is the meaning of php's versioning scheme? I see from the changelogs that features are added throughout the 4.x branches. I am used to schemes where 4.2.x would be feature frozen with just bu and security fixes being applied. - is the 4.3.x branch the only one that is being maintained? I do not relish moving my servers from 4.2.3 to 4.3.? since I have encountered enough problems already with the move from 4.0.6 to 4.2.3. Most of the problems were from sloppy coding that should never have worked but hey it did work with 4.0.6 and does not work with 4.2.3. If the code were all mine I wouldn't be so concerned but I don't want to be telling clients every 6-12 months, that we're upgrading their php version and that things might break for them. Is there an official policy as to how long a branch is supported? PHP 4.2.0 is just over a year old, php 4.2.3 about 6 months old ... Thanks, -- Fraser Campbell <fraser@wehave.net> http://www.wehave.net/ Brampton, Ontario, Canada Debian GNU/Linux