A downstream package is a build of software prepared by a distributor, hosting provider, or other vendor from an upstream project. It may be released later than the upstream version, and its version number may not match the latest upstream release. Vendors can also backport security fixes to older builds, so version numbers alone do not always show whether a package is patched.
This matters during security updates because organizations may depend on a vendor to deliver fixes for software they do not install directly. For a vulnerable runtime such as PHP, defenders should identify who supplies each build and check that provider’s security notices or package status. Confirm the actual runtime serving requests is fixed; updating an application or seeing an older version string is not enough to establish its security state.