best practices with posting serious customer facing announcements such as PHP2SHELL vulnerabilities

Hello Experts, 

I am interested in hearing how all of you are handling posting urgent updates such as the PHP2SHELL vulnerability. First you have an announcement and then you have a string of updates. 

In some cases what started as an announcement turns into a series or more complicated updates that you want to track (time/date stamps) and provide more detailed information to your customers.

Currently I am looking at a working document/resource and when we make updates also calling out via blog posts. 

Can you share how you are addressing this from a structural standpoint? 

Thank you, Sara