Which Drupal versions are affected by the vulnerabilities in advisory PSA-2016-001? There is an PSA about the 2016-July-13 Security Advisory of several critical updates:


  View online: https://www.drupal.org/node/2764899
  
  
  Advisory ID: DRUPAL-PSA-2016-001
  Project: Drupal contributed modules
  Version: 7.x
  Date: 2016-July-12
  Security risk: 22/25 ( Highly Critical)
  AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All 1
  Vulnerability: Arbitrary PHP code execution
  
  
  DESCRIPTION
  
  There will be multiple releases of Drupal contributed modules on
  Wednesday July 13th 2016 16:00 UTC that will fix highly critical
  remote code execution vulnerabilities (risk scores up to 22/25 [2]).
  The Drupal Security Team urges you to reserve time for module updates
  at that time because exploits are expected to be developed within
  hours/days. Release announcements will appear at the standard
  announcement locations. [3]
  
  Drupal core is not affected. Not all sites will be affected. You
  should review the published advisories on July 13th 2016 to see if any
  modules you use are affected.


The advisory only mentions version 7.x as vulnerable, but I realized that I'm not entirely sure how I can interpret that. My interpretation is that Drupal 8.x should not be affected by these issues. But I'm really not sure about Drupal 6.x. 

Drupal 6 is no longer supported. Does that mean that this kind of advisory won't even mention if it is still vulnerable? Or can I interpret this one as only version 7 is affected?

Which versions exactly are potentially affected by this advisory?
The security team is intentionally a bit circumspect with these warnings. They either have to catch us all flat-footed or give potential attackers a heads up that something worth their time is coming. Currently they are siding with the latter method (and as much as I hated seeing that message today I agree with them). 

For the most part it will not be clear until they release the news what modules will be covered. There is already speculation in some circles, but there isn't likely anything to be done before the announcement. Clearly from their announcement multiple modules are effected, and likely at least one is something very common.

Depending on the number of sites you support you should block off enough time to do updates for all of them.

These advisories will no longer cover Drupal 6. There is no formal way to know if Drupal 6 is effected (there will probably twitter comments, blog posts, etc about it after the release of the updates). If D6 is effected the only solution may be to take them offline.