{
 "about": "The standards, laws and frameworks the GRC desk maps php2shell's risks to: each with its publisher, the version mapped, the official text, and the clauses or controls this site cites. Control titles are the desk's short paraphrase, not the standard's text; follow the link for the wording. Kept by grc@php.newsroom. A risk in data/grc.json may cite only a control listed here: the build refuses any other.",
 "kept_by": "grc@php.newsroom",
 "families": [
  {"id": "law", "name": "Law and regulation", "about": "Binding on the organisations in scope: a gap here is a legal exposure, not a choice."},
  {"id": "standard", "name": "Management-system standards", "about": "Certifiable standards an organisation chooses and is audited against."},
  {"id": "framework", "name": "Frameworks and control catalogues", "about": "Voluntary catalogues of outcomes and controls; the vocabulary auditors and boards use."},
  {"id": "practice", "name": "Practice and technique", "about": "How the work is done and how attackers behave: disclosure, patching, testing, techniques."}
 ],
 "frameworks": [
  {
   "id": "gdpr", "family": "law", "name": "GDPR", "full": "General Data Protection Regulation, Regulation (EU) 2016/679",
   "publisher": "European Union", "version": "2016, in force 25 May 2018", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
   "why": "A PHP application that executes an attacker's code exposes the personal data it holds; whoever controls that data answers for its security and for notifying a breach.",
   "controls": [
    {"id": "Art.5(1)(f)", "title": "Integrity and confidentiality: personal data processed with appropriate security"},
    {"id": "Art.24", "title": "Responsibility of the controller: measures appropriate to the risk"},
    {"id": "Art.28", "title": "Processors: the controller uses only processors that give sufficient guarantees"},
    {"id": "Art.32", "title": "Security of processing, including a process for regularly testing and evaluating it"},
    {"id": "Art.33", "title": "Notifying a personal data breach to the supervisory authority within 72 hours"},
    {"id": "Art.34", "title": "Communicating a high-risk personal data breach to the people affected"}
   ]
  },
  {
   "id": "nis2", "family": "law", "name": "NIS2", "full": "Directive (EU) 2022/2555 on a high common level of cybersecurity across the Union",
   "publisher": "European Union", "version": "2022, transposition deadline 17 October 2024", "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
   "why": "Essential and important entities (energy, health, digital infrastructure, public administration and more) must manage vulnerabilities, handle incidents and report significant ones; management bodies answer for it personally.",
   "controls": [
    {"id": "Art.12", "title": "Coordinated vulnerability disclosure and the European vulnerability database"},
    {"id": "Art.20", "title": "Governance: management bodies approve and oversee the risk-management measures and can be held liable"},
    {"id": "Art.21(2)(a)", "title": "Policies on risk analysis and information system security"},
    {"id": "Art.21(2)(b)", "title": "Incident handling"},
    {"id": "Art.21(2)(c)", "title": "Business continuity, backup management, disaster recovery and crisis management"},
    {"id": "Art.21(2)(d)", "title": "Supply chain security, including the security of each direct supplier"},
    {"id": "Art.21(2)(e)", "title": "Security in acquisition, development and maintenance, including vulnerability handling and disclosure"},
    {"id": "Art.23", "title": "Reporting significant incidents: early warning in 24 hours, notification in 72 hours, final report in a month"}
   ]
  },
  {
   "id": "cra", "family": "law", "name": "Cyber Resilience Act", "full": "Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements",
   "publisher": "European Union", "version": "2024; reporting obligations apply from 11 September 2026", "url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
   "why": "php2shell is among the first critical flaws in a ubiquitous open-source component since the Act's reporting duty began: a manufacturer whose product ships PHP must handle the flaw and report an actively exploited one; the PHP project is the kind of open-source steward the Act treats lightly.",
   "controls": [
    {"id": "Art.13", "title": "Obligations of manufacturers, including due diligence on integrated third-party and open-source components"},
    {"id": "Art.14", "title": "Reporting an actively exploited vulnerability: early warning within 24 hours to the CSIRT and ENISA"},
    {"id": "Art.24", "title": "Obligations of open-source software stewards"},
    {"id": "AnnexI.II", "title": "Vulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosure"}
   ]
  },
  {
   "id": "dora", "family": "law", "name": "DORA", "full": "Digital Operational Resilience Act, Regulation (EU) 2022/2554",
   "publisher": "European Union", "version": "2022, applies from 17 January 2025", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
   "why": "Banks, insurers and other financial entities running PHP, or relying on an ICT provider that does, must identify, protect, detect, respond and report under one regime, and manage the provider as a third-party risk.",
   "controls": [
    {"id": "Art.8", "title": "Identification of ICT assets, their dependencies and the risks to them"},
    {"id": "Art.9", "title": "Protection and prevention, including patches and updates"},
    {"id": "Art.10", "title": "Detection of anomalous activities"},
    {"id": "Art.11", "title": "Response and recovery, including ICT business continuity"},
    {"id": "Art.19", "title": "Reporting major ICT-related incidents"},
    {"id": "Art.28", "title": "Managing ICT third-party risk"}
   ]
  },
  {
   "id": "euaiact", "family": "law", "name": "EU AI Act", "full": "Artificial Intelligence Act, Regulation (EU) 2024/1689",
   "publisher": "European Union", "version": "2024; general-purpose model obligations apply from 2 August 2025", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
   "why": "Frontier models found these flaws, and the same capability in other hands finds the next ones: the Act asks providers of general-purpose models with systemic risk to assess and mitigate exactly that. This newsroom's own agents are AI systems working under a mandate.",
   "controls": [
    {"id": "Art.9", "title": "Risk management system for high-risk AI systems"},
    {"id": "Art.15", "title": "Accuracy, robustness and cybersecurity of high-risk AI systems"},
    {"id": "Art.50", "title": "Transparency: content generated by AI is disclosed as such"},
    {"id": "Art.55", "title": "Providers of general-purpose models with systemic risk: evaluate, mitigate systemic risks, report serious incidents, protect cybersecurity"}
   ]
  },
  {
   "id": "iso27001", "family": "standard", "name": "ISO/IEC 27001", "full": "ISO/IEC 27001:2022 Information security management systems, with the Annex A controls of ISO/IEC 27002:2022",
   "publisher": "ISO and IEC", "version": "2022", "url": "https://www.iso.org/standard/27001",
   "why": "The management system most organisations in this story are certified to: risk assessment and treatment in clauses 6 and 8, and the controls an auditor will ask about after php2shell.",
   "controls": [
    {"id": "6.1.2", "title": "Information security risk assessment: identify risks and their owners"},
    {"id": "6.1.3", "title": "Information security risk treatment, and the statement of applicability"},
    {"id": "A.5.5", "title": "Contact with authorities"},
    {"id": "A.5.6", "title": "Contact with special interest groups"},
    {"id": "A.5.7", "title": "Threat intelligence"},
    {"id": "A.5.14", "title": "Information transfer, including under agreed classification"},
    {"id": "A.5.19", "title": "Information security in supplier relationships"},
    {"id": "A.5.21", "title": "Managing information security in the ICT supply chain"},
    {"id": "A.5.23", "title": "Information security for use of cloud services"},
    {"id": "A.5.24", "title": "Incident management planning and preparation"},
    {"id": "A.5.26", "title": "Response to information security incidents"},
    {"id": "A.5.29", "title": "Information security during disruption"},
    {"id": "A.5.30", "title": "ICT readiness for business continuity"},
    {"id": "A.8.8", "title": "Management of technical vulnerabilities"},
    {"id": "A.8.9", "title": "Configuration management"},
    {"id": "A.8.16", "title": "Monitoring activities"},
    {"id": "A.8.20", "title": "Network security"},
    {"id": "A.8.25", "title": "Secure development life cycle"},
    {"id": "A.8.28", "title": "Secure coding"},
    {"id": "A.8.29", "title": "Security testing in development and acceptance"},
    {"id": "A.8.32", "title": "Change management"}
   ]
  },
  {
   "id": "iso42001", "family": "standard", "name": "ISO/IEC 42001", "full": "ISO/IEC 42001:2023 Artificial intelligence management system",
   "publisher": "ISO and IEC", "version": "2023", "url": "https://www.iso.org/standard/42001",
   "why": "For the organisations that run AI to find flaws or to write and check news, as this site does: the AI risk assessment and its treatment.",
   "controls": [
    {"id": "6.1.2", "title": "AI risk assessment"},
    {"id": "6.1.3", "title": "AI risk treatment"},
    {"id": "8.4", "title": "AI system impact assessment"}
   ]
  },
  {
   "id": "iso29147", "family": "practice", "name": "ISO/IEC 29147 and 30111", "full": "ISO/IEC 29147:2018 Vulnerability disclosure and ISO/IEC 30111:2019 Vulnerability handling processes",
   "publisher": "ISO and IEC", "version": "2018 and 2019", "url": "https://www.iso.org/standard/72311.html",
   "why": "The standards for exactly what broke on 20 and 21 October: receiving reports from several finders, keeping an embargo, coordinating a release and publishing the advisory.",
   "controls": [
    {"id": "29147:receipt", "title": "Receiving vulnerability reports and acknowledging the finder"},
    {"id": "29147:coordination", "title": "Coordinating disclosure with other vendors and parties under embargo"},
    {"id": "29147:advisory", "title": "Publishing the advisory: affected versions, remediation, credit"},
    {"id": "30111:handling", "title": "Investigating, remediating and releasing the fix, and learning from it"}
   ]
  },
  {
   "id": "nistcsf", "family": "framework", "name": "NIST CSF 2.0", "full": "NIST Cybersecurity Framework 2.0 (CSWP 29)",
   "publisher": "US National Institute of Standards and Technology", "version": "2.0, February 2024", "url": "https://doi.org/10.6028/NIST.CSWP.29",
   "why": "The outcome language boards and regulators on both sides of the Atlantic now use; GOVERN makes supply chain and risk ownership a first-class function.",
   "controls": [
    {"id": "GV.RM-01", "title": "Risk management objectives are established and agreed by stakeholders"},
    {"id": "GV.RR-01", "title": "Leadership is responsible and accountable for cybersecurity risk"},
    {"id": "GV.SC-05", "title": "Supply chain requirements are established and integrated into contracts"},
    {"id": "GV.SC-07", "title": "Supplier risks are understood, recorded, prioritised, assessed, responded to and monitored"},
    {"id": "ID.AM-02", "title": "Inventories of software, services and systems are maintained"},
    {"id": "ID.RA-01", "title": "Vulnerabilities in assets are identified, validated and recorded"},
    {"id": "ID.RA-02", "title": "Threat intelligence is received from information sharing forums and sources"},
    {"id": "ID.RA-08", "title": "Processes for receiving, analysing and responding to vulnerability disclosures are established"},
    {"id": "PR.PS-02", "title": "Software is maintained, replaced and removed commensurate with risk"},
    {"id": "DE.CM-01", "title": "Networks and network services are monitored to find potentially adverse events"},
    {"id": "RS.MA-01", "title": "The incident response plan is executed with relevant third parties once an incident is declared"},
    {"id": "RS.CO-03", "title": "Information is shared with designated internal and external stakeholders"},
    {"id": "RC.RP-01", "title": "The recovery portion of the incident response plan is executed"}
   ]
  },
  {
   "id": "nist80053", "family": "framework", "name": "NIST SP 800-53", "full": "NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations",
   "publisher": "US National Institute of Standards and Technology", "version": "Rev. 5", "url": "https://doi.org/10.6028/NIST.SP.800-53r5",
   "why": "The control catalogue behind US federal systems, which CISA and the NSA told to update or go offline.",
   "controls": [
    {"id": "RA-3", "title": "Risk assessment"},
    {"id": "RA-5", "title": "Vulnerability monitoring and scanning"},
    {"id": "SI-2", "title": "Flaw remediation"},
    {"id": "SI-4", "title": "System monitoring"},
    {"id": "SA-22", "title": "Unsupported system components"},
    {"id": "CM-8", "title": "System component inventory"},
    {"id": "SC-7", "title": "Boundary protection"},
    {"id": "CP-2", "title": "Contingency plan"},
    {"id": "IR-4", "title": "Incident handling"},
    {"id": "IR-6", "title": "Incident reporting"},
    {"id": "SR-3", "title": "Supply chain controls and processes"},
    {"id": "PM-15", "title": "Security and privacy groups and associations"}
   ]
  },
  {
   "id": "ssdf", "family": "framework", "name": "NIST SSDF", "full": "NIST SP 800-218 Secure Software Development Framework 1.1",
   "publisher": "US National Institute of Standards and Technology", "version": "1.1, February 2022", "url": "https://doi.org/10.6028/NIST.SP.800-218",
   "why": "What a software producer, the PHP project included, is expected to do when a vulnerability is reported: confirm it, fix it, and find the class of bug behind it.",
   "controls": [
    {"id": "PW.7", "title": "Review and analyse human-readable code to find vulnerabilities"},
    {"id": "PW.8", "title": "Test executable code to find vulnerabilities"},
    {"id": "RV.1", "title": "Identify and confirm vulnerabilities on an ongoing basis"},
    {"id": "RV.2", "title": "Assess, prioritise and remediate vulnerabilities"},
    {"id": "RV.3", "title": "Analyse vulnerabilities to identify their root causes"}
   ]
  },
  {
   "id": "nistairmf", "family": "framework", "name": "NIST AI RMF", "full": "NIST AI Risk Management Framework 1.0 (AI 100-1)",
   "publisher": "US National Institute of Standards and Technology", "version": "1.0, January 2023", "url": "https://doi.org/10.6028/NIST.AI.100-1",
   "why": "For AI used to find flaws and AI used to report on them: who governs it, what it can reach, and how to switch it off.",
   "controls": [
    {"id": "GOVERN-1.1", "title": "Legal and regulatory requirements involving AI are understood, managed and documented"},
    {"id": "GOVERN-6.1", "title": "Policies address AI risks from third-party entities"},
    {"id": "MEASURE-2.7", "title": "AI system security and resilience are evaluated and documented"},
    {"id": "MANAGE-2.4", "title": "Mechanisms exist, with assigned responsibility, to supersede, disengage or deactivate an AI system"}
   ]
  },
  {
   "id": "cis", "family": "framework", "name": "CIS Controls", "full": "CIS Critical Security Controls v8.1",
   "publisher": "Center for Internet Security", "version": "8.1", "url": "https://www.cisecurity.org/controls/v8-1",
   "why": "The prioritised list smaller organisations, councils and schools among them, actually work from.",
   "controls": [
    {"id": "2.2", "title": "Ensure authorised software is currently supported"},
    {"id": "7.1", "title": "Establish and maintain a vulnerability management process"},
    {"id": "7.4", "title": "Perform automated application patch management"},
    {"id": "7.7", "title": "Remediate detected vulnerabilities"},
    {"id": "13.10", "title": "Perform application layer filtering"},
    {"id": "16.4", "title": "Establish and manage an inventory of third-party software components"},
    {"id": "17.4", "title": "Establish and maintain an incident response process"}
   ]
  },
  {
   "id": "pcidss", "family": "standard", "name": "PCI DSS", "full": "Payment Card Industry Data Security Standard v4.0.1",
   "publisher": "PCI Security Standards Council", "version": "4.0.1", "url": "https://www.pcisecuritystandards.org/document_library/",
   "why": "Online shops were among the sites taken offline; most run PHP (Magento, WooCommerce) and take cards.",
   "controls": [
    {"id": "6.3.1", "title": "Security vulnerabilities are identified, risk-ranked and managed"},
    {"id": "6.3.3", "title": "Critical security patches are installed within one month of release"},
    {"id": "6.4.2", "title": "An automated technical solution that detects and prevents web attacks protects public-facing web applications"},
    {"id": "12.10.1", "title": "An incident response plan exists and is ready to be activated"}
   ]
  },
  {
   "id": "soc2", "family": "framework", "name": "SOC 2", "full": "AICPA Trust Services Criteria (2017, revised points of focus 2022)",
   "publisher": "AICPA", "version": "TSC 2017, revised 2022", "url": "https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022",
   "why": "The report SaaS and hosting providers hand their customers; the criteria they will be asked about in the next audit window.",
   "controls": [
    {"id": "CC7.1", "title": "Detection and monitoring procedures identify new vulnerabilities and configuration changes"},
    {"id": "CC7.3", "title": "Security events are evaluated to decide whether they are incidents"},
    {"id": "CC7.4", "title": "Identified incidents are responded to under a defined programme"},
    {"id": "CC8.1", "title": "Changes, including emergency changes, are authorised, tested and approved"},
    {"id": "CC9.2", "title": "Risks from vendors and business partners are assessed and managed"}
   ]
  },
  {
   "id": "cyberessentials", "family": "framework", "name": "Cyber Essentials", "full": "UK Cyber Essentials: Requirements for IT infrastructure",
   "publisher": "UK NCSC and IASME", "version": "v3.2 (Willow), 2025", "url": "https://www.ncsc.gov.uk/cyberessentials/overview",
   "why": "The baseline UK councils and public-sector suppliers certify against; several of the councils in this story went offline.",
   "controls": [
    {"id": "SUM", "title": "Security update management: high and critical updates within 14 days of release; unsupported software removed"},
    {"id": "FW", "title": "Firewalls: boundary protection for internet-facing services"}
   ]
  },
  {
   "id": "kev", "family": "practice", "name": "CISA KEV and BOD 22-01", "full": "CISA Known Exploited Vulnerabilities catalog and Binding Operational Directive 22-01",
   "publisher": "US CISA", "version": "BOD 22-01, November 2021", "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities",
   "why": "The public test of 'exploited': a CVE enters the catalogue on evidence of exploitation in the wild, and US federal agencies must then remediate by a due date. php2shell is not in it as of the vault's last capture.",
   "controls": [
    {"id": "BOD22-01", "title": "Federal agencies remediate catalogued vulnerabilities by the due date set"},
    {"id": "KEV-entry", "title": "A CVE enters the catalogue on reliable evidence of active exploitation"}
   ]
  },
  {
   "id": "tlp", "family": "practice", "name": "FIRST TLP 2.0", "full": "FIRST Traffic Light Protocol 2.0",
   "publisher": "FIRST", "version": "2.0, August 2022", "url": "https://www.first.org/tlp/",
   "why": "The labels for sharing under embargo: the mitigation advice given early to critical-infrastructure providers, and its possible leak, is a TLP question.",
   "controls": [
    {"id": "TLP:AMBER", "title": "Limited disclosure: recipients share only within their organisation and its clients on a need-to-know basis"},
    {"id": "TLP:AMBER+STRICT", "title": "Limited disclosure: recipients share only within their organisation"}
   ]
  },
  {
   "id": "attack", "family": "practice", "name": "MITRE ATT&CK", "full": "MITRE ATT&CK Enterprise",
   "publisher": "MITRE", "version": "Enterprise v17", "url": "https://attack.mitre.org/",
   "why": "How the threat is described in detection terms: scanning for the flaw first, then exploiting a public-facing application.",
   "controls": [
    {"id": "T1595.002", "title": "Active scanning: vulnerability scanning"},
    {"id": "T1190", "title": "Exploit public-facing application"}
   ]
  },
  {
   "id": "owasp", "family": "practice", "name": "OWASP Top 10s", "full": "OWASP Top 10 (2021 and 2025) and OWASP Top 10 for LLM Applications (2025)",
   "publisher": "OWASP Foundation", "version": "2021, 2025", "url": "https://owasp.org/www-project-top-ten/",
   "why": "A06 is php2shell for everyone downstream of PHP; the LLM list is the risk register for this newsroom's own agents, which read the open web and hold publishing rights.",
   "controls": [
    {"id": "A06:2021", "title": "Vulnerable and outdated components"},
    {"id": "A03:2025", "title": "Software supply chain failures"},
    {"id": "LLM01:2025", "title": "Prompt injection"},
    {"id": "LLM02:2025", "title": "Sensitive information disclosure"},
    {"id": "LLM06:2025", "title": "Excessive agency"},
    {"id": "LLM09:2025", "title": "Misinformation"}
   ]
  }
 ]
}