{
 "site": "php.oct.2026.newsroom.sgit.ai",
 "version": "0.8.0",
 "kept_by": "grc@php.newsroom",
 "as_of": "2026-10-22",
 "verbs": [
  {
   "verb": "part_of",
   "inverse": "has_part"
  },
  {
   "verb": "arises_from",
   "inverse": "gives_rise_to"
  },
  {
   "verb": "backed_by",
   "inverse": "evidences"
  },
  {
   "verb": "fixed_by",
   "inverse": "fixes"
  },
  {
   "verb": "realised_in",
   "inverse": "realises"
  },
  {
   "verb": "located_in",
   "inverse": "location_of"
  },
  {
   "verb": "protected_by",
   "inverse": "protects"
  },
  {
   "verb": "governed_by",
   "inverse": "governs"
  },
  {
   "verb": "concerns",
   "inverse": "concerned_in"
  },
  {
   "verb": "told_in",
   "inverse": "tells"
  },
  {
   "verb": "tracked_by",
   "inverse": "tracks"
  },
  {
   "verb": "briefed_by",
   "inverse": "briefs"
  },
  {
   "verb": "cites",
   "inverse": "cited_by"
  },
  {
   "verb": "shown_on",
   "inverse": "shows"
  },
  {
   "verb": "owned_by",
   "inverse": "owns"
  },
  {
   "verb": "borne_by",
   "inverse": "bears"
  },
  {
   "verb": "treated_by",
   "inverse": "treats"
  },
  {
   "verb": "raised_by",
   "inverse": "raises"
  },
  {
   "verb": "informed_by",
   "inverse": "informs"
  },
  {
   "verb": "regulated_by",
   "inverse": "regulates"
  }
 ],
 "note": "Every edge is a verb with its inverse named. A risk arises from a weakness, which arises from a vulnerability, which is fixed by a remediation, realised in code; the risk is backed by claims that cite sources, owned, borne and treated by stakeholders, governed by controls, told in stories and tracked by team members.",
 "nodes": [
  {
   "id": "stakeholder:world",
   "kind": "stakeholder",
   "label": "Everyone with PHP in the path",
   "href": "grc/stakeholders/world/index.html"
  },
  {
   "id": "stakeholder:php-project",
   "kind": "stakeholder",
   "label": "The PHP project",
   "href": "grc/stakeholders/php-project/index.html"
  },
  {
   "id": "stakeholder:php-security-team",
   "kind": "stakeholder",
   "label": "The PHP security team",
   "href": "grc/stakeholders/php-security-team/index.html"
  },
  {
   "id": "stakeholder:php-fix-authors",
   "kind": "stakeholder",
   "label": "The fix authors",
   "href": "grc/stakeholders/php-fix-authors/index.html"
  },
  {
   "id": "stakeholder:php-foundation",
   "kind": "stakeholder",
   "label": "The PHP Foundation",
   "href": "grc/stakeholders/php-foundation/index.html"
  },
  {
   "id": "stakeholder:finders",
   "kind": "stakeholder",
   "label": "The finders",
   "href": "grc/stakeholders/finders/index.html"
  },
  {
   "id": "stakeholder:calif",
   "kind": "stakeholder",
   "label": "Calif",
   "href": "grc/stakeholders/calif/index.html"
  },
  {
   "id": "stakeholder:openai",
   "kind": "stakeholder",
   "label": "OpenAI (Patch the Planet)",
   "href": "grc/stakeholders/openai/index.html"
  },
  {
   "id": "stakeholder:wiz",
   "kind": "stakeholder",
   "label": "Wiz Research",
   "href": "grc/stakeholders/wiz/index.html"
  },
  {
   "id": "stakeholder:quarkslab",
   "kind": "stakeholder",
   "label": "Quarkslab and OSTIF",
   "href": "grc/stakeholders/quarkslab/index.html"
  },
  {
   "id": "stakeholder:distributors",
   "kind": "stakeholder",
   "label": "Distributors and packagers",
   "href": "grc/stakeholders/distributors/index.html"
  },
  {
   "id": "stakeholder:chainguard",
   "kind": "stakeholder",
   "label": "Chainguard",
   "href": "grc/stakeholders/chainguard/index.html"
  },
  {
   "id": "stakeholder:distros",
   "kind": "stakeholder",
   "label": "Linux distributions and image builders",
   "href": "grc/stakeholders/distros/index.html"
  },
  {
   "id": "stakeholder:panels",
   "kind": "stakeholder",
   "label": "Hosting panels and paid long-term support",
   "href": "grc/stakeholders/panels/index.html"
  },
  {
   "id": "stakeholder:app-vendors",
   "kind": "stakeholder",
   "label": "Software built on PHP",
   "href": "grc/stakeholders/app-vendors/index.html"
  },
  {
   "id": "stakeholder:inventory-suppliers",
   "kind": "stakeholder",
   "label": "Suppliers in the NCSC-NL inventory",
   "href": "grc/stakeholders/inventory-suppliers/index.html"
  },
  {
   "id": "stakeholder:oss-apps",
   "kind": "stakeholder",
   "label": "Open-source PHP applications",
   "href": "grc/stakeholders/oss-apps/index.html"
  },
  {
   "id": "stakeholder:hosting",
   "kind": "stakeholder",
   "label": "Hosting and cloud providers",
   "href": "grc/stakeholders/hosting/index.html"
  },
  {
   "id": "stakeholder:managed-hosts",
   "kind": "stakeholder",
   "label": "Managed PHP platforms",
   "href": "grc/stakeholders/managed-hosts/index.html"
  },
  {
   "id": "stakeholder:shared-hosts",
   "kind": "stakeholder",
   "label": "Shared and self-service hosting",
   "href": "grc/stakeholders/shared-hosts/index.html"
  },
  {
   "id": "stakeholder:edge",
   "kind": "stakeholder",
   "label": "Edge, WAF and detection vendors",
   "href": "grc/stakeholders/edge/index.html"
  },
  {
   "id": "stakeholder:waf-vendors",
   "kind": "stakeholder",
   "label": "WAF vendors",
   "href": "grc/stakeholders/waf-vendors/index.html"
  },
  {
   "id": "stakeholder:threat-intel",
   "kind": "stakeholder",
   "label": "Threat intelligence and detection",
   "href": "grc/stakeholders/threat-intel/index.html"
  },
  {
   "id": "stakeholder:agencies",
   "kind": "stakeholder",
   "label": "Agencies and CERTs",
   "href": "grc/stakeholders/agencies/index.html"
  },
  {
   "id": "stakeholder:us-agencies",
   "kind": "stakeholder",
   "label": "US: CISA and the NSA",
   "href": "grc/stakeholders/us-agencies/index.html"
  },
  {
   "id": "stakeholder:eu-agencies",
   "kind": "stakeholder",
   "label": "EU and member-state CERTs",
   "href": "grc/stakeholders/eu-agencies/index.html"
  },
  {
   "id": "stakeholder:uk-ncsc",
   "kind": "stakeholder",
   "label": "UK NCSC",
   "href": "grc/stakeholders/uk-ncsc/index.html"
  },
  {
   "id": "stakeholder:operators",
   "kind": "stakeholder",
   "label": "Organisations running PHP",
   "href": "grc/stakeholders/operators/index.html"
  },
  {
   "id": "stakeholder:public-sector",
   "kind": "stakeholder",
   "label": "Governments and public services",
   "href": "grc/stakeholders/public-sector/index.html"
  },
  {
   "id": "stakeholder:councils",
   "kind": "stakeholder",
   "label": "Local councils",
   "href": "grc/stakeholders/councils/index.html"
  },
  {
   "id": "stakeholder:national-gov",
   "kind": "stakeholder",
   "label": "National governments",
   "href": "grc/stakeholders/national-gov/index.html"
  },
  {
   "id": "stakeholder:critical-infra",
   "kind": "stakeholder",
   "label": "Critical infrastructure providers",
   "href": "grc/stakeholders/critical-infra/index.html"
  },
  {
   "id": "stakeholder:commerce",
   "kind": "stakeholder",
   "label": "Online shops and payments",
   "href": "grc/stakeholders/commerce/index.html"
  },
  {
   "id": "stakeholder:finance",
   "kind": "stakeholder",
   "label": "Banks, insurers and financial entities",
   "href": "grc/stakeholders/finance/index.html"
  },
  {
   "id": "stakeholder:non-profits",
   "kind": "stakeholder",
   "label": "Wikis, universities and non-profits",
   "href": "grc/stakeholders/non-profits/index.html"
  },
  {
   "id": "stakeholder:org-roles",
   "kind": "stakeholder",
   "label": "Inside any one organisation",
   "href": "grc/stakeholders/org-roles/index.html"
  },
  {
   "id": "stakeholder:board",
   "kind": "role",
   "label": "Board and executives",
   "href": "grc/stakeholders/board/index.html"
  },
  {
   "id": "briefing:board",
   "kind": "briefing",
   "label": "Board member or executive",
   "href": "briefings/board/index.html"
  },
  {
   "id": "stakeholder:ciso",
   "kind": "role",
   "label": "CISO",
   "href": "grc/stakeholders/ciso/index.html"
  },
  {
   "id": "briefing:ciso",
   "kind": "briefing",
   "label": "CISO",
   "href": "briefings/ciso/index.html"
  },
  {
   "id": "stakeholder:cto",
   "kind": "role",
   "label": "CTO",
   "href": "grc/stakeholders/cto/index.html"
  },
  {
   "id": "briefing:cto",
   "kind": "briefing",
   "label": "CTO",
   "href": "briefings/cto/index.html"
  },
  {
   "id": "stakeholder:cfo",
   "kind": "role",
   "label": "CFO",
   "href": "grc/stakeholders/cfo/index.html"
  },
  {
   "id": "briefing:cfo",
   "kind": "briefing",
   "label": "CFO",
   "href": "briefings/cfo/index.html"
  },
  {
   "id": "stakeholder:security-lead",
   "kind": "role",
   "label": "Security lead and AppSec",
   "href": "grc/stakeholders/security-lead/index.html"
  },
  {
   "id": "briefing:security",
   "kind": "briefing",
   "label": "Security lead",
   "href": "briefings/security/index.html"
  },
  {
   "id": "stakeholder:engineers",
   "kind": "role",
   "label": "Platform engineers and developers",
   "href": "grc/stakeholders/engineers/index.html"
  },
  {
   "id": "briefing:engineer",
   "kind": "briefing",
   "label": "PHP or platform engineer",
   "href": "briefings/engineer/index.html"
  },
  {
   "id": "stakeholder:site-owner",
   "kind": "role",
   "label": "Website owner",
   "href": "grc/stakeholders/site-owner/index.html"
  },
  {
   "id": "briefing:site-owner",
   "kind": "briefing",
   "label": "Website owner",
   "href": "briefings/site-owner/index.html"
  },
  {
   "id": "stakeholder:comms",
   "kind": "role",
   "label": "Communications team",
   "href": "grc/stakeholders/comms/index.html"
  },
  {
   "id": "briefing:comms",
   "kind": "briefing",
   "label": "Media and communications team",
   "href": "briefings/comms/index.html"
  },
  {
   "id": "stakeholder:dpo",
   "kind": "role",
   "label": "Data protection officer",
   "href": "grc/stakeholders/dpo/index.html"
  },
  {
   "id": "briefing:dpo",
   "kind": "briefing",
   "label": "Data protection officer",
   "href": "briefings/dpo/index.html"
  },
  {
   "id": "stakeholder:people",
   "kind": "stakeholder",
   "label": "People who use PHP services",
   "href": "grc/stakeholders/people/index.html"
  },
  {
   "id": "stakeholder:data-subjects",
   "kind": "stakeholder",
   "label": "People whose data is held in PHP applications",
   "href": "grc/stakeholders/data-subjects/index.html"
  },
  {
   "id": "stakeholder:service-users",
   "kind": "stakeholder",
   "label": "People who need a service that went offline",
   "href": "grc/stakeholders/service-users/index.html"
  },
  {
   "id": "stakeholder:media",
   "kind": "stakeholder",
   "label": "The press",
   "href": "grc/stakeholders/media/index.html"
  },
  {
   "id": "stakeholder:newsroom",
   "kind": "stakeholder",
   "label": "This newsroom",
   "href": "grc/stakeholders/newsroom/index.html"
  },
  {
   "id": "stakeholder:newsroom-editor",
   "kind": "role",
   "label": "The editor",
   "href": "grc/stakeholders/newsroom-editor/index.html"
  },
  {
   "id": "member:dinis",
   "kind": "member",
   "label": "Dinis Cruz",
   "href": "team/dinis/index.html"
  },
  {
   "id": "stakeholder:newsroom-agents",
   "kind": "stakeholder",
   "label": "The newsroom's agents",
   "href": "grc/stakeholders/newsroom-agents/index.html"
  },
  {
   "id": "stakeholder:readers",
   "kind": "stakeholder",
   "label": "This site's readers",
   "href": "grc/stakeholders/readers/index.html"
  },
  {
   "id": "weakness:w-alloc-bailout",
   "kind": "weakness",
   "label": "The allocator's longjmp-based bailout on out-of-memory",
   "href": "grc/graph/index.html#w-alloc-bailout"
  },
  {
   "id": "vulnerability:cve-109618",
   "kind": "vulnerability",
   "label": "CVE-2026-109618: RCE via OOM corruption",
   "href": "review/index.html#flaws"
  },
  {
   "id": "weakness:w-stale-globals",
   "kind": "weakness",
   "label": "Request globals that survive a failed request",
   "href": "grc/graph/index.html#w-stale-globals"
  },
  {
   "id": "vulnerability:cve-109619",
   "kind": "vulnerability",
   "label": "CVE-2026-109619: RCE via stale global state",
   "href": "review/index.html#flaws"
  },
  {
   "id": "weakness:w-bailout-class",
   "kind": "weakness",
   "label": "Bailout as a class of bug",
   "href": "grc/graph/index.html#w-bailout-class"
  },
  {
   "id": "weakness:w-eol",
   "kind": "weakness",
   "label": "PHP versions the project no longer fixes",
   "href": "grc/graph/index.html#w-eol"
  },
  {
   "id": "weakness:w-embargo",
   "kind": "weakness",
   "label": "One embargo shared by many parties",
   "href": "grc/graph/index.html#w-embargo"
  },
  {
   "id": "weakness:w-inventory",
   "kind": "weakness",
   "label": "Not knowing where PHP runs",
   "href": "grc/graph/index.html#w-inventory"
  },
  {
   "id": "weakness:w-waf-only",
   "kind": "weakness",
   "label": "A filter in front of an unpatched engine",
   "href": "grc/graph/index.html#w-waf-only"
  },
  {
   "id": "weakness:w-signal",
   "kind": "weakness",
   "label": "Exploitation that cannot yet be seen",
   "href": "grc/graph/index.html#w-signal"
  },
  {
   "id": "weakness:w-headline",
   "kind": "weakness",
   "label": "Numbers and ratings repeated without their source",
   "href": "grc/graph/index.html#w-headline"
  },
  {
   "id": "weakness:w-ai-dual-use",
   "kind": "weakness",
   "label": "Frontier models that find memory-safety bugs in widely used C",
   "href": "grc/graph/index.html#w-ai-dual-use"
  },
  {
   "id": "weakness:w-maintainer-capacity",
   "kind": "weakness",
   "label": "A small, thinly funded maintainer team at the base of the web",
   "href": "grc/graph/index.html#w-maintainer-capacity"
  },
  {
   "id": "weakness:w-agent-reach",
   "kind": "weakness",
   "label": "Agents that read the open web and can publish",
   "href": "grc/graph/index.html#w-agent-reach"
  },
  {
   "id": "repo:admin/build/release.sh",
   "kind": "code",
   "label": "admin/build/release.sh",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/admin/build/release.sh"
  },
  {
   "id": "repo:admin/build/validate.py",
   "kind": "code",
   "label": "admin/build/validate.py",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/admin/build/validate.py"
  },
  {
   "id": "repo:admin/build/security_check.py",
   "kind": "code",
   "label": "admin/build/security_check.py",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/admin/build/security_check.py"
  },
  {
   "id": "repo:.github/workflows/pages.yml",
   "kind": "code",
   "label": ".github/workflows/pages.yml",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/.github/workflows/pages.yml"
  },
  {
   "id": "weakness:w-untrusted-text",
   "kind": "weakness",
   "label": "Third-party text inside the agents' context",
   "href": "grc/graph/index.html#w-untrusted-text"
  },
  {
   "id": "repo:admin/security/injection-allowlist.json",
   "kind": "code",
   "label": "admin/security/injection-allowlist.json",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/admin/security/injection-allowlist.json"
  },
  {
   "id": "weakness:w-status-words",
   "kind": "weakness",
   "label": "A status word chosen by the agent that wrote the claim",
   "href": "grc/graph/index.html#w-status-words"
  },
  {
   "id": "repo:admin/factcheck/fc.py",
   "kind": "code",
   "label": "admin/factcheck/fc.py",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/admin/factcheck/fc.py"
  },
  {
   "id": "repo:data/claims.json",
   "kind": "code",
   "label": "data/claims.json",
   "href": "https://github.com/SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP/blob/dev/data/claims.json"
  },
  {
   "id": "remediation:fix-soft-limit",
   "kind": "remediation",
   "label": "A soft memory limit that no longer jumps",
   "href": "review/index.html#fix-soft-limit"
  },
  {
   "id": "remediation:fix-hard-limit",
   "kind": "remediation",
   "label": "A hard limit that ends the process cleanly",
   "href": "review/index.html#fix-hard-limit"
  },
  {
   "id": "remediation:fix-unwind",
   "kind": "remediation",
   "label": "An orderly unwind at the next safe point",
   "href": "review/index.html#fix-unwind"
  },
  {
   "id": "remediation:fix-fallible",
   "kind": "remediation",
   "label": "Allocations that may fail instead of abort",
   "href": "review/index.html#fix-fallible"
  },
  {
   "id": "remediation:fix-reset-globals",
   "kind": "remediation",
   "label": "Request globals reset so nothing survives a failure",
   "href": "review/index.html#fix-reset-globals"
  },
  {
   "id": "remediation:fix-bounded-parsing",
   "kind": "remediation",
   "label": "Bounded, deduplicated request parsing",
   "href": "review/index.html#fix-bounded-parsing"
  },
  {
   "id": "code:file:Zend/zend_alloc.c",
   "kind": "code",
   "label": "Zend/zend_alloc.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:Zend/zend_execute_API.c",
   "kind": "code",
   "label": "Zend/zend_execute_API.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:Zend/zend_hash.c",
   "kind": "code",
   "label": "Zend/zend_hash.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:Zend/zend_string.c",
   "kind": "code",
   "label": "Zend/zend_string.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:Zend/zend_types.h",
   "kind": "code",
   "label": "Zend/zend_types.h",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:ext/session/session.c",
   "kind": "code",
   "label": "ext/session/session.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:main/SAPI.c",
   "kind": "code",
   "label": "main/SAPI.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:main/main.c",
   "kind": "code",
   "label": "main/main.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "code:file:main/rfc1867.c",
   "kind": "code",
   "label": "main/rfc1867.c",
   "href": "review/index.html#areas"
  },
  {
   "id": "risk:r01",
   "kind": "risk",
   "label": "Remote code execution on internet-facing PHP servers",
   "href": "grc/risks/r01/index.html"
  },
  {
   "id": "claim:two-cves-9.2",
   "kind": "claim",
   "label": "Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fix",
   "href": "facts/two-cves-9.2/index.html"
  },
  {
   "id": "source:cve-cve-2026-109618",
   "kind": "source",
   "label": "CVE Program (CNA: PHP Group)",
   "href": "sources/cve-cve-2026-109618/index.html"
  },
  {
   "id": "source:cve-cve-2026-109619",
   "kind": "source",
   "label": "CVE Program (CNA: PHP Group)",
   "href": "sources/cve-cve-2026-109619/index.html"
  },
  {
   "id": "source:github-ghsa-w8hw-w9fx-j79w",
   "kind": "source",
   "label": "PHP (php/php-src GitHub security advisory, published by bukka)",
   "href": "sources/github-ghsa-w8hw-w9fx-j79w/index.html"
  },
  {
   "id": "source:github-ghsa-6wmf-4rv5-p3rp",
   "kind": "source",
   "label": "PHP (php/php-src GitHub security advisory, published by bukka)",
   "href": "sources/github-ghsa-6wmf-4rv5-p3rp/index.html"
  },
  {
   "id": "source:php-net-advisory",
   "kind": "source",
   "label": "PHP Group (php.net)",
   "href": "sources/php-net-advisory/index.html"
  },
  {
   "id": "claim:rce-modphp",
   "kind": "claim",
   "label": "Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any app",
   "href": "facts/rce-modphp/index.html"
  },
  {
   "id": "source:openwall-oss-security-2026-10-21-6",
   "kind": "source",
   "label": "oss-security list (Jakub Zelenka, PHP security team)",
   "href": "sources/openwall-oss-security-2026-10-21-6/index.html"
  },
  {
   "id": "claim:fix-engine",
   "kind": "claim",
   "label": "Both bugs are in the C engine, not in PHP code: the allocator's longjmp-based bailout on o",
   "href": "facts/fix-engine/index.html"
  },
  {
   "id": "source:github-php-src-fix-commit-3584a98bd",
   "kind": "source",
   "label": "php/php-src (git), read from a clone",
   "href": "sources/github-php-src-fix-commit-3584a98bd/index.html"
  },
  {
   "id": "claim:ac-high",
   "kind": "claim",
   "label": "Triggering the bug is much easier than turning it into code execution; the CVSS vector say",
   "href": "facts/ac-high/index.html"
  },
  {
   "id": "source:imperva-blog-php2shell",
   "kind": "source",
   "label": "Imperva Threat Research (Nadav Avital, Bar Menachem)",
   "href": "sources/imperva-blog-php2shell/index.html"
  },
  {
   "id": "source:fastly-blog-php2shell",
   "kind": "source",
   "label": "Fastly",
   "href": "sources/fastly-blog-php2shell/index.html"
  },
  {
   "id": "claim:only-update",
   "kind": "claim",
   "label": "Updating is the only complete mitigation; the configuration measures reduce exposure to sp",
   "href": "facts/only-update/index.html"
  },
  {
   "id": "source:openwall-oss-security-2026-10-21-7",
   "kind": "source",
   "label": "oss-security list (Jakub Zelenka, PHP security team)",
   "href": "sources/openwall-oss-security-2026-10-21-7/index.html"
  },
  {
   "id": "treatment:r01.1",
   "kind": "treatment",
   "label": "Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35",
   "href": "patching/index.html"
  },
  {
   "id": "treatment:r01.2",
   "kind": "treatment",
   "label": "Take the system offline where an update is not possible (CISA, NSA)",
   "href": "impact/index.html"
  },
  {
   "id": "treatment:r01.3",
   "kind": "treatment",
   "label": "Edge filters while the update is rolled out",
   "href": "defence/index.html#edge"
  },
  {
   "id": "control:iso27001:A.8.8",
   "kind": "control",
   "label": "ISO/IEC 27001 A.8.8: Management of technical vulnerabilities",
   "href": "grc/frameworks/iso27001/index.html#c-a-8-8"
  },
  {
   "id": "control:nistcsf:ID.RA-01",
   "kind": "control",
   "label": "NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated and recorded",
   "href": "grc/frameworks/nistcsf/index.html#c-id-ra-01"
  },
  {
   "id": "control:nist80053:SI-2",
   "kind": "control",
   "label": "NIST SP 800-53 SI-2: Flaw remediation",
   "href": "grc/frameworks/nist80053/index.html#c-si-2"
  },
  {
   "id": "control:cis:7.7",
   "kind": "control",
   "label": "CIS Controls 7.7: Remediate detected vulnerabilities",
   "href": "grc/frameworks/cis/index.html#c-7-7"
  },
  {
   "id": "control:attack:T1190",
   "kind": "control",
   "label": "MITRE ATT&CK T1190: Exploit public-facing application",
   "href": "grc/frameworks/attack/index.html#c-t1190"
  },
  {
   "id": "control:owasp:A06:2021",
   "kind": "control",
   "label": "OWASP Top 10s A06:2021: Vulnerable and outdated components",
   "href": "grc/frameworks/owasp/index.html#c-a06-2021"
  },
  {
   "id": "control:nis2:Art.21(2)(e)",
   "kind": "control",
   "label": "NIS2 Art.21(2)(e): Security in acquisition, development and maintenance, including vulnerability handling and disclosure",
   "href": "grc/frameworks/nis2/index.html#c-art-21-2-e"
  },
  {
   "id": "story:where-php2shell-stands",
   "kind": "story",
   "label": "Where php2shell stands: many sites dark, millions of attempts, no confirmed breach",
   "href": "articles/where-php2shell-stands/index.html"
  },
  {
   "id": "story:patch-at-the-speed-of-metasploit",
   "kind": "story",
   "label": "Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third",
   "href": "articles/patch-at-the-speed-of-metasploit/index.html"
  },
  {
   "id": "member:story-site",
   "kind": "member",
   "label": "Story site agent",
   "href": "team/story-site/index.html"
  },
  {
   "id": "member:journalist",
   "kind": "member",
   "label": "Journalist",
   "href": "team/journalist/index.html"
  },
  {
   "id": "page:flaws/index.html",
   "kind": "page",
   "label": "The two flaws",
   "href": "flaws/index.html"
  },
  {
   "id": "page:review/index.html",
   "kind": "page",
   "label": "The fix, mapped to the code",
   "href": "review/index.html"
  },
  {
   "id": "page:playbook/index.html",
   "kind": "page",
   "label": "If you run PHP",
   "href": "playbook/index.html"
  },
  {
   "id": "risk:r01-1",
   "kind": "risk",
   "label": "Default Apache mod_php installations exploited before application code runs",
   "href": "grc/risks/r01-1/index.html"
  },
  {
   "id": "treatment:r01-1.1",
   "kind": "treatment",
   "label": "Update PHP; the configuration measures reduce exposure and do not make an installation safe",
   "href": "playbook/index.html"
  },
  {
   "id": "control:cis:7.4",
   "kind": "control",
   "label": "CIS Controls 7.4: Perform automated application patch management",
   "href": "grc/frameworks/cis/index.html#c-7-4"
  },
  {
   "id": "control:cyberessentials:SUM",
   "kind": "control",
   "label": "Cyber Essentials SUM: Security update management: high and critical updates within 14 days of release; unsupported software removed",
   "href": "grc/frameworks/cyberessentials/index.html#c-sum"
  },
  {
   "id": "control:pcidss:6.3.3",
   "kind": "control",
   "label": "PCI DSS 6.3.3: Critical security patches are installed within one month of release",
   "href": "grc/frameworks/pcidss/index.html#c-6-3-3"
  },
  {
   "id": "story:why-not-patch-every-version",
   "kind": "story",
   "label": "Why can't every version of PHP just be patched?",
   "href": "articles/why-not-patch-every-version/index.html"
  },
  {
   "id": "page:affected/index.html",
   "kind": "page",
   "label": "Affected systems",
   "href": "affected/index.html"
  },
  {
   "id": "risk:r01-2",
   "kind": "risk",
   "label": "PHP-FPM deployments wrongly treated as safe or as certainly vulnerable",
   "href": "grc/risks/r01-2/index.html"
  },
  {
   "id": "claim:rce-fpm",
   "kind": "claim",
   "label": "Remote code execution is confirmed on PHP-FPM",
   "href": "facts/rce-fpm/index.html"
  },
  {
   "id": "source:php-foundation-blog-security-release",
   "kind": "source",
   "label": "The PHP Foundation",
   "href": "sources/php-foundation-blog-security-release/index.html"
  },
  {
   "id": "treatment:r01-2.1",
   "kind": "treatment",
   "label": "Treat FPM as affected and update it on the same schedule",
   "href": "affected/index.html"
  },
  {
   "id": "control:iso27001:6.1.2",
   "kind": "control",
   "label": "ISO/IEC 27001 6.1.2: Information security risk assessment: identify risks and their owners",
   "href": "grc/frameworks/iso27001/index.html#c-6-1-2"
  },
  {
   "id": "member:verifier",
   "kind": "member",
   "label": "Fact-check desk",
   "href": "team/verifier/index.html"
  },
  {
   "id": "page:factcheck/index.html",
   "kind": "page",
   "label": "Fact-check: how sure we are",
   "href": "factcheck/index.html"
  },
  {
   "id": "risk:r01-3",
   "kind": "risk",
   "label": "Versions the PHP project no longer fixes stay vulnerable",
   "href": "grc/risks/r01-3/index.html"
  },
  {
   "id": "claim:versions-old",
   "kind": "claim",
   "label": "All PHP versions from 5 onwards are affected by at least one of the flaws",
   "href": "facts/versions-old/index.html"
  },
  {
   "id": "source:ncsc-nl-advisories",
   "kind": "source",
   "label": "NCSC-NL",
   "href": "sources/ncsc-nl-advisories/index.html"
  },
  {
   "id": "source:x-wiz-io-php2shell",
   "kind": "source",
   "label": "Wiz (@wiz_io)",
   "href": "sources/x-wiz-io-php2shell/index.html"
  },
  {
   "id": "source:certfr-2026-ale-014",
   "kind": "source",
   "label": "CERT-FR (ANSSI)",
   "href": "sources/certfr-2026-ale-014/index.html"
  },
  {
   "id": "source:openwall-oss-security-109619-thread",
   "kind": "source",
   "label": "oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone)",
   "href": "sources/openwall-oss-security-109619-thread/index.html"
  },
  {
   "id": "claim:offline-cisa",
   "kind": "claim",
   "label": "Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PH",
   "href": "facts/offline-cisa/index.html"
  },
  {
   "id": "source:cisa-alert-php-20261021",
   "kind": "source",
   "label": "US Cybersecurity and Infrastructure Security Agency (CISA)",
   "href": "sources/cisa-alert-php-20261021/index.html"
  },
  {
   "id": "treatment:r01-3.1",
   "kind": "treatment",
   "label": "Distribution backports and paid support for retired versions",
   "href": "patching/index.html#models"
  },
  {
   "id": "treatment:r01-3.2",
   "kind": "treatment",
   "label": "Upgrade to a supported branch",
   "href": "patching/index.html#why"
  },
  {
   "id": "control:nist80053:SA-22",
   "kind": "control",
   "label": "NIST SP 800-53 SA-22: Unsupported system components",
   "href": "grc/frameworks/nist80053/index.html#c-sa-22"
  },
  {
   "id": "control:cis:2.2",
   "kind": "control",
   "label": "CIS Controls 2.2: Ensure authorised software is currently supported",
   "href": "grc/frameworks/cis/index.html#c-2-2"
  },
  {
   "id": "control:nistcsf:PR.PS-02",
   "kind": "control",
   "label": "NIST CSF 2.0 PR.PS-02: Software is maintained, replaced and removed commensurate with risk",
   "href": "grc/frameworks/nistcsf/index.html#c-pr-ps-02"
  },
  {
   "id": "page:patching/index.html",
   "kind": "page",
   "label": "Patching: who gets a fix",
   "href": "patching/index.html"
  },
  {
   "id": "page:patching/inventory/index.html",
   "kind": "page",
   "label": "The inventory, hour by hour",
   "href": "patching/inventory/index.html"
  },
  {
   "id": "risk:r01-4",
   "kind": "risk",
   "label": "The fix is incomplete, or a third flaw follows",
   "href": "grc/risks/r01-4/index.html"
  },
  {
   "id": "claim:fix-incomplete",
   "kind": "claim",
   "label": "The 8.5.12 fix may be incomplete, or there is a third, different bug",
   "href": "facts/fix-incomplete/index.html"
  },
  {
   "id": "claim:more-paths",
   "kind": "claim",
   "label": "Patching the demonstrated paths does not make the bailout mechanism safe; more paths shoul",
   "href": "facts/more-paths/index.html"
  },
  {
   "id": "claim:fix-bailout",
   "kind": "claim",
   "label": "The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the ",
   "href": "facts/fix-bailout/index.html"
  },
  {
   "id": "source:php-net-changelog-8",
   "kind": "source",
   "label": "PHP Group (php.net)",
   "href": "sources/php-net-changelog-8/index.html"
  },
  {
   "id": "source:github-php-src-branch-7.4-backport",
   "kind": "source",
   "label": "php/php-src on GitHub",
   "href": "sources/github-php-src-branch-7.4-backport/index.html"
  },
  {
   "id": "treatment:r01-4.1",
   "kind": "treatment",
   "label": "The fix replaces the longjmp bailout with a delayed soft limit and a clean hard exit",
   "href": "review/index.html#remediation"
  },
  {
   "id": "treatment:r01-4.2",
   "kind": "treatment",
   "label": "Keep detection and filters after patching",
   "href": "defence/index.html"
  },
  {
   "id": "control:ssdf:RV.3",
   "kind": "control",
   "label": "NIST SSDF RV.3: Analyse vulnerabilities to identify their root causes",
   "href": "grc/frameworks/ssdf/index.html#c-rv-3"
  },
  {
   "id": "control:ssdf:PW.8",
   "kind": "control",
   "label": "NIST SSDF PW.8: Test executable code to find vulnerabilities",
   "href": "grc/frameworks/ssdf/index.html#c-pw-8"
  },
  {
   "id": "control:iso27001:A.8.29",
   "kind": "control",
   "label": "ISO/IEC 27001 A.8.29: Security testing in development and acceptance",
   "href": "grc/frameworks/iso27001/index.html#c-a-8-29"
  },
  {
   "id": "control:iso29147:30111:handling",
   "kind": "control",
   "label": "ISO/IEC 29147 and 30111 30111:handling: Investigating, remediating and releasing the fix, and learning from it",
   "href": "grc/frameworks/iso29147/index.html#c-30111-handling"
  },
  {
   "id": "page:code/index.html",
   "kind": "page",
   "label": "The code",
   "href": "code/index.html"
  },
  {
   "id": "risk:r01-5",
   "kind": "risk",
   "label": "Popular applications compromised before authentication",
   "href": "grc/risks/r01-5/index.html"
  },
  {
   "id": "claim:wordpress-drupal",
   "kind": "claim",
   "label": "Pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcu",
   "href": "facts/wordpress-drupal/index.html"
  },
  {
   "id": "source:calif-php2shell",
   "kind": "source",
   "label": "Calif (Calif Research)",
   "href": "sources/calif-php2shell/index.html"
  },
  {
   "id": "source:wiz-blog-php2shell",
   "kind": "source",
   "label": "Wiz (Wiz Research)",
   "href": "sources/wiz-blog-php2shell/index.html"
  },
  {
   "id": "treatment:r01-5.1",
   "kind": "treatment",
   "label": "Update PHP under the application",
   "href": "playbook/index.html"
  },
  {
   "id": "control:pcidss:6.3.1",
   "kind": "control",
   "label": "PCI DSS 6.3.1: Security vulnerabilities are identified, risk-ranked and managed",
   "href": "grc/frameworks/pcidss/index.html#c-6-3-1"
  },
  {
   "id": "control:cis:16.4",
   "kind": "control",
   "label": "CIS Controls 16.4: Establish and manage an inventory of third-party software components",
   "href": "grc/frameworks/cis/index.html#c-16-4"
  },
  {
   "id": "risk:r01-6",
   "kind": "risk",
   "label": "Products that embed PHP stay vulnerable while their suppliers investigate",
   "href": "grc/risks/r01-6/index.html"
  },
  {
   "id": "claim:scale-ncsc-nl",
   "kind": "claim",
   "label": "674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, ",
   "href": "facts/scale-ncsc-nl/index.html"
  },
  {
   "id": "source:ncsc-nl-php2shell-software-list",
   "kind": "source",
   "label": "NCSC-NL (Netherlands National Cyber Security Centre)",
   "href": "sources/ncsc-nl-php2shell-software-list/index.html"
  },
  {
   "id": "treatment:r01-6.1",
   "kind": "treatment",
   "label": "The NCSC-NL inventory, tracked hour by hour",
   "href": "patching/inventory/index.html"
  },
  {
   "id": "control:cra:Art.13",
   "kind": "control",
   "label": "Cyber Resilience Act Art.13: Obligations of manufacturers, including due diligence on integrated third-party and open-source components",
   "href": "grc/frameworks/cra/index.html#c-art-13"
  },
  {
   "id": "control:cra:AnnexI.II",
   "kind": "control",
   "label": "Cyber Resilience Act AnnexI.II: Vulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosure",
   "href": "grc/frameworks/cra/index.html#c-annexi-ii"
  },
  {
   "id": "control:owasp:A03:2025",
   "kind": "control",
   "label": "OWASP Top 10s A03:2025: Software supply chain failures",
   "href": "grc/frameworks/owasp/index.html#c-a03-2025"
  },
  {
   "id": "control:nis2:Art.21(2)(d)",
   "kind": "control",
   "label": "NIS2 Art.21(2)(d): Supply chain security, including the security of each direct supplier",
   "href": "grc/frameworks/nis2/index.html#c-art-21-2-d"
  },
  {
   "id": "control:iso27001:A.5.21",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.21: Managing information security in the ICT supply chain",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-21"
  },
  {
   "id": "control:nistcsf:GV.SC-07",
   "kind": "control",
   "label": "NIST CSF 2.0 GV.SC-07: Supplier risks are understood, recorded, prioritised, assessed, responded to and monitored",
   "href": "grc/frameworks/nistcsf/index.html#c-gv-sc-07"
  },
  {
   "id": "control:dora:Art.28",
   "kind": "control",
   "label": "DORA Art.28: Managing ICT third-party risk",
   "href": "grc/frameworks/dora/index.html#c-art-28"
  },
  {
   "id": "control:soc2:CC9.2",
   "kind": "control",
   "label": "SOC 2 CC9.2: Risks from vendors and business partners are assessed and managed",
   "href": "grc/frameworks/soc2/index.html#c-cc9-2"
  },
  {
   "id": "page:affected/software.html",
   "kind": "page",
   "label": "Software inventory",
   "href": "affected/software.html"
  },
  {
   "id": "risk:r02",
   "kind": "risk",
   "label": "The coordinated disclosure broke before the fix was ready",
   "href": "grc/risks/r02/index.html"
  },
  {
   "id": "claim:release-moved",
   "kind": "claim",
   "label": "The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the",
   "href": "facts/release-moved/index.html"
  },
  {
   "id": "source:openwall-oss-security-2026-10-20-34",
   "kind": "source",
   "label": "oss-security list (Alan Coopersmith, Oracle)",
   "href": "sources/openwall-oss-security-2026-10-20-34/index.html"
  },
  {
   "id": "claim:leak-cve-ids",
   "kind": "claim",
   "label": "On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social me",
   "href": "facts/leak-cve-ids/index.html"
  },
  {
   "id": "source:phpfoundation-blog-security-release-leak",
   "kind": "source",
   "label": "The PHP Foundation",
   "href": "sources/phpfoundation-blog-security-release-leak/index.html"
  },
  {
   "id": "claim:leak-video",
   "kind": "claim",
   "label": "Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of con",
   "href": "facts/leak-video/index.html"
  },
  {
   "id": "source:bbc-live-ckgel5xp2xv9t",
   "kind": "source",
   "label": "BBC News",
   "href": "sources/bbc-live-ckgel5xp2xv9t/index.html"
  },
  {
   "id": "claim:chainguard",
   "kind": "claim",
   "label": "Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built i",
   "href": "facts/chainguard/index.html"
  },
  {
   "id": "source:theregister-php-blames-chainguard",
   "kind": "source",
   "label": "The Register",
   "href": "sources/theregister-php-blames-chainguard/index.html"
  },
  {
   "id": "source:x-feross-chainguard",
   "kind": "source",
   "label": "Feross Aboukhadijeh (@feross) on X",
   "href": "sources/x-feross-chainguard/index.html"
  },
  {
   "id": "claim:leak-mitigations",
   "kind": "claim",
   "label": "Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on",
   "href": "facts/leak-mitigations/index.html"
  },
  {
   "id": "treatment:r02.1",
   "kind": "treatment",
   "label": "Move the release forward once the leak was confirmed",
   "href": "leak/index.html"
  },
  {
   "id": "control:iso29147:29147:coordination",
   "kind": "control",
   "label": "ISO/IEC 29147 and 30111 29147:coordination: Coordinating disclosure with other vendors and parties under embargo",
   "href": "grc/frameworks/iso29147/index.html#c-29147-coordination"
  },
  {
   "id": "control:nis2:Art.12",
   "kind": "control",
   "label": "NIS2 Art.12: Coordinated vulnerability disclosure and the European vulnerability database",
   "href": "grc/frameworks/nis2/index.html#c-art-12"
  },
  {
   "id": "control:nistcsf:ID.RA-08",
   "kind": "control",
   "label": "NIST CSF 2.0 ID.RA-08: Processes for receiving, analysing and responding to vulnerability disclosures are established",
   "href": "grc/frameworks/nistcsf/index.html#c-id-ra-08"
  },
  {
   "id": "control:tlp:TLP:AMBER+STRICT",
   "kind": "control",
   "label": "FIRST TLP 2.0 TLP:AMBER+STRICT: Limited disclosure: recipients share only within their organisation",
   "href": "grc/frameworks/tlp/index.html#c-tlp-amber-strict"
  },
  {
   "id": "story:php2shell-in-perspective",
   "kind": "story",
   "label": "php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof",
   "href": "articles/php2shell-in-perspective/index.html"
  },
  {
   "id": "member:historian",
   "kind": "member",
   "label": "Historian",
   "href": "team/historian/index.html"
  },
  {
   "id": "page:leak/index.html",
   "kind": "page",
   "label": "How disclosure broke",
   "href": "leak/index.html"
  },
  {
   "id": "page:timeline/index.html",
   "kind": "page",
   "label": "Timeline",
   "href": "timeline/index.html"
  },
  {
   "id": "risk:r02-1",
   "kind": "risk",
   "label": "The CVE IDs and the proof-of-concept video circulated before release",
   "href": "grc/risks/r02-1/index.html"
  },
  {
   "id": "claim:leak-hn",
   "kind": "claim",
   "label": "The leak started with an anonymous Hacker News post citing a reliable source, which came d",
   "href": "facts/leak-hn/index.html"
  },
  {
   "id": "source:daubois-blog-php2shell-rumors",
   "kind": "source",
   "label": "Alexandre Daubois (PHP security team / PHP Foundation)",
   "href": "sources/daubois-blog-php2shell-rumors/index.html"
  },
  {
   "id": "claim:leak-watchtowr",
   "kind": "claim",
   "label": "watchTowr confirmed in public that the bugs were real and posted both CVE numbers before t",
   "href": "facts/leak-watchtowr/index.html"
  },
  {
   "id": "source:certeu-sa-2026-018",
   "kind": "source",
   "label": "CERT-EU",
   "href": "sources/certeu-sa-2026-018/index.html"
  },
  {
   "id": "treatment:r02-1.1",
   "kind": "treatment",
   "label": "Edge rules live before disclosure",
   "href": "defence/index.html#edge"
  },
  {
   "id": "risk:r02-2",
   "kind": "risk",
   "label": "Early mitigation advice to a few providers leaked",
   "href": "grc/risks/r02-2/index.html"
  },
  {
   "id": "treatment:r02-2.1",
   "kind": "treatment",
   "label": "Share early advice under TLP:AMBER+STRICT and record who received it",
   "href": "leak/index.html"
  },
  {
   "id": "control:iso27001:A.5.14",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.14: Information transfer, including under agreed classification",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-14"
  },
  {
   "id": "risk:r02-3",
   "kind": "risk",
   "label": "Patched builds published before the embargo lifted",
   "href": "grc/risks/r02-3/index.html"
  },
  {
   "id": "claim:lorenc-ai-found",
   "kind": "claim",
   "label": "Chainguard's team found the same bugs independently with an AI harness and a frontier mode",
   "href": "facts/lorenc-ai-found/index.html"
  },
  {
   "id": "treatment:r02-3.1",
   "kind": "treatment",
   "label": "Embargo terms that cover built artefacts, not only advisories",
   "href": "leak/index.html"
  },
  {
   "id": "control:nistcsf:GV.SC-05",
   "kind": "control",
   "label": "NIST CSF 2.0 GV.SC-05: Supply chain requirements are established and integrated into contracts",
   "href": "grc/frameworks/nistcsf/index.html#c-gv-sc-05"
  },
  {
   "id": "risk:r03",
   "kind": "risk",
   "label": "Exploitation outpaces patching",
   "href": "grc/risks/r03/index.html"
  },
  {
   "id": "claim:probing",
   "kind": "claim",
   "label": "Amazon and Cloudflare saw sites being probed for the flaw",
   "href": "facts/probing/index.html"
  },
  {
   "id": "source:cloudflare-blog-php2shell-waf",
   "kind": "source",
   "label": "Cloudflare",
   "href": "sources/cloudflare-blog-php2shell-waf/index.html"
  },
  {
   "id": "source:aws-security-blog-madpot",
   "kind": "source",
   "label": "Amazon (CJ Moses, AWS Security Blog)",
   "href": "sources/aws-security-blog-madpot/index.html"
  },
  {
   "id": "claim:amazon-honeypot",
   "kind": "claim",
   "label": "An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; pro",
   "href": "facts/amazon-honeypot/index.html"
  },
  {
   "id": "source:thehackernews-php2shell-4days",
   "kind": "source",
   "label": "The Hacker News (Ravie Lakshmanan)",
   "href": "sources/thehackernews-php2shell-4days/index.html"
  },
  {
   "id": "claim:kev-precedent",
   "kind": "claim",
   "label": "The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure a",
   "href": "facts/kev-precedent/index.html"
  },
  {
   "id": "source:cisa-kev-json",
   "kind": "source",
   "label": "CISA",
   "href": "sources/cisa-kev-json/index.html"
  },
  {
   "id": "source:cve-cve-2024-4577",
   "kind": "source",
   "label": "CVE Program (cveawg API)",
   "href": "sources/cve-cve-2024-4577/index.html"
  },
  {
   "id": "source:akamai-blog-cve-2024-4577-one-day",
   "kind": "source",
   "label": "Akamai Security Research",
   "href": "sources/akamai-blog-cve-2024-4577-one-day/index.html"
  },
  {
   "id": "claim:cisa-none",
   "kind": "claim",
   "label": "CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities ",
   "href": "facts/cisa-none/index.html"
  },
  {
   "id": "claim:cloudflare-traffic",
   "kind": "claim",
   "label": "Cloudflare observed attack traffic targeting its customers after the leak, with attackers ",
   "href": "facts/cloudflare-traffic/index.html"
  },
  {
   "id": "treatment:r03.1",
   "kind": "treatment",
   "label": "Patch within days, not the 14-day Cyber Essentials window",
   "href": "playbook/index.html"
  },
  {
   "id": "treatment:r03.2",
   "kind": "treatment",
   "label": "Watch the signals ladder for the move from exposed to exploited",
   "href": "signals/index.html"
  },
  {
   "id": "control:kev:KEV-entry",
   "kind": "control",
   "label": "CISA KEV and BOD 22-01 KEV-entry: A CVE enters the catalogue on reliable evidence of active exploitation",
   "href": "grc/frameworks/kev/index.html#c-kev-entry"
  },
  {
   "id": "control:kev:BOD22-01",
   "kind": "control",
   "label": "CISA KEV and BOD 22-01 BOD22-01: Federal agencies remediate catalogued vulnerabilities by the due date set",
   "href": "grc/frameworks/kev/index.html#c-bod22-01"
  },
  {
   "id": "control:nistcsf:DE.CM-01",
   "kind": "control",
   "label": "NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events",
   "href": "grc/frameworks/nistcsf/index.html#c-de-cm-01"
  },
  {
   "id": "control:nist80053:SI-4",
   "kind": "control",
   "label": "NIST SP 800-53 SI-4: System monitoring",
   "href": "grc/frameworks/nist80053/index.html#c-si-4"
  },
  {
   "id": "control:attack:T1595.002",
   "kind": "control",
   "label": "MITRE ATT&CK T1595.002: Active scanning: vulnerability scanning",
   "href": "grc/frameworks/attack/index.html#c-t1595-002"
  },
  {
   "id": "control:iso27001:A.8.16",
   "kind": "control",
   "label": "ISO/IEC 27001 A.8.16: Monitoring activities",
   "href": "grc/frameworks/iso27001/index.html#c-a-8-16"
  },
  {
   "id": "control:iso27001:A.5.7",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.7: Threat intelligence",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-7"
  },
  {
   "id": "story:exposed-is-not-exploited",
   "kind": "story",
   "label": "Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit",
   "href": "articles/exposed-is-not-exploited/index.html"
  },
  {
   "id": "page:exploitation/index.html",
   "kind": "page",
   "label": "Exploitation signals",
   "href": "exploitation/index.html"
  },
  {
   "id": "page:signals/index.html",
   "kind": "page",
   "label": "The second stories: signals",
   "href": "signals/index.html"
  },
  {
   "id": "risk:r03-1",
   "kind": "risk",
   "label": "Attempts before disclosure",
   "href": "grc/risks/r03-1/index.html"
  },
  {
   "id": "claim:imperva-none",
   "kind": "claim",
   "label": "No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosur",
   "href": "facts/imperva-none/index.html"
  },
  {
   "id": "treatment:r03-1.1",
   "kind": "treatment",
   "label": "Hunt back to 17 October, not to the release",
   "href": "defence/index.html#host"
  },
  {
   "id": "control:nistcsf:ID.RA-02",
   "kind": "control",
   "label": "NIST CSF 2.0 ID.RA-02: Threat intelligence is received from information sharing forums and sources",
   "href": "grc/frameworks/nistcsf/index.html#c-id-ra-02"
  },
  {
   "id": "control:pcidss:12.10.1",
   "kind": "control",
   "label": "PCI DSS 12.10.1: An incident response plan exists and is ready to be activated",
   "href": "grc/frameworks/pcidss/index.html#c-12-10-1"
  },
  {
   "id": "risk:r03-2",
   "kind": "risk",
   "label": "Mass scanning and mutated payloads after the leak",
   "href": "grc/risks/r03-2/index.html"
  },
  {
   "id": "claim:cf-millions",
   "kind": "claim",
   "label": "Exploit attempts across Cloudflare's network: thousands in the ten hours before announceme",
   "href": "facts/cf-millions/index.html"
  },
  {
   "id": "source:x-eastdakota-php2shell-stats",
   "kind": "source",
   "label": "Matthew Prince (@eastdakota), Cloudflare CEO",
   "href": "sources/x-eastdakota-php2shell-stats/index.html"
  },
  {
   "id": "treatment:r03-2.1",
   "kind": "treatment",
   "label": "Edge rules from every major vendor",
   "href": "defence/index.html#edge"
  },
  {
   "id": "control:cis:13.10",
   "kind": "control",
   "label": "CIS Controls 13.10: Perform application layer filtering",
   "href": "grc/frameworks/cis/index.html#c-13-10"
  },
  {
   "id": "page:defence/index.html",
   "kind": "page",
   "label": "Detection and defence",
   "href": "defence/index.html"
  },
  {
   "id": "risk:r03-3",
   "kind": "risk",
   "label": "Exploited in the wild without anyone being able to show it",
   "href": "grc/risks/r03-3/index.html"
  },
  {
   "id": "claim:watchtowr-itw",
   "kind": "claim",
   "label": "watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild",
   "href": "facts/watchtowr-itw/index.html"
  },
  {
   "id": "source:watchtowr-php2shell",
   "kind": "source",
   "label": "watchTowr",
   "href": "sources/watchtowr-php2shell/index.html"
  },
  {
   "id": "source:watchtowr-php2shell-faq",
   "kind": "source",
   "label": "watchTowr",
   "href": "sources/watchtowr-php2shell-faq/index.html"
  },
  {
   "id": "claim:huntress-none",
   "kind": "claim",
   "label": "No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no pub",
   "href": "facts/huntress-none/index.html"
  },
  {
   "id": "source:huntress-php2shell-rapid-response",
   "kind": "source",
   "label": "Huntress",
   "href": "sources/huntress-php2shell-rapid-response/index.html"
  },
  {
   "id": "claim:no-confirmed-compromise",
   "kind": "claim",
   "label": "As of 20:50 UTC on 22 October, no named organisation has said it was compromised through p",
   "href": "facts/no-confirmed-compromise/index.html"
  },
  {
   "id": "source:securityweek-first-attempts-sensors",
   "kind": "source",
   "label": "SecurityWeek",
   "href": "sources/securityweek-first-attempts-sensors/index.html"
  },
  {
   "id": "source:securityweek-exploitation-days-before",
   "kind": "source",
   "label": "SecurityWeek",
   "href": "sources/securityweek-exploitation-days-before/index.html"
  },
  {
   "id": "source:recordedfuture-php2shell",
   "kind": "source",
   "label": "Recorded Future",
   "href": "sources/recordedfuture-php2shell/index.html"
  },
  {
   "id": "source:weirdgloop-blog-php2shell",
   "kind": "source",
   "label": "Weird Gloop (cookmeplox)",
   "href": "sources/weirdgloop-blog-php2shell/index.html"
  },
  {
   "id": "claim:nz-active",
   "kind": "claim",
   "label": "Reports of active exploitation exist",
   "href": "facts/nz-active/index.html"
  },
  {
   "id": "source:ncsc-nz-alert-php",
   "kind": "source",
   "label": "NCSC New Zealand",
   "href": "sources/ncsc-nz-alert-php/index.html"
  },
  {
   "id": "treatment:r03-3.1",
   "kind": "treatment",
   "label": "Rate on exposure and precedent, not only on confirmed exploitation",
   "href": "signals/index.html"
  },
  {
   "id": "control:nistcsf:GV.RR-01",
   "kind": "control",
   "label": "NIST CSF 2.0 GV.RR-01: Leadership is responsible and accountable for cybersecurity risk",
   "href": "grc/frameworks/nistcsf/index.html#c-gv-rr-01"
  },
  {
   "id": "page:compromise/index.html",
   "kind": "page",
   "label": "No named compromise: the evidence",
   "href": "compromise/index.html"
  },
  {
   "id": "risk:r03-4",
   "kind": "risk",
   "label": "Detections built on a proof of concept with the wrong mechanism",
   "href": "grc/risks/r03-4/index.html"
  },
  {
   "id": "claim:pocs-wrong",
   "kind": "claim",
   "label": "None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechani",
   "href": "facts/pocs-wrong/index.html"
  },
  {
   "id": "source:github-rjmendez-phpup-2026",
   "kind": "source",
   "label": "rjmendez, GitHub",
   "href": "sources/github-rjmendez-phpup-2026/index.html"
  },
  {
   "id": "treatment:r03-4.1",
   "kind": "treatment",
   "label": "Check versions, not scanner verdicts",
   "href": "defence/index.html#hard"
  },
  {
   "id": "control:nist80053:RA-5",
   "kind": "control",
   "label": "NIST SP 800-53 RA-5: Vulnerability monitoring and scanning",
   "href": "grc/frameworks/nist80053/index.html#c-ra-5"
  },
  {
   "id": "control:soc2:CC7.1",
   "kind": "control",
   "label": "SOC 2 CC7.1: Detection and monitoring procedures identify new vulnerabilities and configuration changes",
   "href": "grc/frameworks/soc2/index.html#c-cc7-1"
  },
  {
   "id": "risk:r04",
   "kind": "risk",
   "label": "Services lost to precautionary shutdowns",
   "href": "grc/risks/r04/index.html"
  },
  {
   "id": "claim:offline-nsa",
   "kind": "claim",
   "label": "If an immediate update is not feasible, take the system offline until it can be fully miti",
   "href": "facts/offline-nsa/index.html"
  },
  {
   "id": "source:nsa-x-2112903220209098897",
   "kind": "source",
   "label": "NSA Cybersecurity (@NSACyber)",
   "href": "sources/nsa-x-2112903220209098897/index.html"
  },
  {
   "id": "source:nsa-press-php-4630238",
   "kind": "source",
   "label": "US National Security Agency (NSA)",
   "href": "sources/nsa-press-php-4630238/index.html"
  },
  {
   "id": "claim:nl-offline",
   "kind": "claim",
   "label": "The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and O",
   "href": "facts/nl-offline/index.html"
  },
  {
   "id": "source:rijksoverheid-ncsc-php-news",
   "kind": "source",
   "label": "Rijksoverheid (Dutch government) / NCSC-NL",
   "href": "sources/rijksoverheid-ncsc-php-news/index.html"
  },
  {
   "id": "source:dutchitleaders-websites-offline",
   "kind": "source",
   "label": "Dutch IT Leaders",
   "href": "sources/dutchitleaders-websites-offline/index.html"
  },
  {
   "id": "claim:fi-offline",
   "kind": "claim",
   "label": "Finland's state IT provider Valtori restricted public traffic to government web services f",
   "href": "facts/fi-offline/index.html"
  },
  {
   "id": "source:yle-finland-government-sites-shut",
   "kind": "source",
   "label": "Yle (Finnish public broadcaster)",
   "href": "sources/yle-finland-government-sites-shut/index.html"
  },
  {
   "id": "source:helsinkitimes-finland-shutdown",
   "kind": "source",
   "label": "Helsinki Times",
   "href": "sources/helsinkitimes-finland-shutdown/index.html"
  },
  {
   "id": "claim:latvia-offline",
   "kind": "claim",
   "label": "Latvia restricted access from abroad to several state digital resources, possibly until 26",
   "href": "facts/latvia-offline/index.html"
  },
  {
   "id": "source:certlv-php-preventive",
   "kind": "source",
   "label": "CERT.LV (Latvia)",
   "href": "sources/certlv-php-preventive/index.html"
  },
  {
   "id": "claim:affected-sites",
   "kind": "claim",
   "label": "Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, ",
   "href": "facts/affected-sites/index.html"
  },
  {
   "id": "claim:wikimedia-precaution",
   "kind": "claim",
   "label": "The Wikimedia Foundation took down a number of systems 'as a precautionary measure until t",
   "href": "facts/wikimedia-precaution/index.html"
  },
  {
   "id": "source:cnn-php2shell-websites-shut",
   "kind": "source",
   "label": "CNN",
   "href": "sources/cnn-php2shell-websites-shut/index.html"
  },
  {
   "id": "source:cyberexpress-php2shell-gov-sites",
   "kind": "source",
   "label": "The Cyber Express",
   "href": "sources/cyberexpress-php2shell-gov-sites/index.html"
  },
  {
   "id": "treatment:r04.1",
   "kind": "treatment",
   "label": "Serve from cache while the origin is patched",
   "href": "impact/index.html"
  },
  {
   "id": "treatment:r04.2",
   "kind": "treatment",
   "label": "A continuity plan that names which services may go dark",
   "href": "impact/index.html"
  },
  {
   "id": "control:iso27001:A.5.29",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.29: Information security during disruption",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-29"
  },
  {
   "id": "control:iso27001:A.5.30",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.30: ICT readiness for business continuity",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-30"
  },
  {
   "id": "control:nis2:Art.21(2)(c)",
   "kind": "control",
   "label": "NIS2 Art.21(2)(c): Business continuity, backup management, disaster recovery and crisis management",
   "href": "grc/frameworks/nis2/index.html#c-art-21-2-c"
  },
  {
   "id": "control:dora:Art.11",
   "kind": "control",
   "label": "DORA Art.11: Response and recovery, including ICT business continuity",
   "href": "grc/frameworks/dora/index.html#c-art-11"
  },
  {
   "id": "control:nist80053:CP-2",
   "kind": "control",
   "label": "NIST SP 800-53 CP-2: Contingency plan",
   "href": "grc/frameworks/nist80053/index.html#c-cp-2"
  },
  {
   "id": "control:nistcsf:RC.RP-01",
   "kind": "control",
   "label": "NIST CSF 2.0 RC.RP-01: The recovery portion of the incident response plan is executed",
   "href": "grc/frameworks/nistcsf/index.html#c-rc-rp-01"
  },
  {
   "id": "page:impact/index.html",
   "kind": "page",
   "label": "Impact: offline vs compromised",
   "href": "impact/index.html"
  },
  {
   "id": "page:agencies/index.html",
   "kind": "page",
   "label": "The agencies",
   "href": "agencies/index.html"
  },
  {
   "id": "risk:r04-1",
   "kind": "risk",
   "label": "National government services offline",
   "href": "grc/risks/r04-1/index.html"
  },
  {
   "id": "treatment:r04-1.1",
   "kind": "treatment",
   "label": "Restrict access by geography instead of switching off",
   "href": "impact/index.html"
  },
  {
   "id": "risk:r04-2",
   "kind": "risk",
   "label": "Councils and police offline without saying why",
   "href": "grc/risks/r04-2/index.html"
  },
  {
   "id": "claim:edinburgh",
   "kind": "claim",
   "label": "Edinburgh council's site went offline late on 21 October; the council called it 'essential",
   "href": "facts/edinburgh/index.html"
  },
  {
   "id": "source:scotsman-edinburgh-council-offline",
   "kind": "source",
   "label": "The Scotsman (Jack Davies)",
   "href": "sources/scotsman-edinburgh-council-offline/index.html"
  },
  {
   "id": "claim:oxford",
   "kind": "claim",
   "label": "Oxford City Council: 'a precaution because of a worldwide issue with the underlying techno",
   "href": "facts/oxford/index.html"
  },
  {
   "id": "source:oxfordchronicle-councils-offline",
   "kind": "source",
   "label": "Oxford Chronicle",
   "href": "sources/oxfordchronicle-councils-offline/index.html"
  },
  {
   "id": "claim:uk-list",
   "kind": "claim",
   "label": "Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility wer",
   "href": "facts/uk-list/index.html"
  },
  {
   "id": "source:lbc-uk-websites-offline",
   "kind": "source",
   "label": "LBC",
   "href": "sources/lbc-uk-websites-offline/index.html"
  },
  {
   "id": "source:insurancebusiness-uk-councils-met",
   "kind": "source",
   "label": "Insurance Business (Matthew Sellers)",
   "href": "sources/insurancebusiness-uk-councils-met/index.html"
  },
  {
   "id": "treatment:r04-2.1",
   "kind": "treatment",
   "label": "A holding statement prepared before the outage",
   "href": "briefings/comms/index.html"
  },
  {
   "id": "control:nistcsf:RS.CO-03",
   "kind": "control",
   "label": "NIST CSF 2.0 RS.CO-03: Information is shared with designated internal and external stakeholders",
   "href": "grc/frameworks/nistcsf/index.html#c-rs-co-03"
  },
  {
   "id": "control:iso27001:A.5.24",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.24: Incident management planning and preparation",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-24"
  },
  {
   "id": "page:briefings/comms/index.html",
   "kind": "page",
   "label": "Your briefing",
   "href": "briefings/comms/index.html"
  },
  {
   "id": "risk:r04-3",
   "kind": "risk",
   "label": "The agencies' advice disagrees",
   "href": "grc/risks/r04-3/index.html"
  },
  {
   "id": "claim:offline-ncsc",
   "kind": "claim",
   "label": "'Where immediate remediation is not feasible, organisations should consider taking the sys",
   "href": "facts/offline-ncsc/index.html"
  },
  {
   "id": "source:ncsc-news-php",
   "kind": "source",
   "label": "UK National Cyber Security Centre (NCSC)",
   "href": "sources/ncsc-news-php/index.html"
  },
  {
   "id": "source:cccs-al26-026",
   "kind": "source",
   "label": "Canadian Centre for Cyber Security (CCCS)",
   "href": "sources/cccs-al26-026/index.html"
  },
  {
   "id": "claim:offline-allies",
   "kind": "claim",
   "label": "The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking system",
   "href": "facts/offline-allies/index.html"
  },
  {
   "id": "source:acsc-alert-php",
   "kind": "source",
   "label": "ASD's ACSC (Australia)",
   "href": "sources/acsc-alert-php/index.html"
  },
  {
   "id": "source:ncsc-nl-php2shell",
   "kind": "source",
   "label": "NCSC-NL (Netherlands National Cyber Security Centre)",
   "href": "sources/ncsc-nl-php2shell/index.html"
  },
  {
   "id": "source:acn-it-php2shell",
   "kind": "source",
   "label": "ACN / CSIRT Italia",
   "href": "sources/acn-it-php2shell/index.html"
  },
  {
   "id": "source:jpcert-at260033",
   "kind": "source",
   "label": "JPCERT/CC (Japan)",
   "href": "sources/jpcert-at260033/index.html"
  },
  {
   "id": "treatment:r04-3.1",
   "kind": "treatment",
   "label": "The agencies table, advice side by side",
   "href": "agencies/index.html"
  },
  {
   "id": "control:iso27001:A.5.5",
   "kind": "control",
   "label": "ISO/IEC 27001 A.5.5: Contact with authorities",
   "href": "grc/frameworks/iso27001/index.html#c-a-5-5"
  },
  {
   "id": "control:nis2:Art.20",
   "kind": "control",
   "label": "NIS2 Art.20: Governance: management bodies approve and oversee the risk-management measures and can be held liable",
   "href": "grc/frameworks/nis2/index.html#c-art-20"
  },
  {
   "id": "risk:r05",
   "kind": "risk",
   "label": "A web application firewall taken for a patch",
   "href": "grc/risks/r05/index.html"
  },
  {
   "id": "claim:waf",
   "kind": "claim",
   "label": "A web application firewall may provide some protection until systems are patched",
   "href": "facts/waf/index.html"
  },
  {
   "id": "source:ch-bacs-warnung-php",
   "kind": "source",
   "label": "Swiss Federal Office for Cyber Security (BACS / NCSC)",
   "href": "sources/ch-bacs-warnung-php/index.html"
  },
  {
   "id": "claim:waf-nine-hours",
   "kind": "claim",
   "label": "Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akam",
   "href": "facts/waf-nine-hours/index.html"
  },
  {
   "id": "source:akamai-blog-php-core-rce",
   "kind": "source",
   "label": "Akamai Security Research",
   "href": "sources/akamai-blog-php-core-rce/index.html"
  },
  {
   "id": "source:fortinet-fortiweb-php2shell",
   "kind": "source",
   "label": "Fortinet Community (FortiWeb knowledge base)",
   "href": "sources/fortinet-fortiweb-php2shell/index.html"
  },
  {
   "id": "treatment:r05.1",
   "kind": "treatment",
   "label": "Filter and patch, never filter instead of patch",
   "href": "defence/index.html#answer"
  },
  {
   "id": "control:pcidss:6.4.2",
   "kind": "control",
   "label": "PCI DSS 6.4.2: An automated technical solution that detects and prevents web attacks protects public-facing web applications",
   "href": "grc/frameworks/pcidss/index.html#c-6-4-2"
  },
  {
   "id": "control:nist80053:SC-7",
   "kind": "control",
   "label": "NIST SP 800-53 SC-7: Boundary protection",
   "href": "grc/frameworks/nist80053/index.html#c-sc-7"
  },
  {
   "id": "control:iso27001:A.8.20",
   "kind": "control",
   "label": "ISO/IEC 27001 A.8.20: Network security",
   "href": "grc/frameworks/iso27001/index.html#c-a-8-20"
  },
  {
   "id": "control:cyberessentials:FW",
   "kind": "control",
   "label": "Cyber Essentials FW: Firewalls: boundary protection for internet-facing services",
   "href": "grc/frameworks/cyberessentials/index.html#c-fw"
  },
  {
   "id": "risk:r06",
   "kind": "risk",
   "label": "A compromise becomes a reportable breach",
   "href": "grc/risks/r06/index.html"
  },
  {
   "id": "treatment:r06.1",
   "kind": "treatment",
   "label": "A breach-assessment step in the incident plan, started at the first sign of compromise",
   "href": "playbook/index.html"
  },
  {
   "id": "control:gdpr:Art.32",
   "kind": "control",
   "label": "GDPR Art.32: Security of processing, including a process for regularly testing and evaluating it",
   "href": "grc/frameworks/gdpr/index.html#c-art-32"
  },
  {
   "id": "control:gdpr:Art.33",
   "kind": "control",
   "label": "GDPR Art.33: Notifying a personal data breach to the supervisory authority within 72 hours",
   "href": "grc/frameworks/gdpr/index.html#c-art-33"
  },
  {
   "id": "control:gdpr:Art.34",
   "kind": "control",
   "label": "GDPR Art.34: Communicating a high-risk personal data breach to the people affected",
   "href": "grc/frameworks/gdpr/index.html#c-art-34"
  },
  {
   "id": "control:nis2:Art.23",
   "kind": "control",
   "label": "NIS2 Art.23: Reporting significant incidents: early warning in 24 hours, notification in 72 hours, final report in a month",
   "href": "grc/frameworks/nis2/index.html#c-art-23"
  },
  {
   "id": "control:dora:Art.19",
   "kind": "control",
   "label": "DORA Art.19: Reporting major ICT-related incidents",
   "href": "grc/frameworks/dora/index.html#c-art-19"
  },
  {
   "id": "control:cra:Art.14",
   "kind": "control",
   "label": "Cyber Resilience Act Art.14: Reporting an actively exploited vulnerability: early warning within 24 hours to the CSIRT and ENISA",
   "href": "grc/frameworks/cra/index.html#c-art-14"
  },
  {
   "id": "risk:r06-1",
   "kind": "risk",
   "label": "Personal data taken from a compromised PHP application",
   "href": "grc/risks/r06-1/index.html"
  },
  {
   "id": "treatment:r06-1.1",
   "kind": "treatment",
   "label": "Security of processing kept current, tested and evaluated",
   "href": "playbook/index.html"
  },
  {
   "id": "control:gdpr:Art.5(1)(f)",
   "kind": "control",
   "label": "GDPR Art.5(1)(f): Integrity and confidentiality: personal data processed with appropriate security",
   "href": "grc/frameworks/gdpr/index.html#c-art-5-1-f"
  },
  {
   "id": "control:gdpr:Art.24",
   "kind": "control",
   "label": "GDPR Art.24: Responsibility of the controller: measures appropriate to the risk",
   "href": "grc/frameworks/gdpr/index.html#c-art-24"
  },
  {
   "id": "control:gdpr:Art.28",
   "kind": "control",
   "label": "GDPR Art.28: Processors: the controller uses only processors that give sufficient guarantees",
   "href": "grc/frameworks/gdpr/index.html#c-art-28"
  },
  {
   "id": "member:grc",
   "kind": "member",
   "label": "GRC desk",
   "href": "team/grc/index.html"
  },
  {
   "id": "page:briefings/dpo/index.html",
   "kind": "page",
   "label": "Your briefing",
   "href": "briefings/dpo/index.html"
  },
  {
   "id": "risk:r06-2",
   "kind": "risk",
   "label": "Essential and financial entities miss their reporting clocks",
   "href": "grc/risks/r06-2/index.html"
  },
  {
   "id": "treatment:r06-2.1",
   "kind": "treatment",
   "label": "Classify a precautionary shutdown against the reporting thresholds on the day",
   "href": "impact/index.html"
  },
  {
   "id": "control:dora:Art.10",
   "kind": "control",
   "label": "DORA Art.10: Detection of anomalous activities",
   "href": "grc/frameworks/dora/index.html#c-art-10"
  },
  {
   "id": "control:nist80053:IR-6",
   "kind": "control",
   "label": "NIST SP 800-53 IR-6: Incident reporting",
   "href": "grc/frameworks/nist80053/index.html#c-ir-6"
  },
  {
   "id": "risk:r06-3",
   "kind": "risk",
   "label": "Manufacturers under the Cyber Resilience Act owe a 24-hour report",
   "href": "grc/risks/r06-3/index.html"
  },
  {
   "id": "treatment:r06-3.1",
   "kind": "treatment",
   "label": "A documented decision on whether and when the exploitation test is met",
   "href": "affected/software.html"
  },
  {
   "id": "control:cra:Art.24",
   "kind": "control",
   "label": "Cyber Resilience Act Art.24: Obligations of open-source software stewards",
   "href": "grc/frameworks/cra/index.html#c-art-24"
  },
  {
   "id": "risk:r07",
   "kind": "risk",
   "label": "Decisions made on numbers that measure something else",
   "href": "grc/risks/r07/index.html"
  },
  {
   "id": "claim:scale-70pc-internet",
   "kind": "claim",
   "label": "Roughly 70% of the Internet is affected",
   "href": "facts/scale-70pc-internet/index.html"
  },
  {
   "id": "claim:scale-70pc-websites",
   "kind": "claim",
   "label": "PHP is used by almost 70% of websites",
   "href": "facts/scale-70pc-websites/index.html"
  },
  {
   "id": "source:x-openai-php2shell",
   "kind": "source",
   "label": "OpenAI (@OpenAI)",
   "href": "sources/x-openai-php2shell/index.html"
  },
  {
   "id": "claim:cvss-10",
   "kind": "claim",
   "label": "The flaws are CVSS 10.0",
   "href": "facts/cvss-10/index.html"
  },
  {
   "id": "claim:scale-30m",
   "kind": "claim",
   "label": "Something like 30 million websites could be affected",
   "href": "facts/scale-30m/index.html"
  },
  {
   "id": "claim:most-severe",
   "kind": "claim",
   "label": "The most severe flaws ever detected by AI",
   "href": "facts/most-severe/index.html"
  },
  {
   "id": "claim:disclosure-22oct",
   "kind": "claim",
   "label": "The flaws were disclosed on 22 October 2026",
   "href": "facts/disclosure-22oct/index.html"
  },
  {
   "id": "source:github-php-src-tag-php-8.5.12",
   "kind": "source",
   "label": "php/php-src on GitHub (release by adoy)",
   "href": "sources/github-php-src-tag-php-8.5.12/index.html"
  },
  {
   "id": "treatment:r07.1",
   "kind": "treatment",
   "label": "Every number with what it counts and its source",
   "href": "numbers/index.html"
  },
  {
   "id": "control:nistcsf:GV.RM-01",
   "kind": "control",
   "label": "NIST CSF 2.0 GV.RM-01: Risk management objectives are established and agreed by stakeholders",
   "href": "grc/frameworks/nistcsf/index.html#c-gv-rm-01"
  },
  {
   "id": "control:owasp:LLM09:2025",
   "kind": "control",
   "label": "OWASP Top 10s LLM09:2025: Misinformation",
   "href": "grc/frameworks/owasp/index.html#c-llm09-2025"
  },
  {
   "id": "page:numbers/index.html",
   "kind": "page",
   "label": "The numbers",
   "href": "numbers/index.html"
  },
  {
   "id": "risk:r08",
   "kind": "risk",
   "label": "Frontier AI finds critical flaws faster than maintainers can fix them",
   "href": "grc/risks/r08/index.html"
  },
  {
   "id": "claim:ai-found",
   "kind": "claim",
   "label": "The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet init",
   "href": "facts/ai-found/index.html"
  },
  {
   "id": "claim:ahead-of-attackers",
   "kind": "claim",
   "label": "Frontier AI found the flaw ahead of attackers, giving defenders time to prepare",
   "href": "facts/ahead-of-attackers/index.html"
  },
  {
   "id": "claim:vibe-code",
   "kind": "claim",
   "label": "Criminals are using AI to 'vibe code' an attack method",
   "href": "facts/vibe-code/index.html"
  },
  {
   "id": "claim:openai-same-day",
   "kind": "claim",
   "label": "OpenAI independently reported the same root cause on 11 August, with further vectors on 18",
   "href": "facts/openai-same-day/index.html"
  },
  {
   "id": "claim:wiz-independent",
   "kind": "claim",
   "label": "Wiz Research independently discovered the first flaw on 19 August and reported on 24 Augus",
   "href": "facts/wiz-independent/index.html"
  },
  {
   "id": "treatment:r08.1",
   "kind": "treatment",
   "label": "Coordinated reporting by the model providers (Patch the Planet)",
   "href": "discovery/index.html"
  },
  {
   "id": "control:euaiact:Art.55",
   "kind": "control",
   "label": "EU AI Act Art.55: Providers of general-purpose models with systemic risk: evaluate, mitigate systemic risks, report serious incidents, protect cybersecurity",
   "href": "grc/frameworks/euaiact/index.html#c-art-55"
  },
  {
   "id": "control:nistairmf:GOVERN-6.1",
   "kind": "control",
   "label": "NIST AI RMF GOVERN-6.1: Policies address AI risks from third-party entities",
   "href": "grc/frameworks/nistairmf/index.html#c-govern-6-1"
  },
  {
   "id": "control:nistairmf:MEASURE-2.7",
   "kind": "control",
   "label": "NIST AI RMF MEASURE-2.7: AI system security and resilience are evaluated and documented",
   "href": "grc/frameworks/nistairmf/index.html#c-measure-2-7"
  },
  {
   "id": "control:iso42001:6.1.2",
   "kind": "control",
   "label": "ISO/IEC 42001 6.1.2: AI risk assessment",
   "href": "grc/frameworks/iso42001/index.html#c-6-1-2"
  },
  {
   "id": "page:discovery/index.html",
   "kind": "page",
   "label": "Who found it",
   "href": "discovery/index.html"
  },
  {
   "id": "page:context/index.html",
   "kind": "page",
   "label": "In context: 2008 to 2026",
   "href": "context/index.html"
  },
  {
   "id": "risk:r08-1",
   "kind": "risk",
   "label": "A known bug left unexploited, then unfixed, for two years",
   "href": "grc/risks/r08-1/index.html"
  },
  {
   "id": "claim:quarkslab-2024",
   "kind": "claim",
   "label": "The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and t",
   "href": "facts/quarkslab-2024/index.html"
  },
  {
   "id": "claim:quarkslab-redacted",
   "kind": "claim",
   "label": "Quarkslab's published audit summary lists 27 findings, two redacted because their fixes we",
   "href": "facts/quarkslab-redacted/index.html"
  },
  {
   "id": "source:quarkslab-blog-php-src-audit",
   "kind": "source",
   "label": "Quarkslab",
   "href": "sources/quarkslab-blog-php-src-audit/index.html"
  },
  {
   "id": "source:substack-lopezkurtz-patch-is-the-exploit",
   "kind": "source",
   "label": "David Lopez-Kurtz (Substack)",
   "href": "sources/substack-lopezkurtz-patch-is-the-exploit/index.html"
  },
  {
   "id": "treatment:r08-1.1",
   "kind": "treatment",
   "label": "Publicly funded audits (OSTIF, Sovereign Tech Agency)",
   "href": "discovery/index.html"
  },
  {
   "id": "control:ssdf:PW.7",
   "kind": "control",
   "label": "NIST SSDF PW.7: Review and analyse human-readable code to find vulnerabilities",
   "href": "grc/frameworks/ssdf/index.html#c-pw-7"
  },
  {
   "id": "control:ssdf:RV.2",
   "kind": "control",
   "label": "NIST SSDF RV.2: Assess, prioritise and remediate vulnerabilities",
   "href": "grc/frameworks/ssdf/index.html#c-rv-2"
  },
  {
   "id": "control:iso27001:A.8.25",
   "kind": "control",
   "label": "ISO/IEC 27001 A.8.25: Secure development life cycle",
   "href": "grc/frameworks/iso27001/index.html#c-a-8-25"
  },
  {
   "id": "risk:r08-2",
   "kind": "risk",
   "label": "Several finders, one small team",
   "href": "grc/risks/r08-2/index.html"
  },
  {
   "id": "claim:four-reporters",
   "kind": "claim",
   "label": "The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-",
   "href": "facts/four-reporters/index.html"
  },
  {
   "id": "claim:who-first",
   "kind": "claim",
   "label": "Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 1",
   "href": "facts/who-first/index.html"
  },
  {
   "id": "source:x-lcfr-hax-hash-tweet",
   "kind": "source",
   "label": "Ryan Austin (@lcfr_hax), Calif",
   "href": "sources/x-lcfr-hax-hash-tweet/index.html"
  },
  {
   "id": "treatment:r08-2.1",
   "kind": "treatment",
   "label": "A coalition that pooled reports for one fix",
   "href": "discovery/index.html"
  },
  {
   "id": "control:iso29147:29147:receipt",
   "kind": "control",
   "label": "ISO/IEC 29147 and 30111 29147:receipt: Receiving vulnerability reports and acknowledging the finder",
   "href": "grc/frameworks/iso29147/index.html#c-29147-receipt"
  },
  {
   "id": "control:ssdf:RV.1",
   "kind": "control",
   "label": "NIST SSDF RV.1: Identify and confirm vulnerabilities on an ongoing basis",
   "href": "grc/frameworks/ssdf/index.html#c-rv-1"
  },
  {
   "id": "risk:r09",
   "kind": "risk",
   "label": "Not knowing where PHP runs",
   "href": "grc/risks/r09/index.html"
  },
  {
   "id": "claim:scale-2.6m-hosts",
   "kind": "claim",
   "label": "PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 mi",
   "href": "facts/scale-2.6m-hosts/index.html"
  },
  {
   "id": "treatment:r09.1",
   "kind": "treatment",
   "label": "A software inventory with component versions (SBOM)",
   "href": "playbook/index.html"
  },
  {
   "id": "control:nistcsf:ID.AM-02",
   "kind": "control",
   "label": "NIST CSF 2.0 ID.AM-02: Inventories of software, services and systems are maintained",
   "href": "grc/frameworks/nistcsf/index.html#c-id-am-02"
  },
  {
   "id": "control:nist80053:CM-8",
   "kind": "control",
   "label": "NIST SP 800-53 CM-8: System component inventory",
   "href": "grc/frameworks/nist80053/index.html#c-cm-8"
  },
  {
   "id": "control:dora:Art.8",
   "kind": "control",
   "label": "DORA Art.8: Identification of ICT assets, their dependencies and the risks to them",
   "href": "grc/frameworks/dora/index.html#c-art-8"
  },
  {
   "id": "control:iso27001:A.8.9",
   "kind": "control",
   "label": "ISO/IEC 27001 A.8.9: Configuration management",
   "href": "grc/frameworks/iso27001/index.html#c-a-8-9"
  },
  {
   "id": "risk:r10",
   "kind": "risk",
   "label": "This newsroom's own agents are steered, leak or mislead",
   "href": "grc/risks/r10/index.html"
  },
  {
   "id": "treatment:r10.1",
   "kind": "treatment",
   "label": "The security requirements, the gate and the release tripwire",
   "href": "admin/agents/index.html"
  },
  {
   "id": "treatment:r10.2",
   "kind": "treatment",
   "label": "Rulesets on dev and main restricting the gate's own files",
   "href": "admin/index.html"
  },
  {
   "id": "control:euaiact:Art.50",
   "kind": "control",
   "label": "EU AI Act Art.50: Transparency: content generated by AI is disclosed as such",
   "href": "grc/frameworks/euaiact/index.html#c-art-50"
  },
  {
   "id": "control:nistairmf:MANAGE-2.4",
   "kind": "control",
   "label": "NIST AI RMF MANAGE-2.4: Mechanisms exist, with assigned responsibility, to supersede, disengage or deactivate an AI system",
   "href": "grc/frameworks/nistairmf/index.html#c-manage-2-4"
  },
  {
   "id": "control:iso42001:6.1.3",
   "kind": "control",
   "label": "ISO/IEC 42001 6.1.3: AI risk treatment",
   "href": "grc/frameworks/iso42001/index.html#c-6-1-3"
  },
  {
   "id": "control:owasp:LLM06:2025",
   "kind": "control",
   "label": "OWASP Top 10s LLM06:2025: Excessive agency",
   "href": "grc/frameworks/owasp/index.html#c-llm06-2025"
  },
  {
   "id": "member:dev",
   "kind": "member",
   "label": "dev@php.newsroom",
   "href": "team/dev/index.html"
  },
  {
   "id": "member:conductor",
   "kind": "member",
   "label": "Conductor",
   "href": "team/conductor/index.html"
  },
  {
   "id": "page:admin/agents/index.html",
   "kind": "page",
   "label": "Guidance for agents",
   "href": "admin/agents/index.html"
  },
  {
   "id": "page:team/index.html",
   "kind": "page",
   "label": "The team",
   "href": "team/index.html"
  },
  {
   "id": "risk:r10-1",
   "kind": "risk",
   "label": "Prompt injection through captured material",
   "href": "grc/risks/r10-1/index.html"
  },
  {
   "id": "treatment:r10-1.1",
   "kind": "treatment",
   "label": "Untrusted input fenced, flagged and never followed; the gate's injection check",
   "href": "admin/agents/index.html"
  },
  {
   "id": "control:owasp:LLM01:2025",
   "kind": "control",
   "label": "OWASP Top 10s LLM01:2025: Prompt injection",
   "href": "grc/frameworks/owasp/index.html#c-llm01-2025"
  },
  {
   "id": "control:euaiact:Art.15",
   "kind": "control",
   "label": "EU AI Act Art.15: Accuracy, robustness and cybersecurity of high-risk AI systems",
   "href": "grc/frameworks/euaiact/index.html#c-art-15"
  },
  {
   "id": "risk:r10-2",
   "kind": "risk",
   "label": "A vault key or token published",
   "href": "grc/risks/r10-2/index.html"
  },
  {
   "id": "treatment:r10-2.1",
   "kind": "treatment",
   "label": "Credential-shape and vault-file checks in the gate and on the staged diff",
   "href": "vaults/index.html"
  },
  {
   "id": "control:owasp:LLM02:2025",
   "kind": "control",
   "label": "OWASP Top 10s LLM02:2025: Sensitive information disclosure",
   "href": "grc/frameworks/owasp/index.html#c-llm02-2025"
  },
  {
   "id": "page:vaults/index.html",
   "kind": "page",
   "label": "Every vault behind this site",
   "href": "vaults/index.html"
  },
  {
   "id": "risk:r10-3",
   "kind": "risk",
   "label": "A status word stronger than its evidence",
   "href": "grc/risks/r10-3/index.html"
  },
  {
   "id": "treatment:r10-3.1",
   "kind": "treatment",
   "label": "An independent fact-check desk grading every claim",
   "href": "factcheck/index.html"
  },
  {
   "id": "page:method/index.html",
   "kind": "page",
   "label": "The method",
   "href": "method/index.html"
  }
 ],
 "edges": [
  {
   "from": "stakeholder:php-project",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:php-security-team",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:php-project"
  },
  {
   "from": "stakeholder:php-fix-authors",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:php-project"
  },
  {
   "from": "stakeholder:php-foundation",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:php-project"
  },
  {
   "from": "stakeholder:finders",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:calif",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:finders"
  },
  {
   "from": "stakeholder:openai",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:finders"
  },
  {
   "from": "stakeholder:wiz",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:finders"
  },
  {
   "from": "stakeholder:quarkslab",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:finders"
  },
  {
   "from": "stakeholder:distributors",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:chainguard",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:distributors"
  },
  {
   "from": "stakeholder:distros",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:distributors"
  },
  {
   "from": "stakeholder:panels",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:distributors"
  },
  {
   "from": "stakeholder:app-vendors",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:inventory-suppliers",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:app-vendors"
  },
  {
   "from": "stakeholder:oss-apps",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:app-vendors"
  },
  {
   "from": "stakeholder:hosting",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:managed-hosts",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:hosting"
  },
  {
   "from": "stakeholder:shared-hosts",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:hosting"
  },
  {
   "from": "stakeholder:edge",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:waf-vendors",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:edge"
  },
  {
   "from": "stakeholder:threat-intel",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:edge"
  },
  {
   "from": "stakeholder:agencies",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:us-agencies",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:agencies"
  },
  {
   "from": "stakeholder:eu-agencies",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:agencies"
  },
  {
   "from": "stakeholder:uk-ncsc",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:agencies"
  },
  {
   "from": "stakeholder:operators",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:public-sector",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:operators"
  },
  {
   "from": "stakeholder:councils",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:public-sector"
  },
  {
   "from": "stakeholder:national-gov",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:public-sector"
  },
  {
   "from": "stakeholder:critical-infra",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:operators"
  },
  {
   "from": "stakeholder:commerce",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:operators"
  },
  {
   "from": "stakeholder:finance",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:operators"
  },
  {
   "from": "stakeholder:non-profits",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:operators"
  },
  {
   "from": "stakeholder:org-roles",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:operators"
  },
  {
   "from": "stakeholder:board",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:board",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:board"
  },
  {
   "from": "stakeholder:ciso",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:ciso",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:ciso"
  },
  {
   "from": "stakeholder:cto",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:cto",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:cto"
  },
  {
   "from": "stakeholder:cfo",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:cfo",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:cfo"
  },
  {
   "from": "stakeholder:security-lead",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:security-lead",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:security"
  },
  {
   "from": "stakeholder:engineers",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:engineers",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:engineer"
  },
  {
   "from": "stakeholder:site-owner",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:site-owner",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:site-owner"
  },
  {
   "from": "stakeholder:comms",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:comms",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:comms"
  },
  {
   "from": "stakeholder:dpo",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:org-roles"
  },
  {
   "from": "stakeholder:dpo",
   "rel": "briefed_by",
   "inverse": "briefs",
   "to": "briefing:dpo"
  },
  {
   "from": "stakeholder:people",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:data-subjects",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:people"
  },
  {
   "from": "stakeholder:service-users",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:people"
  },
  {
   "from": "stakeholder:media",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:world"
  },
  {
   "from": "stakeholder:newsroom",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:media"
  },
  {
   "from": "stakeholder:newsroom-editor",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:newsroom"
  },
  {
   "from": "stakeholder:newsroom-editor",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:dinis"
  },
  {
   "from": "stakeholder:newsroom-agents",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:newsroom"
  },
  {
   "from": "stakeholder:readers",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "stakeholder:newsroom"
  },
  {
   "from": "weakness:w-alloc-bailout",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "weakness:w-stale-globals",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "weakness:w-bailout-class",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "weakness:w-bailout-class",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "weakness:w-eol",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "weakness:w-eol",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "weakness:w-agent-reach",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:admin/build/release.sh"
  },
  {
   "from": "weakness:w-agent-reach",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:admin/build/validate.py"
  },
  {
   "from": "weakness:w-agent-reach",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:admin/build/security_check.py"
  },
  {
   "from": "weakness:w-agent-reach",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:.github/workflows/pages.yml"
  },
  {
   "from": "weakness:w-untrusted-text",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:admin/build/security_check.py"
  },
  {
   "from": "weakness:w-untrusted-text",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:admin/security/injection-allowlist.json"
  },
  {
   "from": "weakness:w-status-words",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:admin/factcheck/fc.py"
  },
  {
   "from": "weakness:w-status-words",
   "rel": "located_in",
   "inverse": "location_of",
   "to": "repo:data/claims.json"
  },
  {
   "from": "vulnerability:cve-109618",
   "rel": "fixed_by",
   "inverse": "fixes",
   "to": "remediation:fix-soft-limit"
  },
  {
   "from": "vulnerability:cve-109618",
   "rel": "fixed_by",
   "inverse": "fixes",
   "to": "remediation:fix-hard-limit"
  },
  {
   "from": "vulnerability:cve-109618",
   "rel": "fixed_by",
   "inverse": "fixes",
   "to": "remediation:fix-unwind"
  },
  {
   "from": "vulnerability:cve-109618",
   "rel": "fixed_by",
   "inverse": "fixes",
   "to": "remediation:fix-fallible"
  },
  {
   "from": "vulnerability:cve-109619",
   "rel": "fixed_by",
   "inverse": "fixes",
   "to": "remediation:fix-reset-globals"
  },
  {
   "from": "vulnerability:cve-109619",
   "rel": "fixed_by",
   "inverse": "fixes",
   "to": "remediation:fix-bounded-parsing"
  },
  {
   "from": "remediation:fix-soft-limit",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:Zend/zend_alloc.c"
  },
  {
   "from": "remediation:fix-unwind",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:Zend/zend_execute_API.c"
  },
  {
   "from": "remediation:fix-fallible",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:Zend/zend_hash.c"
  },
  {
   "from": "remediation:fix-fallible",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:Zend/zend_string.c"
  },
  {
   "from": "remediation:fix-fallible",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:Zend/zend_types.h"
  },
  {
   "from": "remediation:fix-bounded-parsing",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:ext/session/session.c"
  },
  {
   "from": "remediation:fix-reset-globals",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:main/SAPI.c"
  },
  {
   "from": "remediation:fix-reset-globals",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:main/main.c"
  },
  {
   "from": "remediation:fix-bounded-parsing",
   "rel": "realised_in",
   "inverse": "realises",
   "to": "code:file:main/rfc1867.c"
  },
  {
   "from": "risk:r01",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r01",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:people"
  },
  {
   "from": "risk:r01",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:php-project"
  },
  {
   "from": "risk:r01",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:hosting"
  },
  {
   "from": "risk:r01",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:edge"
  },
  {
   "from": "risk:r01",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:agencies"
  },
  {
   "from": "risk:r01",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r01",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-stale-globals"
  },
  {
   "from": "risk:r01",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:two-cves-9.2"
  },
  {
   "from": "claim:two-cves-9.2",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2026-109618"
  },
  {
   "from": "claim:two-cves-9.2",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2026-109619"
  },
  {
   "from": "claim:two-cves-9.2",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:two-cves-9.2",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "claim:two-cves-9.2",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "risk:r01",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:rce-modphp"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-6"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "risk:r01",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:fix-engine"
  },
  {
   "from": "claim:fix-engine",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-php-src-fix-commit-3584a98bd"
  },
  {
   "from": "claim:fix-engine",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:fix-engine",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "risk:r01",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:ac-high"
  },
  {
   "from": "claim:ac-high",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:imperva-blog-php2shell"
  },
  {
   "from": "claim:ac-high",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:fastly-blog-php2shell"
  },
  {
   "from": "claim:ac-high",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2026-109618"
  },
  {
   "from": "risk:r01",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:only-update"
  },
  {
   "from": "claim:only-update",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "claim:only-update",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-7"
  },
  {
   "from": "claim:only-update",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "risk:r01",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01.1"
  },
  {
   "from": "risk:r01",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01.2"
  },
  {
   "from": "risk:r01",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01.3"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.8"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-01"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:SI-2"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:7.7"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:attack:T1190"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:A06:2021"
  },
  {
   "from": "risk:r01",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.21(2)(e)"
  },
  {
   "from": "risk:r01",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r01",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:patch-at-the-speed-of-metasploit"
  },
  {
   "from": "risk:r01",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r01",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r01",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:flaws/index.html"
  },
  {
   "from": "risk:r01",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:review/index.html"
  },
  {
   "from": "risk:r01",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:playbook/index.html"
  },
  {
   "from": "risk:r01-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r01"
  },
  {
   "from": "risk:r01-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:shared-hosts"
  },
  {
   "from": "risk:r01-1",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:site-owner"
  },
  {
   "from": "risk:r01-1",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:engineers"
  },
  {
   "from": "risk:r01-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r01-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:rce-modphp"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-6"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "risk:r01-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:fix-engine"
  },
  {
   "from": "claim:fix-engine",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-php-src-fix-commit-3584a98bd"
  },
  {
   "from": "claim:fix-engine",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:fix-engine",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "risk:r01-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-1.1"
  },
  {
   "from": "risk:r01-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.8"
  },
  {
   "from": "risk:r01-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:7.4"
  },
  {
   "from": "risk:r01-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cyberessentials:SUM"
  },
  {
   "from": "risk:r01-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:pcidss:6.3.3"
  },
  {
   "from": "risk:r01-1",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:why-not-patch-every-version"
  },
  {
   "from": "risk:r01-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r01-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:affected/index.html"
  },
  {
   "from": "risk:r01-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:playbook/index.html"
  },
  {
   "from": "risk:r01-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r01"
  },
  {
   "from": "risk:r01-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:security-lead"
  },
  {
   "from": "risk:r01-2",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:managed-hosts"
  },
  {
   "from": "risk:r01-2",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r01-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-stale-globals"
  },
  {
   "from": "risk:r01-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:rce-fpm"
  },
  {
   "from": "claim:rce-fpm",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:rce-fpm",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "claim:rce-fpm",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:rce-fpm",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-6"
  },
  {
   "from": "risk:r01-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-2.1"
  },
  {
   "from": "risk:r01-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-01"
  },
  {
   "from": "risk:r01-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:6.1.2"
  },
  {
   "from": "risk:r01-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:verifier"
  },
  {
   "from": "risk:r01-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:affected/index.html"
  },
  {
   "from": "risk:r01-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:factcheck/index.html"
  },
  {
   "from": "risk:r01-3",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r01"
  },
  {
   "from": "risk:r01-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r01-3",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:panels"
  },
  {
   "from": "risk:r01-3",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:distros"
  },
  {
   "from": "risk:r01-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:cto"
  },
  {
   "from": "risk:r01-3",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:cfo"
  },
  {
   "from": "risk:r01-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-eol"
  },
  {
   "from": "risk:r01-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:versions-old"
  },
  {
   "from": "claim:versions-old",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-nl-advisories"
  },
  {
   "from": "claim:versions-old",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-wiz-io-php2shell"
  },
  {
   "from": "claim:versions-old",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:certfr-2026-ale-014"
  },
  {
   "from": "claim:versions-old",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-109619-thread"
  },
  {
   "from": "risk:r01-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-cisa"
  },
  {
   "from": "claim:offline-cisa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "risk:r01-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-3.1"
  },
  {
   "from": "risk:r01-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-3.2"
  },
  {
   "from": "risk:r01-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:SA-22"
  },
  {
   "from": "risk:r01-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:2.2"
  },
  {
   "from": "risk:r01-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:PR.PS-02"
  },
  {
   "from": "risk:r01-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cyberessentials:SUM"
  },
  {
   "from": "risk:r01-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:pcidss:6.3.3"
  },
  {
   "from": "risk:r01-3",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:why-not-patch-every-version"
  },
  {
   "from": "risk:r01-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r01-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r01-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:patching/index.html"
  },
  {
   "from": "risk:r01-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:patching/inventory/index.html"
  },
  {
   "from": "risk:r01-4",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r01"
  },
  {
   "from": "risk:r01-4",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:php-fix-authors"
  },
  {
   "from": "risk:r01-4",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r01-4",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r01-4",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:engineers"
  },
  {
   "from": "risk:r01-4",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:finders"
  },
  {
   "from": "risk:r01-4",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-bailout-class"
  },
  {
   "from": "risk:r01-4",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:fix-incomplete"
  },
  {
   "from": "claim:fix-incomplete",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-109619-thread"
  },
  {
   "from": "risk:r01-4",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:more-paths"
  },
  {
   "from": "claim:more-paths",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:fastly-blog-php2shell"
  },
  {
   "from": "claim:more-paths",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-109619-thread"
  },
  {
   "from": "risk:r01-4",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:fix-bailout"
  },
  {
   "from": "claim:fix-bailout",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:fix-bailout",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-changelog-8"
  },
  {
   "from": "claim:fix-bailout",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-php-src-branch-7.4-backport"
  },
  {
   "from": "risk:r01-4",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-4.1"
  },
  {
   "from": "risk:r01-4",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-4.2"
  },
  {
   "from": "risk:r01-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:ssdf:RV.3"
  },
  {
   "from": "risk:r01-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:ssdf:PW.8"
  },
  {
   "from": "risk:r01-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.29"
  },
  {
   "from": "risk:r01-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso29147:30111:handling"
  },
  {
   "from": "risk:r01-4",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:patch-at-the-speed-of-metasploit"
  },
  {
   "from": "risk:r01-4",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r01-4",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:review/index.html"
  },
  {
   "from": "risk:r01-4",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:code/index.html"
  },
  {
   "from": "risk:r01-5",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r01"
  },
  {
   "from": "risk:r01-5",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:oss-apps"
  },
  {
   "from": "risk:r01-5",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:site-owner"
  },
  {
   "from": "risk:r01-5",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:commerce"
  },
  {
   "from": "risk:r01-5",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r01-5",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-stale-globals"
  },
  {
   "from": "risk:r01-5",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:wordpress-drupal"
  },
  {
   "from": "claim:wordpress-drupal",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:calif-php2shell"
  },
  {
   "from": "claim:wordpress-drupal",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "risk:r01-5",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-5.1"
  },
  {
   "from": "risk:r01-5",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:A06:2021"
  },
  {
   "from": "risk:r01-5",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:pcidss:6.3.1"
  },
  {
   "from": "risk:r01-5",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:16.4"
  },
  {
   "from": "risk:r01-5",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r01-5",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:affected/index.html"
  },
  {
   "from": "risk:r01-6",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r01"
  },
  {
   "from": "risk:r01-6",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:inventory-suppliers"
  },
  {
   "from": "risk:r01-6",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r01-6",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:eu-agencies"
  },
  {
   "from": "risk:r01-6",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:cto"
  },
  {
   "from": "risk:r01-6",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-inventory"
  },
  {
   "from": "risk:r01-6",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-ncsc-nl"
  },
  {
   "from": "claim:scale-ncsc-nl",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-nl-php2shell-software-list"
  },
  {
   "from": "risk:r01-6",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r01-6.1"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.13"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:AnnexI.II"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:A03:2025"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.21(2)(d)"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.21"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:GV.SC-07"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:dora:Art.28"
  },
  {
   "from": "risk:r01-6",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:soc2:CC9.2"
  },
  {
   "from": "risk:r01-6",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:why-not-patch-every-version"
  },
  {
   "from": "risk:r01-6",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r01-6",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:affected/software.html"
  },
  {
   "from": "risk:r01-6",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:patching/inventory/index.html"
  },
  {
   "from": "risk:r02",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r02",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:finders"
  },
  {
   "from": "risk:r02",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:distributors"
  },
  {
   "from": "risk:r02",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r02",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:security-lead"
  },
  {
   "from": "risk:r02",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-embargo"
  },
  {
   "from": "risk:r02",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "risk:r02",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "risk:r02",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:release-moved"
  },
  {
   "from": "claim:release-moved",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:release-moved",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-20-34"
  },
  {
   "from": "claim:release-moved",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-wiz-io-php2shell"
  },
  {
   "from": "claim:release-moved",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-changelog-8"
  },
  {
   "from": "risk:r02",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-cve-ids"
  },
  {
   "from": "claim:leak-cve-ids",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:leak-cve-ids",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:phpfoundation-blog-security-release-leak"
  },
  {
   "from": "risk:r02",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-video"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:phpfoundation-blog-security-release-leak"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:calif-php2shell"
  },
  {
   "from": "risk:r02",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:chainguard"
  },
  {
   "from": "claim:chainguard",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:chainguard",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:theregister-php-blames-chainguard"
  },
  {
   "from": "claim:chainguard",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-feross-chainguard"
  },
  {
   "from": "risk:r02",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-mitigations"
  },
  {
   "from": "claim:leak-mitigations",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "risk:r02",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r02.1"
  },
  {
   "from": "risk:r02",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso29147:29147:coordination"
  },
  {
   "from": "risk:r02",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.12"
  },
  {
   "from": "risk:r02",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-08"
  },
  {
   "from": "risk:r02",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:tlp:TLP:AMBER+STRICT"
  },
  {
   "from": "risk:r02",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r02",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:php2shell-in-perspective"
  },
  {
   "from": "risk:r02",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r02",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r02",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:leak/index.html"
  },
  {
   "from": "risk:r02",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:timeline/index.html"
  },
  {
   "from": "risk:r02-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r02"
  },
  {
   "from": "risk:r02-1",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:calif"
  },
  {
   "from": "risk:r02-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r02-1",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:edge"
  },
  {
   "from": "risk:r02-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-embargo"
  },
  {
   "from": "risk:r02-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-cve-ids"
  },
  {
   "from": "claim:leak-cve-ids",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:leak-cve-ids",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:phpfoundation-blog-security-release-leak"
  },
  {
   "from": "risk:r02-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-hn"
  },
  {
   "from": "claim:leak-hn",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:daubois-blog-php2shell-rumors"
  },
  {
   "from": "risk:r02-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-watchtowr"
  },
  {
   "from": "claim:leak-watchtowr",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:daubois-blog-php2shell-rumors"
  },
  {
   "from": "claim:leak-watchtowr",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:certeu-sa-2026-018"
  },
  {
   "from": "risk:r02-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-video"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:phpfoundation-blog-security-release-leak"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:leak-video",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:calif-php2shell"
  },
  {
   "from": "risk:r02-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r02-1.1"
  },
  {
   "from": "risk:r02-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso29147:29147:coordination"
  },
  {
   "from": "risk:r02-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-08"
  },
  {
   "from": "risk:r02-1",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r02-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r02-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:leak/index.html"
  },
  {
   "from": "risk:r02-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r02"
  },
  {
   "from": "risk:r02-2",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:critical-infra"
  },
  {
   "from": "risk:r02-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r02-2",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r02-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-embargo"
  },
  {
   "from": "risk:r02-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:leak-mitigations"
  },
  {
   "from": "claim:leak-mitigations",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "risk:r02-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r02-2.1"
  },
  {
   "from": "risk:r02-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:tlp:TLP:AMBER+STRICT"
  },
  {
   "from": "risk:r02-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.14"
  },
  {
   "from": "risk:r02-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso29147:29147:coordination"
  },
  {
   "from": "risk:r02-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r02-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:leak/index.html"
  },
  {
   "from": "risk:r02-3",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r02"
  },
  {
   "from": "risk:r02-3",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:chainguard"
  },
  {
   "from": "risk:r02-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:distributors"
  },
  {
   "from": "risk:r02-3",
   "rel": "regulated_by",
   "inverse": "regulates",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r02-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-embargo"
  },
  {
   "from": "risk:r02-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:chainguard"
  },
  {
   "from": "claim:chainguard",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:chainguard",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:theregister-php-blames-chainguard"
  },
  {
   "from": "claim:chainguard",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-feross-chainguard"
  },
  {
   "from": "risk:r02-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:lorenc-ai-found"
  },
  {
   "from": "claim:lorenc-ai-found",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:theregister-php-blames-chainguard"
  },
  {
   "from": "risk:r02-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r02-3.1"
  },
  {
   "from": "risk:r02-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso29147:29147:coordination"
  },
  {
   "from": "risk:r02-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.13"
  },
  {
   "from": "risk:r02-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:GV.SC-05"
  },
  {
   "from": "risk:r02-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:A03:2025"
  },
  {
   "from": "risk:r02-3",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r02-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r02-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:leak/index.html"
  },
  {
   "from": "risk:r03",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r03",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:threat-intel"
  },
  {
   "from": "risk:r03",
   "rel": "regulated_by",
   "inverse": "regulates",
   "to": "stakeholder:us-agencies"
  },
  {
   "from": "risk:r03",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:security-lead"
  },
  {
   "from": "risk:r03",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-signal"
  },
  {
   "from": "risk:r03",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r03",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:probing"
  },
  {
   "from": "claim:probing",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:probing",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "claim:probing",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "risk:r03",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:amazon-honeypot"
  },
  {
   "from": "claim:amazon-honeypot",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "claim:amazon-honeypot",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:thehackernews-php2shell-4days"
  },
  {
   "from": "risk:r03",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:kev-precedent"
  },
  {
   "from": "claim:kev-precedent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:kev-precedent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2024-4577"
  },
  {
   "from": "claim:kev-precedent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:akamai-blog-cve-2024-4577-one-day"
  },
  {
   "from": "risk:r03",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cisa-none"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2026-109618"
  },
  {
   "from": "risk:r03",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cloudflare-traffic"
  },
  {
   "from": "claim:cloudflare-traffic",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "risk:r03",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r03.1"
  },
  {
   "from": "risk:r03",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r03.2"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:kev:KEV-entry"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:kev:BOD22-01"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:DE.CM-01"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:SI-4"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:attack:T1595.002"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.16"
  },
  {
   "from": "risk:r03",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.7"
  },
  {
   "from": "risk:r03",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:patch-at-the-speed-of-metasploit"
  },
  {
   "from": "risk:r03",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:exposed-is-not-exploited"
  },
  {
   "from": "risk:r03",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:php2shell-in-perspective"
  },
  {
   "from": "risk:r03",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r03",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r03",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:exploitation/index.html"
  },
  {
   "from": "risk:r03",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:signals/index.html"
  },
  {
   "from": "risk:r03-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r03"
  },
  {
   "from": "risk:r03-1",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:threat-intel"
  },
  {
   "from": "risk:r03-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:security-lead"
  },
  {
   "from": "risk:r03-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-signal"
  },
  {
   "from": "risk:r03-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:amazon-honeypot"
  },
  {
   "from": "claim:amazon-honeypot",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "claim:amazon-honeypot",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:thehackernews-php2shell-4days"
  },
  {
   "from": "risk:r03-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:imperva-none"
  },
  {
   "from": "claim:imperva-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:imperva-blog-php2shell"
  },
  {
   "from": "risk:r03-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r03-1.1"
  },
  {
   "from": "risk:r03-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-02"
  },
  {
   "from": "risk:r03-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.7"
  },
  {
   "from": "risk:r03-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:SI-4"
  },
  {
   "from": "risk:r03-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:pcidss:12.10.1"
  },
  {
   "from": "risk:r03-1",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:exposed-is-not-exploited"
  },
  {
   "from": "risk:r03-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r03-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:exploitation/index.html"
  },
  {
   "from": "risk:r03-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r03"
  },
  {
   "from": "risk:r03-2",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:waf-vendors"
  },
  {
   "from": "risk:r03-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r03-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-waf-only"
  },
  {
   "from": "risk:r03-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cf-millions"
  },
  {
   "from": "claim:cf-millions",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-eastdakota-php2shell-stats"
  },
  {
   "from": "risk:r03-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cloudflare-traffic"
  },
  {
   "from": "claim:cloudflare-traffic",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "risk:r03-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:probing"
  },
  {
   "from": "claim:probing",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:probing",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "claim:probing",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "risk:r03-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r03-2.1"
  },
  {
   "from": "risk:r03-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:attack:T1595.002"
  },
  {
   "from": "risk:r03-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:DE.CM-01"
  },
  {
   "from": "risk:r03-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:13.10"
  },
  {
   "from": "risk:r03-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r03-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:exploitation/index.html"
  },
  {
   "from": "risk:r03-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:defence/index.html"
  },
  {
   "from": "risk:r03-3",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r03"
  },
  {
   "from": "risk:r03-3",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:threat-intel"
  },
  {
   "from": "risk:r03-3",
   "rel": "regulated_by",
   "inverse": "regulates",
   "to": "stakeholder:us-agencies"
  },
  {
   "from": "risk:r03-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:board"
  },
  {
   "from": "risk:r03-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-signal"
  },
  {
   "from": "risk:r03-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:watchtowr-itw"
  },
  {
   "from": "claim:watchtowr-itw",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:watchtowr-php2shell"
  },
  {
   "from": "claim:watchtowr-itw",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:watchtowr-php2shell-faq"
  },
  {
   "from": "risk:r03-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cisa-none"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2026-109618"
  },
  {
   "from": "risk:r03-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:huntress-none"
  },
  {
   "from": "claim:huntress-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:huntress-php2shell-rapid-response"
  },
  {
   "from": "risk:r03-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:no-confirmed-compromise"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:huntress-php2shell-rapid-response"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-first-attempts-sensors"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-exploitation-days-before"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:recordedfuture-php2shell"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:imperva-blog-php2shell"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:weirdgloop-blog-php2shell"
  },
  {
   "from": "risk:r03-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:nz-active"
  },
  {
   "from": "claim:nz-active",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-nz-alert-php"
  },
  {
   "from": "risk:r03-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r03-3.1"
  },
  {
   "from": "risk:r03-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:kev:KEV-entry"
  },
  {
   "from": "risk:r03-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-02"
  },
  {
   "from": "risk:r03-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:GV.RR-01"
  },
  {
   "from": "risk:r03-3",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:exposed-is-not-exploited"
  },
  {
   "from": "risk:r03-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r03-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r03-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:compromise/index.html"
  },
  {
   "from": "risk:r03-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:signals/index.html"
  },
  {
   "from": "risk:r03-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:exploitation/index.html"
  },
  {
   "from": "risk:r03-4",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r03"
  },
  {
   "from": "risk:r03-4",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:threat-intel"
  },
  {
   "from": "risk:r03-4",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:security-lead"
  },
  {
   "from": "risk:r03-4",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-signal"
  },
  {
   "from": "risk:r03-4",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-waf-only"
  },
  {
   "from": "risk:r03-4",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:pocs-wrong"
  },
  {
   "from": "claim:pocs-wrong",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-rjmendez-phpup-2026"
  },
  {
   "from": "claim:pocs-wrong",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:huntress-php2shell-rapid-response"
  },
  {
   "from": "risk:r03-4",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r03-4.1"
  },
  {
   "from": "risk:r03-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:RA-5"
  },
  {
   "from": "risk:r03-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:soc2:CC7.1"
  },
  {
   "from": "risk:r03-4",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-01"
  },
  {
   "from": "risk:r03-4",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:patch-at-the-speed-of-metasploit"
  },
  {
   "from": "risk:r03-4",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r03-4",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:defence/index.html"
  },
  {
   "from": "risk:r04",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:public-sector"
  },
  {
   "from": "risk:r04",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:service-users"
  },
  {
   "from": "risk:r04",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:agencies"
  },
  {
   "from": "risk:r04",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:board"
  },
  {
   "from": "risk:r04",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:comms"
  },
  {
   "from": "risk:r04",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-eol"
  },
  {
   "from": "risk:r04",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-inventory"
  },
  {
   "from": "risk:r04",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "risk:r04",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-nsa"
  },
  {
   "from": "claim:offline-nsa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:nsa-x-2112903220209098897"
  },
  {
   "from": "claim:offline-nsa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:nsa-press-php-4630238"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-cisa"
  },
  {
   "from": "claim:offline-cisa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:nl-offline"
  },
  {
   "from": "claim:nl-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:rijksoverheid-ncsc-php-news"
  },
  {
   "from": "claim:nl-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:dutchitleaders-websites-offline"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:fi-offline"
  },
  {
   "from": "claim:fi-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:yle-finland-government-sites-shut"
  },
  {
   "from": "claim:fi-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:helsinkitimes-finland-shutdown"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:latvia-offline"
  },
  {
   "from": "claim:latvia-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:certlv-php-preventive"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:affected-sites"
  },
  {
   "from": "claim:affected-sites",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "risk:r04",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:wikimedia-precaution"
  },
  {
   "from": "claim:wikimedia-precaution",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cnn-php2shell-websites-shut"
  },
  {
   "from": "claim:wikimedia-precaution",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cyberexpress-php2shell-gov-sites"
  },
  {
   "from": "risk:r04",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r04.1"
  },
  {
   "from": "risk:r04",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r04.2"
  },
  {
   "from": "risk:r04",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.29"
  },
  {
   "from": "risk:r04",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.30"
  },
  {
   "from": "risk:r04",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.21(2)(c)"
  },
  {
   "from": "risk:r04",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:dora:Art.11"
  },
  {
   "from": "risk:r04",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:CP-2"
  },
  {
   "from": "risk:r04",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:RC.RP-01"
  },
  {
   "from": "risk:r04",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:php2shell-in-perspective"
  },
  {
   "from": "risk:r04",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r04",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r04",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:impact/index.html"
  },
  {
   "from": "risk:r04",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:agencies/index.html"
  },
  {
   "from": "risk:r04-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r04"
  },
  {
   "from": "risk:r04-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:national-gov"
  },
  {
   "from": "risk:r04-1",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:service-users"
  },
  {
   "from": "risk:r04-1",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:eu-agencies"
  },
  {
   "from": "risk:r04-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-inventory"
  },
  {
   "from": "risk:r04-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:nl-offline"
  },
  {
   "from": "claim:nl-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:rijksoverheid-ncsc-php-news"
  },
  {
   "from": "claim:nl-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:dutchitleaders-websites-offline"
  },
  {
   "from": "risk:r04-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:fi-offline"
  },
  {
   "from": "claim:fi-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:yle-finland-government-sites-shut"
  },
  {
   "from": "claim:fi-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:helsinkitimes-finland-shutdown"
  },
  {
   "from": "risk:r04-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:latvia-offline"
  },
  {
   "from": "claim:latvia-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:certlv-php-preventive"
  },
  {
   "from": "risk:r04-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r04-1.1"
  },
  {
   "from": "risk:r04-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.21(2)(c)"
  },
  {
   "from": "risk:r04-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.29"
  },
  {
   "from": "risk:r04-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:RC.RP-01"
  },
  {
   "from": "risk:r04-1",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:php2shell-in-perspective"
  },
  {
   "from": "risk:r04-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r04-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:impact/index.html"
  },
  {
   "from": "risk:r04-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r04"
  },
  {
   "from": "risk:r04-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:councils"
  },
  {
   "from": "risk:r04-2",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:comms"
  },
  {
   "from": "risk:r04-2",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:uk-ncsc"
  },
  {
   "from": "risk:r04-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-eol"
  },
  {
   "from": "risk:r04-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:edinburgh"
  },
  {
   "from": "claim:edinburgh",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:scotsman-edinburgh-council-offline"
  },
  {
   "from": "risk:r04-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:oxford"
  },
  {
   "from": "claim:oxford",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:oxfordchronicle-councils-offline"
  },
  {
   "from": "risk:r04-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:uk-list"
  },
  {
   "from": "claim:uk-list",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:lbc-uk-websites-offline"
  },
  {
   "from": "claim:uk-list",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:insurancebusiness-uk-councils-met"
  },
  {
   "from": "risk:r04-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r04-2.1"
  },
  {
   "from": "risk:r04-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cyberessentials:SUM"
  },
  {
   "from": "risk:r04-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:RS.CO-03"
  },
  {
   "from": "risk:r04-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.24"
  },
  {
   "from": "risk:r04-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r04-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:impact/index.html"
  },
  {
   "from": "risk:r04-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:briefings/comms/index.html"
  },
  {
   "from": "risk:r04-3",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r04"
  },
  {
   "from": "risk:r04-3",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:agencies"
  },
  {
   "from": "risk:r04-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:board"
  },
  {
   "from": "risk:r04-3",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:media"
  },
  {
   "from": "risk:r04-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-headline"
  },
  {
   "from": "risk:r04-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-ncsc"
  },
  {
   "from": "claim:offline-ncsc",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:offline-ncsc",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-news-php"
  },
  {
   "from": "claim:offline-ncsc",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cccs-al26-026"
  },
  {
   "from": "risk:r04-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-allies"
  },
  {
   "from": "claim:offline-allies",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:offline-allies",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:acsc-alert-php"
  },
  {
   "from": "claim:offline-allies",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:certeu-sa-2026-018"
  },
  {
   "from": "claim:offline-allies",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-nl-php2shell"
  },
  {
   "from": "claim:offline-allies",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:acn-it-php2shell"
  },
  {
   "from": "claim:offline-allies",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:jpcert-at260033"
  },
  {
   "from": "risk:r04-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-nsa"
  },
  {
   "from": "claim:offline-nsa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:nsa-x-2112903220209098897"
  },
  {
   "from": "claim:offline-nsa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:nsa-press-php-4630238"
  },
  {
   "from": "risk:r04-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:offline-cisa"
  },
  {
   "from": "claim:offline-cisa",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "risk:r04-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r04-3.1"
  },
  {
   "from": "risk:r04-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.5"
  },
  {
   "from": "risk:r04-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:GV.RR-01"
  },
  {
   "from": "risk:r04-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.20"
  },
  {
   "from": "risk:r04-3",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r04-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r04-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:verifier"
  },
  {
   "from": "risk:r04-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:agencies/index.html"
  },
  {
   "from": "risk:r05",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:waf-vendors"
  },
  {
   "from": "risk:r05",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:security-lead"
  },
  {
   "from": "risk:r05",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:commerce"
  },
  {
   "from": "risk:r05",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-waf-only"
  },
  {
   "from": "risk:r05",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "risk:r05",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "risk:r05",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:waf"
  },
  {
   "from": "claim:waf",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:waf",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ch-bacs-warnung-php"
  },
  {
   "from": "claim:waf",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "risk:r05",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:waf-nine-hours"
  },
  {
   "from": "claim:waf-nine-hours",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "claim:waf-nine-hours",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:imperva-blog-php2shell"
  },
  {
   "from": "claim:waf-nine-hours",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:akamai-blog-php-core-rce"
  },
  {
   "from": "claim:waf-nine-hours",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:fastly-blog-php2shell"
  },
  {
   "from": "claim:waf-nine-hours",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:fortinet-fortiweb-php2shell"
  },
  {
   "from": "risk:r05",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:only-update"
  },
  {
   "from": "claim:only-update",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "claim:only-update",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-7"
  },
  {
   "from": "claim:only-update",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "risk:r05",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r05.1"
  },
  {
   "from": "risk:r05",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:pcidss:6.4.2"
  },
  {
   "from": "risk:r05",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:13.10"
  },
  {
   "from": "risk:r05",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:SC-7"
  },
  {
   "from": "risk:r05",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.20"
  },
  {
   "from": "risk:r05",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cyberessentials:FW"
  },
  {
   "from": "risk:r05",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:patch-at-the-speed-of-metasploit"
  },
  {
   "from": "risk:r05",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r05",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:defence/index.html"
  },
  {
   "from": "risk:r06",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:operators"
  },
  {
   "from": "risk:r06",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:dpo"
  },
  {
   "from": "risk:r06",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:data-subjects"
  },
  {
   "from": "risk:r06",
   "rel": "regulated_by",
   "inverse": "regulates",
   "to": "stakeholder:eu-agencies"
  },
  {
   "from": "risk:r06",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:board"
  },
  {
   "from": "risk:r06",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r06",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-stale-globals"
  },
  {
   "from": "risk:r06",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:no-confirmed-compromise"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:huntress-php2shell-rapid-response"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-first-attempts-sensors"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-exploitation-days-before"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:recordedfuture-php2shell"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:imperva-blog-php2shell"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:weirdgloop-blog-php2shell"
  },
  {
   "from": "risk:r06",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:rce-modphp"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-6"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "risk:r06",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r06.1"
  },
  {
   "from": "risk:r06",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.32"
  },
  {
   "from": "risk:r06",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.33"
  },
  {
   "from": "risk:r06",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.34"
  },
  {
   "from": "risk:r06",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.23"
  },
  {
   "from": "risk:r06",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:dora:Art.19"
  },
  {
   "from": "risk:r06",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.14"
  },
  {
   "from": "risk:r06",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r06",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:compromise/index.html"
  },
  {
   "from": "risk:r06",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:impact/index.html"
  },
  {
   "from": "risk:r06",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:playbook/index.html"
  },
  {
   "from": "risk:r06-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r06"
  },
  {
   "from": "risk:r06-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:dpo"
  },
  {
   "from": "risk:r06-1",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:data-subjects"
  },
  {
   "from": "risk:r06-1",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:managed-hosts"
  },
  {
   "from": "risk:r06-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r06-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:rce-modphp"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:openwall-oss-security-2026-10-21-6"
  },
  {
   "from": "claim:rce-modphp",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "risk:r06-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r06-1.1"
  },
  {
   "from": "risk:r06-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.5(1)(f)"
  },
  {
   "from": "risk:r06-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.24"
  },
  {
   "from": "risk:r06-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.28"
  },
  {
   "from": "risk:r06-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.32"
  },
  {
   "from": "risk:r06-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.33"
  },
  {
   "from": "risk:r06-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.34"
  },
  {
   "from": "risk:r06-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r06-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:grc"
  },
  {
   "from": "risk:r06-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:briefings/dpo/index.html"
  },
  {
   "from": "risk:r06-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:impact/index.html"
  },
  {
   "from": "risk:r06-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r06"
  },
  {
   "from": "risk:r06-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:critical-infra"
  },
  {
   "from": "risk:r06-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:finance"
  },
  {
   "from": "risk:r06-2",
   "rel": "regulated_by",
   "inverse": "regulates",
   "to": "stakeholder:eu-agencies"
  },
  {
   "from": "risk:r06-2",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:ciso"
  },
  {
   "from": "risk:r06-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-signal"
  },
  {
   "from": "risk:r06-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:no-confirmed-compromise"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:huntress-php2shell-rapid-response"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:aws-security-blog-madpot"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-first-attempts-sensors"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-exploitation-days-before"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:recordedfuture-php2shell"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:imperva-blog-php2shell"
  },
  {
   "from": "claim:no-confirmed-compromise",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:weirdgloop-blog-php2shell"
  },
  {
   "from": "risk:r06-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:nl-offline"
  },
  {
   "from": "claim:nl-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:rijksoverheid-ncsc-php-news"
  },
  {
   "from": "claim:nl-offline",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:dutchitleaders-websites-offline"
  },
  {
   "from": "risk:r06-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r06-2.1"
  },
  {
   "from": "risk:r06-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.23"
  },
  {
   "from": "risk:r06-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nis2:Art.20"
  },
  {
   "from": "risk:r06-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:dora:Art.19"
  },
  {
   "from": "risk:r06-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:dora:Art.10"
  },
  {
   "from": "risk:r06-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:IR-6"
  },
  {
   "from": "risk:r06-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r06-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:impact/index.html"
  },
  {
   "from": "risk:r06-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:agencies/index.html"
  },
  {
   "from": "risk:r06-3",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r06"
  },
  {
   "from": "risk:r06-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:inventory-suppliers"
  },
  {
   "from": "risk:r06-3",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:php-foundation"
  },
  {
   "from": "risk:r06-3",
   "rel": "regulated_by",
   "inverse": "regulates",
   "to": "stakeholder:eu-agencies"
  },
  {
   "from": "risk:r06-3",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:engineers"
  },
  {
   "from": "risk:r06-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-inventory"
  },
  {
   "from": "risk:r06-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-signal"
  },
  {
   "from": "risk:r06-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-ncsc-nl"
  },
  {
   "from": "claim:scale-ncsc-nl",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-nl-php2shell-software-list"
  },
  {
   "from": "risk:r06-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:watchtowr-itw"
  },
  {
   "from": "claim:watchtowr-itw",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:watchtowr-php2shell"
  },
  {
   "from": "claim:watchtowr-itw",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:watchtowr-php2shell-faq"
  },
  {
   "from": "risk:r06-3",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cisa-none"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-alert-php-20261021"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cisa-kev-json"
  },
  {
   "from": "claim:cisa-none",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cve-cve-2026-109618"
  },
  {
   "from": "risk:r06-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r06-3.1"
  },
  {
   "from": "risk:r06-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.14"
  },
  {
   "from": "risk:r06-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.13"
  },
  {
   "from": "risk:r06-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.24"
  },
  {
   "from": "risk:r06-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:AnnexI.II"
  },
  {
   "from": "risk:r06-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r06-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:affected/software.html"
  },
  {
   "from": "risk:r06-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:exploitation/index.html"
  },
  {
   "from": "risk:r07",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:media"
  },
  {
   "from": "risk:r07",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:wiz"
  },
  {
   "from": "risk:r07",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:board"
  },
  {
   "from": "risk:r07",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:newsroom"
  },
  {
   "from": "risk:r07",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-headline"
  },
  {
   "from": "risk:r07",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "risk:r07",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "risk:r07",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-70pc-internet"
  },
  {
   "from": "claim:scale-70pc-internet",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "claim:scale-70pc-internet",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-wiz-io-php2shell"
  },
  {
   "from": "claim:scale-70pc-internet",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "risk:r07",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-70pc-websites"
  },
  {
   "from": "claim:scale-70pc-websites",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:cloudflare-blog-php2shell-waf"
  },
  {
   "from": "claim:scale-70pc-websites",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-openai-php2shell"
  },
  {
   "from": "claim:scale-70pc-websites",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "risk:r07",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:cvss-10"
  },
  {
   "from": "claim:cvss-10",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:cvss-10",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:daubois-blog-php2shell-rumors"
  },
  {
   "from": "risk:r07",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-30m"
  },
  {
   "from": "claim:scale-30m",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "risk:r07",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:most-severe"
  },
  {
   "from": "claim:most-severe",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:most-severe",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "risk:r07",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:disclosure-22oct"
  },
  {
   "from": "claim:disclosure-22oct",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:disclosure-22oct",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-net-advisory"
  },
  {
   "from": "claim:disclosure-22oct",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-php-src-tag-php-8.5.12"
  },
  {
   "from": "risk:r07",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r07.1"
  },
  {
   "from": "risk:r07",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:GV.RM-01"
  },
  {
   "from": "risk:r07",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:6.1.2"
  },
  {
   "from": "risk:r07",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:LLM09:2025"
  },
  {
   "from": "risk:r07",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:where-php2shell-stands"
  },
  {
   "from": "risk:r07",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:exposed-is-not-exploited"
  },
  {
   "from": "risk:r07",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:verifier"
  },
  {
   "from": "risk:r07",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:journalist"
  },
  {
   "from": "risk:r07",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:numbers/index.html"
  },
  {
   "from": "risk:r07",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:factcheck/index.html"
  },
  {
   "from": "risk:r08",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:openai"
  },
  {
   "from": "risk:r08",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:finders"
  },
  {
   "from": "risk:r08",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:php-project"
  },
  {
   "from": "risk:r08",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:world"
  },
  {
   "from": "risk:r08",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:ciso"
  },
  {
   "from": "risk:r08",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-ai-dual-use"
  },
  {
   "from": "risk:r08",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-maintainer-capacity"
  },
  {
   "from": "risk:r08",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "risk:r08",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "risk:r08",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:ai-found"
  },
  {
   "from": "claim:ai-found",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "claim:ai-found",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-openai-php2shell"
  },
  {
   "from": "claim:ai-found",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:calif-php2shell"
  },
  {
   "from": "claim:ai-found",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "risk:r08",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:ahead-of-attackers"
  },
  {
   "from": "claim:ahead-of-attackers",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-openai-php2shell"
  },
  {
   "from": "claim:ahead-of-attackers",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:thehackernews-php2shell-4days"
  },
  {
   "from": "risk:r08",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:lorenc-ai-found"
  },
  {
   "from": "claim:lorenc-ai-found",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:theregister-php-blames-chainguard"
  },
  {
   "from": "risk:r08",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:vibe-code"
  },
  {
   "from": "claim:vibe-code",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:bbc-live-ckgel5xp2xv9t"
  },
  {
   "from": "risk:r08",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:openai-same-day"
  },
  {
   "from": "claim:openai-same-day",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:openai-same-day",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "risk:r08",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:wiz-independent"
  },
  {
   "from": "claim:wiz-independent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "claim:wiz-independent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "risk:r08",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r08.1"
  },
  {
   "from": "risk:r08",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:euaiact:Art.55"
  },
  {
   "from": "risk:r08",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistairmf:GOVERN-6.1"
  },
  {
   "from": "risk:r08",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistairmf:MEASURE-2.7"
  },
  {
   "from": "risk:r08",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso42001:6.1.2"
  },
  {
   "from": "risk:r08",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:php2shell-in-perspective"
  },
  {
   "from": "risk:r08",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r08",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:discovery/index.html"
  },
  {
   "from": "risk:r08",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:context/index.html"
  },
  {
   "from": "risk:r08-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r08"
  },
  {
   "from": "risk:r08-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:php-project"
  },
  {
   "from": "risk:r08-1",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:quarkslab"
  },
  {
   "from": "risk:r08-1",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:php-foundation"
  },
  {
   "from": "risk:r08-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-maintainer-capacity"
  },
  {
   "from": "risk:r08-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-alloc-bailout"
  },
  {
   "from": "risk:r08-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:quarkslab-2024"
  },
  {
   "from": "claim:quarkslab-2024",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:quarkslab-2024",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:calif-php2shell"
  },
  {
   "from": "risk:r08-1",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:quarkslab-redacted"
  },
  {
   "from": "claim:quarkslab-redacted",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:quarkslab-blog-php-src-audit"
  },
  {
   "from": "claim:quarkslab-redacted",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:substack-lopezkurtz-patch-is-the-exploit"
  },
  {
   "from": "risk:r08-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r08-1.1"
  },
  {
   "from": "risk:r08-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:ssdf:PW.7"
  },
  {
   "from": "risk:r08-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:ssdf:RV.2"
  },
  {
   "from": "risk:r08-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:Art.24"
  },
  {
   "from": "risk:r08-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.25"
  },
  {
   "from": "risk:r08-1",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:php2shell-in-perspective"
  },
  {
   "from": "risk:r08-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r08-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:discovery/index.html"
  },
  {
   "from": "risk:r08-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r08"
  },
  {
   "from": "risk:r08-2",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:php-security-team"
  },
  {
   "from": "risk:r08-2",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:finders"
  },
  {
   "from": "risk:r08-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:php-foundation"
  },
  {
   "from": "risk:r08-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-maintainer-capacity"
  },
  {
   "from": "risk:r08-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:four-reporters"
  },
  {
   "from": "claim:four-reporters",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "claim:four-reporters",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-6wmf-4rv5-p3rp"
  },
  {
   "from": "claim:four-reporters",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:daubois-blog-php2shell-rumors"
  },
  {
   "from": "risk:r08-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:who-first"
  },
  {
   "from": "claim:who-first",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:calif-php2shell"
  },
  {
   "from": "claim:who-first",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:x-lcfr-hax-hash-tweet"
  },
  {
   "from": "claim:who-first",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "risk:r08-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:openai-same-day"
  },
  {
   "from": "claim:openai-same-day",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "claim:openai-same-day",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:github-ghsa-w8hw-w9fx-j79w"
  },
  {
   "from": "risk:r08-2",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:wiz-independent"
  },
  {
   "from": "claim:wiz-independent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:wiz-blog-php2shell"
  },
  {
   "from": "claim:wiz-independent",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:php-foundation-blog-security-release"
  },
  {
   "from": "risk:r08-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r08-2.1"
  },
  {
   "from": "risk:r08-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso29147:29147:receipt"
  },
  {
   "from": "risk:r08-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.RA-08"
  },
  {
   "from": "risk:r08-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:ssdf:RV.1"
  },
  {
   "from": "risk:r08-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:historian"
  },
  {
   "from": "risk:r08-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:discovery/index.html"
  },
  {
   "from": "risk:r09",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:cto"
  },
  {
   "from": "risk:r09",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:engineers"
  },
  {
   "from": "risk:r09",
   "rel": "informed_by",
   "inverse": "informs",
   "to": "stakeholder:inventory-suppliers"
  },
  {
   "from": "risk:r09",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-inventory"
  },
  {
   "from": "risk:r09",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109618"
  },
  {
   "from": "risk:r09",
   "rel": "concerns",
   "inverse": "concerned_in",
   "to": "vulnerability:cve-109619"
  },
  {
   "from": "risk:r09",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-ncsc-nl"
  },
  {
   "from": "claim:scale-ncsc-nl",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:ncsc-nl-php2shell-software-list"
  },
  {
   "from": "risk:r09",
   "rel": "backed_by",
   "inverse": "evidences",
   "to": "claim:scale-2.6m-hosts"
  },
  {
   "from": "claim:scale-2.6m-hosts",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:thehackernews-php2shell-4days"
  },
  {
   "from": "claim:scale-2.6m-hosts",
   "rel": "cites",
   "inverse": "cited_by",
   "to": "source:securityweek-exploitation-days-before"
  },
  {
   "from": "risk:r09",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r09.1"
  },
  {
   "from": "risk:r09",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistcsf:ID.AM-02"
  },
  {
   "from": "risk:r09",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nist80053:CM-8"
  },
  {
   "from": "risk:r09",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cis:16.4"
  },
  {
   "from": "risk:r09",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:dora:Art.8"
  },
  {
   "from": "risk:r09",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.8.9"
  },
  {
   "from": "risk:r09",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:cra:AnnexI.II"
  },
  {
   "from": "risk:r09",
   "rel": "told_in",
   "inverse": "tells",
   "to": "story:exposed-is-not-exploited"
  },
  {
   "from": "risk:r09",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r09",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:playbook/index.html"
  },
  {
   "from": "risk:r09",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:affected/software.html"
  },
  {
   "from": "risk:r10",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:newsroom-editor"
  },
  {
   "from": "risk:r10",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:newsroom-agents"
  },
  {
   "from": "risk:r10",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:readers"
  },
  {
   "from": "risk:r10",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-agent-reach"
  },
  {
   "from": "risk:r10",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-untrusted-text"
  },
  {
   "from": "risk:r10",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-status-words"
  },
  {
   "from": "risk:r10",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r10.1"
  },
  {
   "from": "risk:r10",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r10.2"
  },
  {
   "from": "risk:r10",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:euaiact:Art.50"
  },
  {
   "from": "risk:r10",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistairmf:MANAGE-2.4"
  },
  {
   "from": "risk:r10",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso42001:6.1.3"
  },
  {
   "from": "risk:r10",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:LLM06:2025"
  },
  {
   "from": "risk:r10",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:dev"
  },
  {
   "from": "risk:r10",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:conductor"
  },
  {
   "from": "risk:r10",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:admin/agents/index.html"
  },
  {
   "from": "risk:r10",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:team/index.html"
  },
  {
   "from": "risk:r10-1",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r10"
  },
  {
   "from": "risk:r10-1",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:newsroom-agents"
  },
  {
   "from": "risk:r10-1",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:newsroom-editor"
  },
  {
   "from": "risk:r10-1",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-untrusted-text"
  },
  {
   "from": "risk:r10-1",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r10-1.1"
  },
  {
   "from": "risk:r10-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:LLM01:2025"
  },
  {
   "from": "risk:r10-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:nistairmf:MEASURE-2.7"
  },
  {
   "from": "risk:r10-1",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:euaiact:Art.15"
  },
  {
   "from": "risk:r10-1",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:dev"
  },
  {
   "from": "risk:r10-1",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:admin/agents/index.html"
  },
  {
   "from": "risk:r10-2",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r10"
  },
  {
   "from": "risk:r10-2",
   "rel": "treated_by",
   "inverse": "treats",
   "to": "stakeholder:newsroom-agents"
  },
  {
   "from": "risk:r10-2",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:newsroom-editor"
  },
  {
   "from": "risk:r10-2",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:readers"
  },
  {
   "from": "risk:r10-2",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-agent-reach"
  },
  {
   "from": "risk:r10-2",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r10-2.1"
  },
  {
   "from": "risk:r10-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:LLM02:2025"
  },
  {
   "from": "risk:r10-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:gdpr:Art.32"
  },
  {
   "from": "risk:r10-2",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:iso27001:A.5.14"
  },
  {
   "from": "risk:r10-2",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:dev"
  },
  {
   "from": "risk:r10-2",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:vaults/index.html"
  },
  {
   "from": "risk:r10-3",
   "rel": "part_of",
   "inverse": "has_part",
   "to": "risk:r10"
  },
  {
   "from": "risk:r10-3",
   "rel": "raised_by",
   "inverse": "raises",
   "to": "stakeholder:newsroom-agents"
  },
  {
   "from": "risk:r10-3",
   "rel": "borne_by",
   "inverse": "bears",
   "to": "stakeholder:readers"
  },
  {
   "from": "risk:r10-3",
   "rel": "owned_by",
   "inverse": "owns",
   "to": "stakeholder:newsroom-editor"
  },
  {
   "from": "risk:r10-3",
   "rel": "arises_from",
   "inverse": "gives_rise_to",
   "to": "weakness:w-status-words"
  },
  {
   "from": "risk:r10-3",
   "rel": "protected_by",
   "inverse": "protects",
   "to": "treatment:r10-3.1"
  },
  {
   "from": "risk:r10-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:owasp:LLM09:2025"
  },
  {
   "from": "risk:r10-3",
   "rel": "governed_by",
   "inverse": "governs",
   "to": "control:euaiact:Art.50"
  },
  {
   "from": "risk:r10-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:verifier"
  },
  {
   "from": "risk:r10-3",
   "rel": "tracked_by",
   "inverse": "tracks",
   "to": "member:story-site"
  },
  {
   "from": "risk:r10-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:factcheck/index.html"
  },
  {
   "from": "risk:r10-3",
   "rel": "shown_on",
   "inverse": "shows",
   "to": "page:method/index.html"
  }
 ]
}