Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / MITRE ATT&CK
MITRE ATT&CK: the php2shell risks it governs
How the threat is described in detection terms: scanning for the flaw first, then exploiting a public-facing application.
Full name MITRE ATT&CK Enterprise · Publisher MITRE · Version Enterprise v17 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| T1595.002 | Active scanning: vulnerability scanning | R03 Exploitation outpaces patching 20 critical R03-2 Mass scanning and mutated payloads after the leak 20 critical | Organisations running PHP, US: CISA and the NSA |
| T1190 | Exploit public-facing application | R01 Remote code execution on internet-facing PHP servers 15 high | Organisations running PHP |