# MITRE ATT&CK: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each MITRE ATT&CK clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / MITRE ATT&CK

# MITRE ATT&CK: the php2shell risks it governs

How the threat is described in detection terms: scanning for the flaw first, then exploiting a public-facing application.

**Full name** MITRE ATT&CK Enterprise · **Publisher** MITRE · **Version** Enterprise v17 · [the official text](https://attack.mitre.org/)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **T1595.002** | Active scanning: vulnerability scanning | [R03 Exploitation outpaces patching](../../../grc/risks/r03/index.html) **20** critical [R03-2 Mass scanning and mutated payloads after the leak](../../../grc/risks/r03-2/index.html) **20** critical | [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [US: CISA and the NSA](../../../grc/stakeholders/us-agencies/index.html) |
| **T1190** | Exploit public-facing application | [R01 Remote code execution on internet-facing PHP servers](../../../grc/risks/r01/index.html) **15** high | [Organisations running PHP](../../../grc/stakeholders/operators/index.html) |


---
site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/attack/index.html