Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / CIS Controls

CIS Controls: the php2shell risks it governs

The prioritised list smaller organisations, councils and schools among them, actually work from.

Full name CIS Critical Security Controls v8.1 · Publisher Center for Internet Security · Version 8.1 · the official text

Clauses and controls

Control	What it asks (paraphrased)	Risks mapped	Owned or regulated by
2.2	Ensure authorised software is currently supported	R01-3 Versions the PHP project no longer fixes stay vulnerable 20 critical	Organisations running PHP, CTO
7.1	Establish and maintain a vulnerability management process	no risk mapped
7.4	Perform automated application patch management	R01-1 Default Apache mod_php installations exploited before application code runs 15 high	Shared and self-service hosting
7.7	Remediate detected vulnerabilities	R01 Remote code execution on internet-facing PHP servers 15 high	Organisations running PHP
13.10	Perform application layer filtering	R03-2 Mass scanning and mutated payloads after the leak 20 critical R05 A web application firewall taken for a patch 16 high	Organisations running PHP, Security lead and AppSec
16.4	Establish and manage an inventory of third-party software components	R01-5 Popular applications compromised before authentication 15 high R09 Not knowing where PHP runs 16 high	Website owner, CTO
17.4	Establish and maintain an incident response process	no risk mapped