Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / Cyber Resilience Act

Cyber Resilience Act: the php2shell risks it governs

php2shell is among the first critical flaws in a ubiquitous open-source component since the Act's reporting duty began: a manufacturer whose product ships PHP must handle the flaw and report an actively exploited one; the PHP project is the kind of open-source steward the Act treats lightly.

Full name Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements · Publisher European Union · Version 2024; reporting obligations apply from 11 September 2026 · the official text

Clauses and controls

ControlWhat it asks (paraphrased)Risks mappedOwned or regulated by
Art.13Obligations of manufacturers, including due diligence on integrated third-party and open-source componentsR01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high
R02-3 Patched builds published before the embargo lifted 16 high
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report 12 high		Suppliers in the NCSC-NL inventory, CTO, Distributors and packagers, The PHP security team, EU and member-state CERTs
Art.14Reporting an actively exploited vulnerability: early warning within 24 hours to the CSIRT and ENISAR06 A compromise becomes a reportable breach 15 high
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report 12 high		EU and member-state CERTs, Organisations running PHP, Data protection officer, Board and executives, Suppliers in the NCSC-NL inventory
Art.24Obligations of open-source software stewardsR06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report 12 high
R08-1 A known bug left unexploited, then unfixed, for two years 16 high		Suppliers in the NCSC-NL inventory, EU and member-state CERTs, The PHP project
AnnexI.IIVulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosureR01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report 12 high
R09 Not knowing where PHP runs 16 high		Suppliers in the NCSC-NL inventory, CTO, EU and member-state CERTs