Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / Cyber Essentials
Cyber Essentials: the php2shell risks it governs
The baseline UK councils and public-sector suppliers certify against; several of the councils in this story went offline.
Full name UK Cyber Essentials: Requirements for IT infrastructure · Publisher UK NCSC and IASME · Version v3.2 (Willow), 2025 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| SUM | Security update management: high and critical updates within 14 days of release; unsupported software removed | R01-1 Default Apache mod_php installations exploited before application code runs 15 high R01-3 Versions the PHP project no longer fixes stay vulnerable 20 critical R04-2 Councils and police offline without saying why 15 high | Shared and self-service hosting, Organisations running PHP, CTO, Local councils |
| FW | Firewalls: boundary protection for internet-facing services | R05 A web application firewall taken for a patch 16 high | Security lead and AppSec |