# Cyber Essentials: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each Cyber Essentials clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / Cyber Essentials

# Cyber Essentials: the php2shell risks it governs

The baseline UK councils and public-sector suppliers certify against; several of the councils in this story went offline.

**Full name** UK Cyber Essentials: Requirements for IT infrastructure · **Publisher** UK NCSC and IASME · **Version** v3.2 (Willow), 2025 · [the official text](https://www.ncsc.gov.uk/cyberessentials/overview)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **SUM** | Security update management: high and critical updates within 14 days of release; unsupported software removed | [R01-1 Default Apache mod_php installations exploited before application code runs](../../../grc/risks/r01-1/index.html) **15** high [R01-3 Versions the PHP project no longer fixes stay vulnerable](../../../grc/risks/r01-3/index.html) **20** critical [R04-2 Councils and police offline without saying why](../../../grc/risks/r04-2/index.html) **15** high | [Shared and self-service hosting](../../../grc/stakeholders/shared-hosts/index.html), [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [CTO](../../../grc/stakeholders/cto/index.html), [Local councils](../../../grc/stakeholders/councils/index.html) |
| **FW** | Firewalls: boundary protection for internet-facing services | [R05 A web application firewall taken for a patch](../../../grc/risks/r05/index.html) **16** high | [Security lead and AppSec](../../../grc/stakeholders/security-lead/index.html) |


---
site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/cyberessentials/index.html