Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / DORA

DORA: the php2shell risks it governs

Banks, insurers and other financial entities running PHP, or relying on an ICT provider that does, must identify, protect, detect, respond and report under one regime, and manage the provider as a third-party risk.

Full name Digital Operational Resilience Act, Regulation (EU) 2022/2554 · Publisher European Union · Version 2022, applies from 17 January 2025 · the official text

Clauses and controls

Control	What it asks (paraphrased)	Risks mapped	Owned or regulated by
Art.8	Identification of ICT assets, their dependencies and the risks to them	R09 Not knowing where PHP runs 16 high	CTO
Art.9	Protection and prevention, including patches and updates	no risk mapped
Art.10	Detection of anomalous activities	R06-2 Essential and financial entities miss their reporting clocks 12 high	Critical infrastructure providers, Banks, insurers and financial entities, EU and member-state CERTs
Art.11	Response and recovery, including ICT business continuity	R04 Services lost to precautionary shutdowns 20 critical	Governments and public services, Board and executives
Art.19	Reporting major ICT-related incidents	R06 A compromise becomes a reportable breach 15 high R06-2 Essential and financial entities miss their reporting clocks 12 high	EU and member-state CERTs, Organisations running PHP, Data protection officer, Board and executives, Critical infrastructure providers
Art.28	Managing ICT third-party risk	R01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high	Suppliers in the NCSC-NL inventory, CTO