Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / GDPR

GDPR: the php2shell risks it governs

A PHP application that executes an attacker's code exposes the personal data it holds; whoever controls that data answers for its security and for notifying a breach.

Full name General Data Protection Regulation, Regulation (EU) 2016/679 · Publisher European Union · Version 2016, in force 25 May 2018 · the official text

Clauses and controls

ControlWhat it asks (paraphrased)Risks mappedOwned or regulated by
Art.5(1)(f)Integrity and confidentiality: personal data processed with appropriate securityR06-1 Personal data taken from a compromised PHP application 15 highData protection officer
Art.24Responsibility of the controller: measures appropriate to the riskR06-1 Personal data taken from a compromised PHP application 15 highData protection officer
Art.28Processors: the controller uses only processors that give sufficient guaranteesR06-1 Personal data taken from a compromised PHP application 15 highData protection officer
Art.32Security of processing, including a process for regularly testing and evaluating itR06 A compromise becomes a reportable breach 15 high
R06-1 Personal data taken from a compromised PHP application 15 high
R10-2 A vault key or token published 10 medium		Data protection officer, Organisations running PHP, EU and member-state CERTs, Board and executives, The editor
Art.33Notifying a personal data breach to the supervisory authority within 72 hoursR06 A compromise becomes a reportable breach 15 high
R06-1 Personal data taken from a compromised PHP application 15 high		Data protection officer, Organisations running PHP, EU and member-state CERTs, Board and executives
Art.34Communicating a high-risk personal data breach to the people affectedR06 A compromise becomes a reportable breach 15 high
R06-1 Personal data taken from a compromised PHP application 15 high		Data protection officer, Organisations running PHP, EU and member-state CERTs, Board and executives