Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / ISO/IEC 27001

ISO/IEC 27001: the php2shell risks it governs

The management system most organisations in this story are certified to: risk assessment and treatment in clauses 6 and 8, and the controls an auditor will ask about after php2shell.

Full name ISO/IEC 27001:2022 Information security management systems, with the Annex A controls of ISO/IEC 27002:2022 · Publisher ISO and IEC · Version 2022 · the official text

Clauses and controls

Control	What it asks (paraphrased)	Risks mapped	Owned or regulated by
6.1.2	Information security risk assessment: identify risks and their owners	R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable 12 high R07 Decisions made on numbers that measure something else 12 high	Security lead and AppSec, Board and executives
6.1.3	Information security risk treatment, and the statement of applicability	no risk mapped
A.5.5	Contact with authorities	R04-3 The agencies' advice disagrees 12 high	Board and executives
A.5.6	Contact with special interest groups	no risk mapped
A.5.7	Threat intelligence	R03 Exploitation outpaces patching 20 critical R03-1 Attempts before disclosure 15 high	Organisations running PHP, US: CISA and the NSA, Security lead and AppSec
A.5.14	Information transfer, including under agreed classification	R02-2 Early mitigation advice to a few providers leaked 9 medium R10-2 A vault key or token published 10 medium	The PHP security team, The editor
A.5.19	Information security in supplier relationships	no risk mapped
A.5.21	Managing information security in the ICT supply chain	R01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high	Suppliers in the NCSC-NL inventory, CTO
A.5.23	Information security for use of cloud services	no risk mapped
A.5.24	Incident management planning and preparation	R04-2 Councils and police offline without saying why 15 high	Local councils
A.5.26	Response to information security incidents	no risk mapped
A.5.29	Information security during disruption	R04 Services lost to precautionary shutdowns 20 critical R04-1 National government services offline 20 critical	Governments and public services, Board and executives, National governments
A.5.30	ICT readiness for business continuity	R04 Services lost to precautionary shutdowns 20 critical	Governments and public services, Board and executives
A.8.8	Management of technical vulnerabilities	R01 Remote code execution on internet-facing PHP servers 15 high R01-1 Default Apache mod_php installations exploited before application code runs 15 high	Organisations running PHP, Shared and self-service hosting
A.8.9	Configuration management	R09 Not knowing where PHP runs 16 high	CTO
A.8.16	Monitoring activities	R03 Exploitation outpaces patching 20 critical	Organisations running PHP, US: CISA and the NSA
A.8.20	Network security	R05 A web application firewall taken for a patch 16 high	Security lead and AppSec
A.8.25	Secure development life cycle	R08-1 A known bug left unexploited, then unfixed, for two years 16 high	The PHP project
A.8.28	Secure coding	no risk mapped
A.8.29	Security testing in development and acceptance	R01-4 The fix is incomplete, or a third flaw follows 15 high	The fix authors
A.8.32	Change management	no risk mapped