Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / ISO/IEC 29147 and 30111
ISO/IEC 29147 and 30111: the php2shell risks it governs
The standards for exactly what broke on 20 and 21 October: receiving reports from several finders, keeping an embargo, coordinating a release and publishing the advisory.
Full name ISO/IEC 29147:2018 Vulnerability disclosure and ISO/IEC 30111:2019 Vulnerability handling processes · Publisher ISO and IEC · Version 2018 and 2019 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| 29147:receipt | Receiving vulnerability reports and acknowledging the finder | R08-2 Several finders, one small team 12 high | The PHP Foundation |
| 29147:coordination | Coordinating disclosure with other vendors and parties under embargo | R02 The coordinated disclosure broke before the fix was ready 20 critical R02-1 The CVE IDs and the proof-of-concept video circulated before release 20 critical R02-2 Early mitigation advice to a few providers leaked 9 medium R02-3 Patched builds published before the embargo lifted 16 high | The PHP security team, Distributors and packagers |
| 29147:advisory | Publishing the advisory: affected versions, remediation, credit | no risk mapped | |
| 30111:handling | Investigating, remediating and releasing the fix, and learning from it | R01-4 The fix is incomplete, or a third flaw follows 15 high | The fix authors |