Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / CISA KEV and BOD 22-01
CISA KEV and BOD 22-01: the php2shell risks it governs
The public test of 'exploited': a CVE enters the catalogue on evidence of exploitation in the wild, and US federal agencies must then remediate by a due date. php2shell is not in it as of the vault's last capture.
Full name CISA Known Exploited Vulnerabilities catalog and Binding Operational Directive 22-01 · Publisher US CISA · Version BOD 22-01, November 2021 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| BOD22-01 | Federal agencies remediate catalogued vulnerabilities by the due date set | R03 Exploitation outpaces patching 20 critical | Organisations running PHP, US: CISA and the NSA |
| KEV-entry | A CVE enters the catalogue on reliable evidence of active exploitation | R03 Exploitation outpaces patching 20 critical R03-3 Exploited in the wild without anyone being able to show it 12 high | US: CISA and the NSA, Organisations running PHP, Board and executives |