# CISA KEV and BOD 22-01: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each CISA KEV and BOD 22-01 clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / CISA KEV and BOD 22-01

# CISA KEV and BOD 22-01: the php2shell risks it governs

The public test of 'exploited': a CVE enters the catalogue on evidence of exploitation in the wild, and US federal agencies must then remediate by a due date. php2shell is not in it as of the vault's last capture.

**Full name** CISA Known Exploited Vulnerabilities catalog and Binding Operational Directive 22-01 · **Publisher** US CISA · **Version** BOD 22-01, November 2021 · [the official text](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **BOD22-01** | Federal agencies remediate catalogued vulnerabilities by the due date set | [R03 Exploitation outpaces patching](../../../grc/risks/r03/index.html) **20** critical | [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [US: CISA and the NSA](../../../grc/stakeholders/us-agencies/index.html) |
| **KEV-entry** | A CVE enters the catalogue on reliable evidence of active exploitation | [R03 Exploitation outpaces patching](../../../grc/risks/r03/index.html) **20** critical [R03-3 Exploited in the wild without anyone being able to show it](../../../grc/risks/r03-3/index.html) **12** high | [US: CISA and the NSA](../../../grc/stakeholders/us-agencies/index.html), [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [Board and executives](../../../grc/stakeholders/board/index.html) |


---
site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/kev/index.html