Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / NIS2

NIS2: the php2shell risks it governs

Essential and important entities (energy, health, digital infrastructure, public administration and more) must manage vulnerabilities, handle incidents and report significant ones; management bodies answer for it personally.

Full name Directive (EU) 2022/2555 on a high common level of cybersecurity across the Union · Publisher European Union · Version 2022, transposition deadline 17 October 2024 · the official text

Clauses and controls

ControlWhat it asks (paraphrased)Risks mappedOwned or regulated by
Art.12Coordinated vulnerability disclosure and the European vulnerability databaseR02 The coordinated disclosure broke before the fix was ready 20 criticalThe PHP security team
Art.20Governance: management bodies approve and oversee the risk-management measures and can be held liableR04-3 The agencies' advice disagrees 12 high
R06-2 Essential and financial entities miss their reporting clocks 12 high		Board and executives, Critical infrastructure providers, Banks, insurers and financial entities, EU and member-state CERTs
Art.21(2)(a)Policies on risk analysis and information system securityno risk mapped
Art.21(2)(b)Incident handlingno risk mapped
Art.21(2)(c)Business continuity, backup management, disaster recovery and crisis managementR04 Services lost to precautionary shutdowns 20 critical
R04-1 National government services offline 20 critical		Governments and public services, Board and executives, National governments
Art.21(2)(d)Supply chain security, including the security of each direct supplierR01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 highSuppliers in the NCSC-NL inventory, CTO
Art.21(2)(e)Security in acquisition, development and maintenance, including vulnerability handling and disclosureR01 Remote code execution on internet-facing PHP servers 15 highOrganisations running PHP
Art.23Reporting significant incidents: early warning in 24 hours, notification in 72 hours, final report in a monthR06 A compromise becomes a reportable breach 15 high
R06-2 Essential and financial entities miss their reporting clocks 12 high		EU and member-state CERTs, Organisations running PHP, Data protection officer, Board and executives, Critical infrastructure providers