Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / NIST SP 800-53

NIST SP 800-53: the php2shell risks it governs

The control catalogue behind US federal systems, which CISA and the NSA told to update or go offline.

Full name NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations · Publisher US National Institute of Standards and Technology · Version Rev. 5 · the official text

Clauses and controls

Control	What it asks (paraphrased)	Risks mapped	Owned or regulated by
RA-3	Risk assessment	no risk mapped
RA-5	Vulnerability monitoring and scanning	R03-4 Detections built on a proof of concept with the wrong mechanism 12 high	Security lead and AppSec
SI-2	Flaw remediation	R01 Remote code execution on internet-facing PHP servers 15 high	Organisations running PHP
SI-4	System monitoring	R03 Exploitation outpaces patching 20 critical R03-1 Attempts before disclosure 15 high	Organisations running PHP, US: CISA and the NSA, Security lead and AppSec
SA-22	Unsupported system components	R01-3 Versions the PHP project no longer fixes stay vulnerable 20 critical	Organisations running PHP, CTO
CM-8	System component inventory	R09 Not knowing where PHP runs 16 high	CTO
SC-7	Boundary protection	R05 A web application firewall taken for a patch 16 high	Security lead and AppSec
CP-2	Contingency plan	R04 Services lost to precautionary shutdowns 20 critical	Governments and public services, Board and executives
IR-4	Incident handling	no risk mapped
IR-6	Incident reporting	R06-2 Essential and financial entities miss their reporting clocks 12 high	Critical infrastructure providers, Banks, insurers and financial entities, EU and member-state CERTs
SR-3	Supply chain controls and processes	no risk mapped
PM-15	Security and privacy groups and associations	no risk mapped