Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Frameworks / NIST CSF 2.0

NIST CSF 2.0: the php2shell risks it governs

The outcome language boards and regulators on both sides of the Atlantic now use; GOVERN makes supply chain and risk ownership a first-class function.

Full name NIST Cybersecurity Framework 2.0 (CSWP 29) · Publisher US National Institute of Standards and Technology · Version 2.0, February 2024 · the official text

Clauses and controls

Control	What it asks (paraphrased)	Risks mapped	Owned or regulated by
GV.RM-01	Risk management objectives are established and agreed by stakeholders	R07 Decisions made on numbers that measure something else 12 high	Board and executives
GV.RR-01	Leadership is responsible and accountable for cybersecurity risk	R03-3 Exploited in the wild without anyone being able to show it 12 high R04-3 The agencies' advice disagrees 12 high	Board and executives, US: CISA and the NSA
GV.SC-05	Supply chain requirements are established and integrated into contracts	R02-3 Patched builds published before the embargo lifted 16 high	Distributors and packagers, The PHP security team
GV.SC-07	Supplier risks are understood, recorded, prioritised, assessed, responded to and monitored	R01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high	Suppliers in the NCSC-NL inventory, CTO
ID.AM-02	Inventories of software, services and systems are maintained	R09 Not knowing where PHP runs 16 high	CTO
ID.RA-01	Vulnerabilities in assets are identified, validated and recorded	R01 Remote code execution on internet-facing PHP servers 15 high R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable 12 high R03-4 Detections built on a proof of concept with the wrong mechanism 12 high	Security lead and AppSec, Organisations running PHP
ID.RA-02	Threat intelligence is received from information sharing forums and sources	R03-1 Attempts before disclosure 15 high R03-3 Exploited in the wild without anyone being able to show it 12 high	Security lead and AppSec, US: CISA and the NSA, Board and executives
ID.RA-08	Processes for receiving, analysing and responding to vulnerability disclosures are established	R02 The coordinated disclosure broke before the fix was ready 20 critical R02-1 The CVE IDs and the proof-of-concept video circulated before release 20 critical R08-2 Several finders, one small team 12 high	The PHP security team, The PHP Foundation
PR.PS-02	Software is maintained, replaced and removed commensurate with risk	R01-3 Versions the PHP project no longer fixes stay vulnerable 20 critical	Organisations running PHP, CTO
DE.CM-01	Networks and network services are monitored to find potentially adverse events	R03 Exploitation outpaces patching 20 critical R03-2 Mass scanning and mutated payloads after the leak 20 critical	Organisations running PHP, US: CISA and the NSA
RS.MA-01	The incident response plan is executed with relevant third parties once an incident is declared	no risk mapped
RS.CO-03	Information is shared with designated internal and external stakeholders	R04-2 Councils and police offline without saying why 15 high	Local councils
RC.RP-01	The recovery portion of the incident response plan is executed	R04 Services lost to precautionary shutdowns 20 critical R04-1 National government services offline 20 critical	Governments and public services, Board and executives, National governments