Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / PCI DSS
PCI DSS: the php2shell risks it governs
Online shops were among the sites taken offline; most run PHP (Magento, WooCommerce) and take cards.
Full name Payment Card Industry Data Security Standard v4.0.1 · Publisher PCI Security Standards Council · Version 4.0.1 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| 6.3.1 | Security vulnerabilities are identified, risk-ranked and managed | R01-5 Popular applications compromised before authentication 15 high | Website owner |
| 6.3.3 | Critical security patches are installed within one month of release | R01-1 Default Apache mod_php installations exploited before application code runs 15 high R01-3 Versions the PHP project no longer fixes stay vulnerable 20 critical | Shared and self-service hosting, Organisations running PHP, CTO |
| 6.4.2 | An automated technical solution that detects and prevents web attacks protects public-facing web applications | R05 A web application firewall taken for a patch 16 high | Security lead and AppSec |
| 12.10.1 | An incident response plan exists and is ready to be activated | R03-1 Attempts before disclosure 15 high | Security lead and AppSec |