Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Frameworks / NIST SSDF
NIST SSDF: the php2shell risks it governs
What a software producer, the PHP project included, is expected to do when a vulnerability is reported: confirm it, fix it, and find the class of bug behind it.
Full name NIST SP 800-218 Secure Software Development Framework 1.1 · Publisher US National Institute of Standards and Technology · Version 1.1, February 2022 · the official text
Clauses and controls
| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| PW.7 | Review and analyse human-readable code to find vulnerabilities | R08-1 A known bug left unexploited, then unfixed, for two years 16 high | The PHP project |
| PW.8 | Test executable code to find vulnerabilities | R01-4 The fix is incomplete, or a third flaw follows 15 high | The fix authors |
| RV.1 | Identify and confirm vulnerabilities on an ongoing basis | R08-2 Several finders, one small team 12 high | The PHP Foundation |
| RV.2 | Assess, prioritise and remediate vulnerabilities | R08-1 A known bug left unexploited, then unfixed, for two years 16 high | The PHP project |
| RV.3 | Analyse vulnerabilities to identify their root causes | R01-4 The fix is incomplete, or a third flaw follows 15 high | The fix authors |