# NIST SSDF: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each NIST SSDF clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / NIST SSDF

# NIST SSDF: the php2shell risks it governs

What a software producer, the PHP project included, is expected to do when a vulnerability is reported: confirm it, fix it, and find the class of bug behind it.

**Full name** NIST SP 800-218 Secure Software Development Framework 1.1 · **Publisher** US National Institute of Standards and Technology · **Version** 1.1, February 2022 · [the official text](https://doi.org/10.6028/NIST.SP.800-218)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **PW.7** | Review and analyse human-readable code to find vulnerabilities | [R08-1 A known bug left unexploited, then unfixed, for two years](../../../grc/risks/r08-1/index.html) **16** high | [The PHP project](../../../grc/stakeholders/php-project/index.html) |
| **PW.8** | Test executable code to find vulnerabilities | [R01-4 The fix is incomplete, or a third flaw follows](../../../grc/risks/r01-4/index.html) **15** high | [The fix authors](../../../grc/stakeholders/php-fix-authors/index.html) |
| **RV.1** | Identify and confirm vulnerabilities on an ongoing basis | [R08-2 Several finders, one small team](../../../grc/risks/r08-2/index.html) **12** high | [The PHP Foundation](../../../grc/stakeholders/php-foundation/index.html) |
| **RV.2** | Assess, prioritise and remediate vulnerabilities | [R08-1 A known bug left unexploited, then unfixed, for two years](../../../grc/risks/r08-1/index.html) **16** high | [The PHP project](../../../grc/stakeholders/php-project/index.html) |
| **RV.3** | Analyse vulnerabilities to identify their root causes | [R01-4 The fix is incomplete, or a third flaw follows](../../../grc/risks/r01-4/index.html) **15** high | [The fix authors](../../../grc/stakeholders/php-fix-authors/index.html) |


---
site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/ssdf/index.html