Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
GRC · Risks · Stakeholders · Frameworks · The graph · From the network
GRC: the risks of php2shell, who carries them, and the standards that govern them
A register of every risk in this story, broken down until each piece has someone who can act on it, and assigned to every stakeholder who carries part of it. The registers are fractal: the PHP project, a hosting provider, a council, a board and a developer each have one, and each is the same register read at a different scale. Every risk is backed by claims already on this site, and joined, edge by edge, to the weakness behind it, the vulnerability, the part of the fix that addresses it, the code that changed, the stories that tell it, the roles that act on it, and the controls in GDPR, NIS2, the Cyber Resilience Act, DORA, the EU AI Act, ISO 27001, NIST and the rest.
Where the risks sit
Likelihood up, impact across; the number in each cell is the score, likelihood times impact. Click an id for the risk.
| Likelihood / impact | 1 Minor | 2 Moderate | 3 Significant | 4 Major | 5 Severe |
|---|---|---|---|---|---|
| 5 Happening | 5 | 10 | 15 R04-2 | 20 R02 R02-1 R03-2 R04 R04-1 | 25 |
| 4 Likely | 4 | 8 | 12 R04-3 R07 R08-2 R10-3 | 16 R01-6 R02-3 R05 R08-1 R09 | 20 R01-3 R03 R08 |
| 3 Possible | 3 | 6 | 9 R02-2 | 12 R01-2 R03-3 R03-4 R06-2 R06-3 R10 R10-1 | 15 R01 R01-1 R01-4 R01-5 R03-1 R06 R06-1 |
| 2 Unlikely | 2 | 4 | 6 | 8 | 10 R10-2 |
| 1 Rare | 1 | 2 | 3 | 4 | 5 |
The ten risks at the top
Each breaks down into the narrower risks it is made of; the full register is on the risks page.
From a risk to the code, the story and the role
The editor's test for this section: a path in the graph from every risk to the vulnerabilities, the code, the stories and the roles. The build walks it for every risk and the table below is the count; the gaps are listed by name, not hidden. A risk with no vulnerability is not a gap in itself: some risks here arise from how disclosure, regulation or this newsroom works, and their weaknesses point at the code in this repository that guards them instead.
| Every risk reaches | Risks that do | Risks that do not yet |
|---|---|---|
| a vulnerability | 30 of 34 | R10 This newsroom's own agents are steered, leak or mislead, R10-1 Prompt injection through captured material, R10-2 A vault key or token published, R10-3 A status word stronger than its evidence |
| code | 34 of 34 | none |
| a story | 26 of 34 | R06 A compromise becomes a reportable breach, R06-1 Personal data taken from a compromised PHP application, R06-2 Essential and financial entities miss their reporting clocks, R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report, R10 This newsroom's own agents are steered, leak or mislead, R10-1 Prompt injection through captured material, R10-2 A vault key or token published, R10-3 A status word stronger than its evidence |
| a role inside an organisation | 34 of 34 | none |
| a member of this team | 34 of 34 | none |
How the registers work
- A stakeholder is a node in a tree. A sector holds organisations, an organisation holds roles. The same register is read at every level: a stakeholder's register is what is assigned to it plus everything that arrives through the parts below it.
- A risk is a node in a tree. A broad risk holds the narrower risks it is made of, until each can be owned.
- One risk, many stakeholders. Each assignment says the part played: owner, bearer, treater, source, informer or regulator. Two stakeholders that share a risk are connected; the stakeholders page shows by how much.
- Every edge is a verb with a named inverse, following the sgit graph grammar: a risk arises from a weakness, which gives rise to it; a risk is owned by a stakeholder, who owns it.
- A rating is a judgement. Likelihood and impact on a scale of 1 to 5, each with its basis in a sentence, as at the vault's last capture.
No risk on this register is accepted. An acceptance is an act by the holder of a risk, for a stated interval, and nobody can accept on anyone else's behalf; this desk records risks and their holders, it does not accept for them. Until a holder accepts, funds or fixes, each risk stands as it is rated here.
| Likelihood | Impact | |
|---|---|---|
| 1 | Rare: Not seen and needs conditions nobody has shown | Minor: An inconvenience, absorbed without a decision |
| 2 | Unlikely: Possible; no sign of it in the evidence yet | Moderate: Costs time or money; one team's problem |
| 3 | Possible: Reported or attempted; not confirmed at scale | Significant: A service degraded or an obligation triggered; a director decides |
| 4 | Likely: Under way somewhere, by confirmed evidence, or the precedent says it will be within weeks | Major: A service down, a regulator involved, data at risk; the board decides |
| 5 | Happening: Confirmed and under way now | Severe: Code execution or data loss at scale, or harm to people relying on the service |
| Part | Means | Edge |
|---|---|---|
| Owner | Accountable for treating the risk: decides, funds, signs off | owned_by / owns |
| Bearer | Suffers the consequence if it happens, whether or not it can act | borne_by / bears |
| Treater | Does the work that reduces it: patches, filters, detects, ships | treated_by / treats |
| Source | Its actions or omissions create or raise the risk, without intent | raised_by / raises |
| Informer | Its information changes how others see and rate the risk | informed_by / informs |
| Regulator | Sets or enforces the obligation the risk triggers | regulated_by / regulates |
The data
Authored: data/grc.json (53 stakeholders, 14 weaknesses, 34 risks) and data/grc-frameworks.json (20 frameworks, 120 controls). Generated on every build: data/grc-graph.json, 442 nodes and 914 edges. The build refuses a risk that points at a claim, source, story, page, member, code node or control that does not exist, and a risk with no owner. Kept by the GRC desk.