Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

GRC · Risks · Stakeholders · Frameworks · The graph · From the network

The risk register: every risk, as a tree

34 risks, 10 at the top and 24 beneath them. A risk beneath another is a part of it narrow enough to own. Sorted as the tree; each row links to the risk's page with its full path.

Risk	Rating	Kind	Owned by	Stakeholders	Controls
R01 Remote code execution on internet-facing PHP servers	15 high	Security	Organisations running PHP	6	7
R01-1 Default Apache mod_php installations exploited before application code runs	15 high	Security	Shared and self-service hosting	3	4
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable	12 high	Security	Security lead and AppSec	3	2
R01-3 Versions the PHP project no longer fixes stay vulnerable	20 critical	Security	Organisations running PHP, CTO	5	5
R01-4 The fix is incomplete, or a third flaw follows	15 high	Security	The fix authors	5	4
R01-5 Popular applications compromised before authentication	15 high	Security	Website owner	3	3
R01-6 Products that embed PHP stay vulnerable while their suppliers investigate	16 high	Supply chain	Suppliers in the NCSC-NL inventory, CTO	4	8
R02 The coordinated disclosure broke before the fix was ready	20 critical	Disclosure process	The PHP security team	5	4
R02-1 The CVE IDs and the proof-of-concept video circulated before release	20 critical	Disclosure process	The PHP security team	3	2
R02-2 Early mitigation advice to a few providers leaked	9 medium	Disclosure process	The PHP security team	3	3
R02-3 Patched builds published before the embargo lifted	16 high	Supply chain	Distributors and packagers	3	4
R03 Exploitation outpaces patching	20 critical	Security	Organisations running PHP	4	7
R03-1 Attempts before disclosure	15 high	Security	Security lead and AppSec	2	4
R03-2 Mass scanning and mutated payloads after the leak	20 critical	Security	Organisations running PHP	2	3
R03-3 Exploited in the wild without anyone being able to show it	12 high	Governance	Board and executives	3	3
R03-4 Detections built on a proof of concept with the wrong mechanism	12 high	Security	Security lead and AppSec	2	3
R04 Services lost to precautionary shutdowns	20 critical	Operational	Governments and public services, Board and executives	5	6
R04-1 National government services offline	20 critical	Operational	National governments	3	3
R04-2 Councils and police offline without saying why	15 high	Reputational	Local councils	3	3
R04-3 The agencies' advice disagrees	12 high	Governance	Board and executives	3	3
R05 A web application firewall taken for a patch	16 high	Security	Security lead and AppSec	3	5
R06 A compromise becomes a reportable breach	15 high	Compliance	Organisations running PHP, Data protection officer, Board and executives	5	6
R06-1 Personal data taken from a compromised PHP application	15 high	Compliance	Data protection officer	3	6
R06-2 Essential and financial entities miss their reporting clocks	12 high	Compliance	Critical infrastructure providers, Banks, insurers and financial entities	4	5
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report	12 high	Compliance	Suppliers in the NCSC-NL inventory	4	4
R07 Decisions made on numbers that measure something else	12 high	Governance	Board and executives	4	3
R08 Frontier AI finds critical flaws faster than maintainers can fix them	20 critical	Strategic	OpenAI (Patch the Planet)	5	4
R08-1 A known bug left unexploited, then unfixed, for two years	16 high	Strategic	The PHP project	3	4
R08-2 Several finders, one small team	12 high	Operational	The PHP Foundation	3	3
R09 Not knowing where PHP runs	16 high	Operational	CTO	3	6
R10 This newsroom's own agents are steered, leak or mislead	12 high	AI and agents	The editor	3	4
R10-1 Prompt injection through captured material	12 high	AI and agents	The editor	2	3
R10-2 A vault key or token published	10 medium	AI and agents	The editor	3	3
R10-3 A status word stronger than its evidence	12 high	AI and agents	The editor	3	2

By kind

Kind	Risks	Highest
Security	11	R01-3 Versions the PHP project no longer fixes stay vulnerable 20 critical
Supply chain	2	R01-6 Products that embed PHP stay vulnerable while their suppliers investigate 16 high
Disclosure process	3	R02 The coordinated disclosure broke before the fix was ready 20 critical
Operational	4	R04 Services lost to precautionary shutdowns 20 critical
Compliance	4	R06 A compromise becomes a reportable breach 15 high
Governance	3	R03-3 Exploited in the wild without anyone being able to show it 12 high
Reputational	1	R04-2 Councils and police offline without saying why 15 high
Strategic	2	R08 Frontier AI finds critical flaws faster than maintainers can fix them 20 critical
AI and agents	4	R10 This newsroom's own agents are steered, leak or mislead 12 high

Acceptance

No risk on this register is accepted. An acceptance is an act by the holder of a risk, for a stated interval, and nobody can accept on anyone else's behalf; this desk records risks and their holders, it does not accept for them. Until a holder accepts, funds or fixes, each risk stands as it is rated here.