Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R01 Remote code execution on internet-facing PHP servers / R01-6
R01-6: Products that embed PHP stay vulnerable while their suppliers investigate
Because PHP is embedded in products whose suppliers must each ship their own fix, and most of the 674 products in the NCSC-NL inventory were vulnerable or under investigation, customers of those products cannot patch on their own, resulting in exposure that lasts as long as the slowest supplier.
Rating 16 high · Likelihood 4 Likely · Impact 4 Major · Kind Supply chain · Acceptance not recorded
Basis. Counted from the inventory: 206 vulnerable and 418 under investigation against 46 fixed at the vault's capture.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| Suppliers in the NCSC-NL inventory | owner | Each ships the fix for its product. | 3 risks |
| Organisations running PHP | bearer | Depend on the supplier's release. | 26 risks |
| EU and member-state CERTs | informer | NCSC-NL keeps the inventory. | 5 risks |
| CTO | owner | Owns the supplier relationship and the inventory of what runs where. | 3 risks |
What it arises from
- Not knowing where PHP runs. PHP is embedded in appliances, images and products whose owners do not list it; 418 inventory rows were still under investigation.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable | confirmed | A1 Weak signal●○○○○○ | NCSC-NL |
Treatments
| Treatment | Status | Where |
|---|---|---|
| The NCSC-NL inventory, tracked hour by hour | partial | The inventory, hour by hour: fixed, vulnerable, still under investigation |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| Cyber Resilience Act | Art.13 | Obligations of manufacturers, including due diligence on integrated third-party and open-source components | Law and regulation |
| Cyber Resilience Act | AnnexI.II | Vulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosure | Law and regulation |
| OWASP Top 10s | A03:2025 | Software supply chain failures | Practice and technique |
| NIS2 | Art.21(2)(d) | Supply chain security, including the security of each direct supplier | Law and regulation |
| ISO/IEC 27001 | A.5.21 | Managing information security in the ICT supply chain | Management-system standards |
| NIST CSF 2.0 | GV.SC-07 | Supplier risks are understood, recorded, prioritised, assessed, responded to and monitored | Frameworks and control catalogues |
| DORA | Art.28 | Managing ICT third-party risk | Law and regulation |
| SOC 2 | CC9.2 | Risks from vendors and business partners are assessed and managed | Frameworks and control catalogues |
The stories that tell it
- Why can't every version of PHP just be patched?
- Where php2shell stands: many sites dark, millions of attempts, no confirmed breach (through Remote code execution on internet-facing PHP servers)
- Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third (through Remote code execution on internet-facing PHP servers)
On this site: The NCSC-NL inventory: 674 products · The inventory, hour by hour: fixed, vulnerable, still under investigation