Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R06 A compromise becomes a reportable breach / R06-1
R06-1: Personal data taken from a compromised PHP application
Because PHP applications hold accounts, orders and records, code execution on one gives the attacker its database, resulting in a personal data breach the controller must assess within 72 hours.
Rating 15 high · Likelihood 3 Possible · Impact 5 Severe · Kind Compliance · Acceptance not recorded
Basis. Follows from code execution; no named organisation has reported a breach through php2shell.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| Data protection officer | owner | Runs the breach assessment. | 2 risks |
| People whose data is held in PHP applications | bearer | Their data. | 2 risks |
| Managed PHP platforms | treater | Processors under Article 28 for their customers. | 2 risks |
What it arises from
- The allocator's longjmp-based bailout on out-of-memory. An out-of-memory error unwinds by longjmp and can leave request memory in a state that cleanup later reads.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs | confirmed | A6 Established●●●●●● | PHP oss-security php.net |
Treatments
| Treatment | Status | Where |
|---|---|---|
| Security of processing kept current, tested and evaluated | partial | If you run PHP: the steps, in order, with their sources |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| GDPR | Art.5(1)(f) | Integrity and confidentiality: personal data processed with appropriate security | Law and regulation |
| GDPR | Art.24 | Responsibility of the controller: measures appropriate to the risk | Law and regulation |
| GDPR | Art.28 | Processors: the controller uses only processors that give sufficient guarantees | Law and regulation |
| GDPR | Art.32 | Security of processing, including a process for regularly testing and evaluating it | Law and regulation |
| GDPR | Art.33 | Notifying a personal data breach to the supervisory authority within 72 hours | Law and regulation |
| GDPR | Art.34 | Communicating a high-risk personal data breach to the people affected | Law and regulation |
The stories that tell it
- No story on this site tells this risk yet.
On this site: Briefing for a data protection officer: Was personal data exposed, does this start a GDPR breach assessment or a 72-hour notification, and what do I document? · Impact: taken offline versus compromised