Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R06 A compromise becomes a reportable breach / R06-2

R06-2: Essential and financial entities miss their reporting clocks

Because NIS2 asks for an early warning within 24 hours and DORA for major-incident reports on its own schedule, an entity that cannot tell a precautionary outage from an incident may report late or not at all, resulting in a regulatory finding on top of the incident.

Rating 12 high · Likelihood 3 Possible · Impact 4 Major · Kind Compliance · Acceptance not recorded

Basis. Precautionary shutdowns may themselves meet the significance tests; the evidence does not say how entities classified them.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Critical infrastructure providers	owner	Essential entities under NIS2.	2 risks
Banks, insurers and financial entities	owner	Under DORA.	1 risk
EU and member-state CERTs	regulator	Receive the reports.	5 risks
CISO	treater	Classifies the event.	2 risks

What it arises from

Exploitation that cannot yet be seen. Honeypots and edge networks see attempts; nobody has shown a compromise, and KEV waits for one. Absence of evidence is read as safety.

The evidence

Claim	Status	Fact-check	Sources
As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.	reported	A4 Corroborated	CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop
The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those services	confirmed	A3 Echoed	Rijksoverheid / NCSC-NL Dutch IT Leaders

Treatments

Treatment	Status	Where
Classify a precautionary shutdown against the reporting thresholds on the day	missing	Impact: taken offline versus compromised

The standards that govern it

Framework	Control	What it asks	Family
NIS2	Art.23	Reporting significant incidents: early warning in 24 hours, notification in 72 hours, final report in a month	Law and regulation
NIS2	Art.20	Governance: management bodies approve and oversee the risk-management measures and can be held liable	Law and regulation
DORA	Art.19	Reporting major ICT-related incidents	Law and regulation
DORA	Art.10	Detection of anomalous activities	Law and regulation
NIST SP 800-53	IR-6	Incident reporting	Frameworks and control catalogues

The stories that tell it

No story on this site tells this risk yet.

On this site: Impact: taken offline versus compromised · What sixteen agencies actually advise