Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R06 A compromise becomes a reportable breach / R06-3
R06-3: Manufacturers under the Cyber Resilience Act owe a 24-hour report
Because the Act's reporting duty has applied since 11 September 2026, a manufacturer whose product embeds PHP must report an actively exploited vulnerability within 24 hours, and whether php2shell is 'actively exploited' is exactly what the evidence cannot yet settle, resulting in manufacturers deciding alone when the clock starts.
Rating 12 high · Likelihood 3 Possible · Impact 4 Major · Kind Compliance · Acceptance not recorded
Basis. The legal test turns on exploitation, which is disputed; the inventory shows hundreds of products.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| Suppliers in the NCSC-NL inventory | owner | Manufacturers under the Act. | 3 risks |
| The PHP Foundation | informer | An open-source steward, with lighter duties under Article 24. | 3 risks |
| EU and member-state CERTs | regulator | The CSIRTs and ENISA receive the reports. | 5 risks |
| Platform engineers and developers | treater | Build the fixed product and the component inventory that shows it. | 4 risks |
What it arises from
- Not knowing where PHP runs. PHP is embedded in appliances, images and products whose owners do not list it; 418 inventory rows were still under investigation.
- Exploitation that cannot yet be seen. Honeypots and edge networks see attempts; nobody has shown a compromise, and KEV waits for one. Absence of evidence is read as safety.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable | confirmed | A1 Weak signal●○○○○○ | NCSC-NL |
| watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild | unverified | A4 Corroborated●●●●○○ | watchTowr watchTowr |
| CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog | confirmed | A6 Established●●●●●● | CISA CISA CVE record |
Treatments
| Treatment | Status | Where |
|---|---|---|
| A documented decision on whether and when the exploitation test is met | missing | The NCSC-NL inventory: 674 products |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| Cyber Resilience Act | Art.14 | Reporting an actively exploited vulnerability: early warning within 24 hours to the CSIRT and ENISA | Law and regulation |
| Cyber Resilience Act | Art.13 | Obligations of manufacturers, including due diligence on integrated third-party and open-source components | Law and regulation |
| Cyber Resilience Act | Art.24 | Obligations of open-source software stewards | Law and regulation |
| Cyber Resilience Act | AnnexI.II | Vulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosure | Law and regulation |
The stories that tell it
- No story on this site tells this risk yet.
On this site: The NCSC-NL inventory: 674 products · Exploitation signals, in order