Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R06

R06: A compromise becomes a reportable breach

Because a server running an attacker's code exposes the personal data and the services behind it, a single compromise can trigger breach notification under GDPR, incident reporting under NIS2 and DORA, and, for a manufacturer, reporting under the Cyber Resilience Act, resulting in deadlines measured in hours and fines measured in turnover.

Rating 15 high · Likelihood 3 Possible · Impact 5 Severe · Kind Compliance · Acceptance not recorded

Basis. No named organisation has said it was compromised; two vendors report successful exploitation without naming a victim. If one comes, the clocks are 24 and 72 hours.

The path

Told innone yetActed on byData protection officerData protection offi…Board and executivesBoard and executivesCISOCISOPlatform engineers and developersPlatform engineers a…Story site agentStory site agentCarried byOrganisations running PHP (owner)Organisations runnin…Data protection officer (owner)Data protection offi…People whose data is held in PHP applications (bearer)People whose data is…EU and member-state CERTs (regulator)EU and member-state …Board and executives (owner)Board and executives…RiskR06 A compromise becomes a reportable breachR06 A compromise bec…Arises fromThe allocator's longjmp-based bailout on out-of-memoryThe allocator's long…Request globals that survive a failed requestRequest globals that…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
Organisations running PHPownerControllers and essential entities.26 risks
Data protection officerownerDecides whether the 72-hour clock has started.2 risks
People whose data is held in PHP applicationsbearerTheir data.2 risks
EU and member-state CERTsregulatorReceive the reports.5 risks
Board and executivesownerPersonally accountable under NIS2.5 risks

The risks this one is made of

RiskRatingKindAssigned toControls
R06-1 Personal data taken from a compromised PHP application15 highComplianceData protection officer owner, People whose data is held in PHP applications bearer, Managed PHP platforms treaterGDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2
R06-2 Essential and financial entities miss their reporting clocks12 highComplianceCritical infrastructure providers owner, Banks, insurers and financial entities owner, EU and member-state CERTs regulator, CISO treaterNIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report12 highComplianceSuppliers in the NCSC-NL inventory owner, The PHP Foundation informer, EU and member-state CERTs regulator, Platform engineers and developers treaterCyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II

What it arises from

The evidence

ClaimStatusFact-checkSources
As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.reportedA4 CorroboratedCISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop
Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runsconfirmedA6 EstablishedPHP oss-security php.net

Treatments

TreatmentStatusWhere
A breach-assessment step in the incident plan, started at the first sign of compromisepartialIf you run PHP: the steps, in order, with their sources

The standards that govern it

FrameworkControlWhat it asksFamily
GDPRArt.32Security of processing, including a process for regularly testing and evaluating itLaw and regulation
GDPRArt.33Notifying a personal data breach to the supervisory authority within 72 hoursLaw and regulation
GDPRArt.34Communicating a high-risk personal data breach to the people affectedLaw and regulation
NIS2Art.23Reporting significant incidents: early warning in 24 hours, notification in 72 hours, final report in a monthLaw and regulation
DORAArt.19Reporting major ICT-related incidentsLaw and regulation
Cyber Resilience ActArt.14Reporting an actively exploited vulnerability: early warning within 24 hours to the CSIRT and ENISALaw and regulation

The stories that tell it

On this site: No named organisation has said it was compromised through php2shell: the evidence · Impact: taken offline versus compromised · If you run PHP: the steps, in order, with their sources