Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R09
R09: Not knowing where PHP runs
Because PHP sits in appliances, images, plugins and forgotten sites, an organisation cannot patch what it has not listed, resulting in an update programme that reports done while vulnerable runtimes remain.
Rating 16 high · Likelihood 4 Likely · Impact 4 Major · Kind Operational · Acceptance not recorded
Basis. 418 inventory rows under investigation; the precedent of every component flaw since Log4Shell.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| CTO | owner | Owns the inventory. | 3 risks |
| Platform engineers and developers | treater | Build it and keep it. | 4 risks |
| Suppliers in the NCSC-NL inventory | informer | Say which products embed PHP. | 3 risks |
What it arises from
- Not knowing where PHP runs. PHP is embedded in appliances, images and products whose owners do not list it; 418 inventory rows were still under investigation.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable | confirmed | A1 Weak signal●○○○○○ | NCSC-NL |
| PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 October | reported | A2 Reported●●○○○○ | THN SecurityWeek |
Treatments
| Treatment | Status | Where |
|---|---|---|
| A software inventory with component versions (SBOM) | partial | If you run PHP: the steps, in order, with their sources |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| NIST CSF 2.0 | ID.AM-02 | Inventories of software, services and systems are maintained | Frameworks and control catalogues |
| NIST SP 800-53 | CM-8 | System component inventory | Frameworks and control catalogues |
| CIS Controls | 16.4 | Establish and manage an inventory of third-party software components | Frameworks and control catalogues |
| DORA | Art.8 | Identification of ICT assets, their dependencies and the risks to them | Law and regulation |
| ISO/IEC 27001 | A.8.9 | Configuration management | Management-system standards |
| Cyber Resilience Act | AnnexI.II | Vulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosure | Law and regulation |
The stories that tell it
On this site: If you run PHP: the steps, in order, with their sources · The NCSC-NL inventory: 674 products