Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Agencies and CERTs

Agencies and CERTs: its risk register

The national agencies that advised, and in some cases told their own governments to go offline.

Kind group · Assigned here 3 · In its register 11 · in the story as National agencies

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R03 Exploitation outpaces patching20 criticalSecuritythrough US: CISA and the NSA (regulator)CISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3
R04 Services lost to precautionary shutdowns20 criticalOperationalsourceISO/IEC 27001 A.5.29, ISO/IEC 27001 A.5.30, NIS2 Art.21(2)(c), DORA Art.11 +2
R04-1 National government services offline20 criticalOperationalthrough EU and member-state CERTs (informer)NIS2 Art.21(2)(c), ISO/IEC 27001 A.5.29, NIST CSF 2.0 RC.RP-01
R01-6 Products that embed PHP stay vulnerable while their suppliers investigate16 highSupply chainthrough EU and member-state CERTs (informer)Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4
R01 Remote code execution on internet-facing PHP servers15 highSecurityinformerISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3
R04-2 Councils and police offline without saying why15 highReputationalthrough UK NCSC (informer)Cyber Essentials SUM, NIST CSF 2.0 RS.CO-03, ISO/IEC 27001 A.5.24
R06 A compromise becomes a reportable breach15 highCompliancethrough EU and member-state CERTs (regulator)GDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2
R03-3 Exploited in the wild without anyone being able to show it12 highGovernancethrough US: CISA and the NSA (regulator)CISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01
R04-3 The agencies' advice disagrees12 highGovernancesourceISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20
R06-2 Essential and financial entities miss their reporting clocks12 highCompliancethrough EU and member-state CERTs (regulator)NIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report12 highCompliancethrough EU and member-state CERTs (regulator)Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 R04-220 R04 R04-125
4 Likely4 8 12 R04-316 R01-620 R03
3 Possible3 6 9 12 R03-3 R06-2 R06-315 R01 R06
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Its parts

Who it shares risks with

Board and executives (2), Organisations running PHP (1), People who use PHP services (1), The PHP project (1), Hosting and cloud providers (1), Edge, WAF and detection vendors (1), Governments and public services (1), People who need a service that went offline (1), Communications team (1), The press (1)

The standards its register touches

ISO/IEC 27001 (8), NIST CSF 2.0 (7), NIS2 (5), NIST SP 800-53 (4), Cyber Resilience Act (4), DORA (4), GDPR (3), MITRE ATT&CK (2), OWASP Top 10s (2), CISA KEV and BOD 22-01 (2), CIS Controls (1), SOC 2 (1), Cyber Essentials (1)