Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Software built on PHP
Software built on PHP: its risk register
The suppliers in the NCSC-NL inventory and the open-source applications (WordPress, Drupal, Joomla, MediaWiki, Magento, Nextcloud, Laravel, Symfony) that ship or run on PHP; manufacturers under the Cyber Resilience Act.
Kind group · Assigned here 0 · In its register 4
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R01-6 Products that embed PHP stay vulnerable while their suppliers investigate | 16 high | Supply chain | through Suppliers in the NCSC-NL inventory (owner) | Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4 |
| R09 Not knowing where PHP runs | 16 high | Operational | through Suppliers in the NCSC-NL inventory (informer) | NIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2 |
| R01-5 Popular applications compromised before authentication | 15 high | Security | through Open-source PHP applications (informer) | OWASP Top 10s A06:2021, PCI DSS 6.3.1, CIS Controls 16.4 |
| R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report | 12 high | Compliance | through Suppliers in the NCSC-NL inventory (owner) | Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II |
Where its risks sit
Its parts
- Suppliers in the NCSC-NL inventory: 3 risks
- Open-source PHP applications: 1 risks
The standards its register touches
Cyber Resilience Act (4), OWASP Top 10s (2), ISO/IEC 27001 (2), NIST CSF 2.0 (2), DORA (2), PCI DSS (1), CIS Controls (1), NIS2 (1), SOC 2 (1), NIST SP 800-53 (1)