Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / Board and executives

Board and executives: its risk register

Accountable under NIS2 Article 20 and DORA; decides whether to take a service offline.

Kind role · Assigned here 5 · In its register 5 · the briefing for a board member or executive

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R04 Services lost to precautionary shutdowns20 criticalOperationalownerISO/IEC 27001 A.5.29, ISO/IEC 27001 A.5.30, NIS2 Art.21(2)(c), DORA Art.11 +2
R06 A compromise becomes a reportable breach15 highComplianceownerGDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2
R03-3 Exploited in the wild without anyone being able to show it12 highGovernanceownerCISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01
R04-3 The agencies' advice disagrees12 highGovernanceownerISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20
R07 Decisions made on numbers that measure something else12 highGovernanceownerNIST CSF 2.0 GV.RM-01, ISO/IEC 27001 6.1.2, OWASP Top 10s LLM09:2025

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 R0425
4 Likely4 8 12 R04-3 R0716 20
3 Possible3 6 9 12 R03-315 R06
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Agencies and CERTs (2), The press (2), Threat intelligence and detection (1), US: CISA and the NSA (1), Governments and public services (1), People who need a service that went offline (1), Communications team (1), Organisations running PHP (1), Data protection officer (1), People whose data is held in PHP applications (1), EU and member-state CERTs (1), Wiz Research (1)

The standards its register touches

NIST CSF 2.0 (4), ISO/IEC 27001 (4), NIS2 (3), GDPR (3), DORA (2), CISA KEV and BOD 22-01 (1), NIST SP 800-53 (1), Cyber Resilience Act (1), OWASP Top 10s (1)