Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Distributors and packagers
Distributors and packagers: its risk register
Everyone between the PHP source and a running server: Linux distributions, container image builders, hosting panels. A fix reaches most servers through them, not from php.net.
Kind group · Assigned here 2 · In its register 3 · in the story as Chainguard, Dan Lorenc, Chainguard
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R01-3 Versions the PHP project no longer fixes stay vulnerable | 20 critical | Security | through Hosting panels and paid long-term support (treater), Linux distributions and image builders (treater) | NIST SP 800-53 SA-22, CIS Controls 2.2, NIST CSF 2.0 PR.PS-02, Cyber Essentials SUM +1 |
| R02 The coordinated disclosure broke before the fix was ready | 20 critical | Disclosure process | source | ISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT |
| R02-3 Patched builds published before the embargo lifted | 16 high | Supply chain | owner | ISO/IEC 29147 and 30111 29147:coordination, Cyber Resilience Act Art.13, NIST CSF 2.0 GV.SC-05, OWASP Top 10s A03:2025 |
Where its risks sit
Its parts
- Chainguard: 1 risks
- Linux distributions and image builders: 1 risks
- Hosting panels and paid long-term support: 1 risks
The standards its register touches
NIST CSF 2.0 (3), NIST SP 800-53 (1), CIS Controls (1), Cyber Essentials (1), PCI DSS (1), ISO/IEC 29147 and 30111 (1), NIS2 (1), FIRST TLP 2.0 (1), Cyber Resilience Act (1), OWASP Top 10s (1)