Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Edge, WAF and detection vendors

Edge, WAF and detection vendors: its risk register

Cloudflare, Akamai, Fastly, Imperva and others who shipped filters before disclosure, and the threat-intelligence firms who reported what they saw.

Kind group · Assigned here 2 · In its register 8 · in the story as Cloudflare, Akamai, Fastly, Imperva Threat Research

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

Risk	Rating	Kind	Part played	Controls
R02-1 The CVE IDs and the proof-of-concept video circulated before release	20 critical	Disclosure process	treater	ISO/IEC 29147 and 30111 29147:coordination, NIST CSF 2.0 ID.RA-08
R03 Exploitation outpaces patching	20 critical	Security	through Threat intelligence and detection (informer)	CISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3
R03-2 Mass scanning and mutated payloads after the leak	20 critical	Security	through WAF vendors (treater)	MITRE ATT&CK T1595.002, NIST CSF 2.0 DE.CM-01, CIS Controls 13.10
R05 A web application firewall taken for a patch	16 high	Security	through WAF vendors (informer)	PCI DSS 6.4.2, CIS Controls 13.10, NIST SP 800-53 SC-7, ISO/IEC 27001 A.8.20 +1
R01 Remote code execution on internet-facing PHP servers	15 high	Security	treater	ISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3
R03-1 Attempts before disclosure	15 high	Security	through Threat intelligence and detection (informer)	NIST CSF 2.0 ID.RA-02, ISO/IEC 27001 A.5.7, NIST SP 800-53 SI-4, PCI DSS 12.10.1
R03-3 Exploited in the wild without anyone being able to show it	12 high	Governance	through Threat intelligence and detection (informer)	CISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01
R03-4 Detections built on a proof of concept with the wrong mechanism	12 high	Security	through Threat intelligence and detection (treater)	NIST SP 800-53 RA-5, SOC 2 CC7.1, NIST CSF 2.0 ID.RA-01

Where its risks sit

Likelihood / impact	1 Minor	2 Moderate	3 Significant	4 Major	5 Severe
5 Happening	5	10	15	20 R02-1 R03-2	25
4 Likely	4	8	12	16 R05	20 R03
3 Possible	3	6	9	12 R03-3 R03-4	15 R01 R03-1
2 Unlikely	2	4	6	8	10
1 Rare	1	2	3	4	5

Its parts

WAF vendors: 2 risks
Threat intelligence and detection: 4 risks

Who it shares risks with

Organisations running PHP (1), People who use PHP services (1), The PHP project (1), Hosting and cloud providers (1), Agencies and CERTs (1), Calif (1), The PHP security team (1)

The standards its register touches

NIST CSF 2.0 (5), ISO/IEC 27001 (4), NIST SP 800-53 (4), CIS Controls (2), MITRE ATT&CK (2), CISA KEV and BOD 22-01 (2), PCI DSS (2), OWASP Top 10s (1), NIS2 (1), ISO/IEC 29147 and 30111 (1), SOC 2 (1), Cyber Essentials (1)