Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / Platform engineers and developers

Platform engineers and developers: its risk register

Find every PHP runtime, upgrade it, rebuild the images and prove it is done.

Kind role · Assigned here 4 · In its register 4 · the briefing for a php or platform engineer

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R09 Not knowing where PHP runs16 highOperationaltreaterNIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2
R01-1 Default Apache mod_php installations exploited before application code runs15 highSecuritytreaterISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3
R01-4 The fix is incomplete, or a third flaw follows15 highSecuritybearerNIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report12 highCompliancetreaterCyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 R0920
3 Possible3 6 9 12 R06-315 R01-1 R01-4
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Suppliers in the NCSC-NL inventory (2), Shared and self-service hosting (1), Website owner (1), The fix authors (1), The PHP security team (1), Organisations running PHP (1), The finders (1), The PHP Foundation (1), EU and member-state CERTs (1), CTO (1)

The standards its register touches

Cyber Resilience Act (4), ISO/IEC 27001 (3), CIS Controls (2), NIST SSDF (2), Cyber Essentials (1), PCI DSS (1), ISO/IEC 29147 and 30111 (1), NIST CSF 2.0 (1), NIST SP 800-53 (1), DORA (1)