Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Agencies and CERTs / EU and member-state CERTs

EU and member-state CERTs: its risk register

CERT-EU, CERT-FR, NCSC-NL, CERT.LV, ACN, BACS and the CSIRTs that receive incident reports under NIS2 and the Cyber Resilience Act.

Kind group · Assigned here 5 · In its register 5

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R04-1 National government services offline20 criticalOperationalinformerNIS2 Art.21(2)(c), ISO/IEC 27001 A.5.29, NIST CSF 2.0 RC.RP-01
R01-6 Products that embed PHP stay vulnerable while their suppliers investigate16 highSupply chaininformerCyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4
R06 A compromise becomes a reportable breach15 highComplianceregulatorGDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2
R06-2 Essential and financial entities miss their reporting clocks12 highComplianceregulatorNIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report12 highComplianceregulatorCyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 R04-125
4 Likely4 8 12 16 R01-620
3 Possible3 6 9 12 R06-2 R06-315 R06
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Suppliers in the NCSC-NL inventory (2), Organisations running PHP (2), CTO (1), National governments (1), People who need a service that went offline (1), Data protection officer (1), People whose data is held in PHP applications (1), Board and executives (1), Critical infrastructure providers (1), Banks, insurers and financial entities (1), CISO (1), The PHP Foundation (1)

The standards its register touches

Cyber Resilience Act (4), NIS2 (4), DORA (3), GDPR (3), ISO/IEC 27001 (2), NIST CSF 2.0 (2), OWASP Top 10s (1), SOC 2 (1), NIST SP 800-53 (1)