Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / The finders

The finders: its risk register

The researchers and companies that found the flaws, several of them with frontier AI, and the audit that surfaced the first bug two years earlier.

Kind group · Assigned here 4 · In its register 7 · in the story as Calif, OpenAI, Wiz Research, Quarkslab, OSTIF

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R02 The coordinated disclosure broke before the fix was ready20 criticalDisclosure processsourceISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT
R02-1 The CVE IDs and the proof-of-concept video circulated before release20 criticalDisclosure processthrough Calif (source)ISO/IEC 29147 and 30111 29147:coordination, NIST CSF 2.0 ID.RA-08
R08 Frontier AI finds critical flaws faster than maintainers can fix them20 criticalStrategictreaterEU AI Act Art.55, NIST AI RMF GOVERN-6.1, NIST AI RMF MEASURE-2.7, ISO/IEC 42001 6.1.2
R08-1 A known bug left unexploited, then unfixed, for two years16 highStrategicthrough Quarkslab and OSTIF (informer)NIST SSDF PW.7, NIST SSDF RV.2, Cyber Resilience Act Art.24, ISO/IEC 27001 A.8.25
R01-4 The fix is incomplete, or a third flaw follows15 highSecurityinformerNIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R07 Decisions made on numbers that measure something else12 highGovernancethrough Wiz Research (source)NIST CSF 2.0 GV.RM-01, ISO/IEC 27001 6.1.2, OWASP Top 10s LLM09:2025
R08-2 Several finders, one small team12 highOperationalsourceISO/IEC 29147 and 30111 29147:receipt, NIST CSF 2.0 ID.RA-08, NIST SSDF RV.1

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 R02 R02-125
4 Likely4 8 12 R07 R08-216 R08-120 R08
3 Possible3 6 9 12 15 R01-4
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Its parts

Who it shares risks with

The PHP security team (3), Organisations running PHP (2), The fix authors (1), Platform engineers and developers (1), Distributors and packagers (1), Security lead and AppSec (1), OpenAI (Patch the Planet) (1), The PHP project (1), Everyone with PHP in the path (1), CISO (1), The PHP Foundation (1)

The standards its register touches

NIST SSDF (5), ISO/IEC 27001 (3), ISO/IEC 29147 and 30111 (3), NIST CSF 2.0 (2), NIST AI RMF (2), NIS2 (1), FIRST TLP 2.0 (1), OWASP Top 10s (1), EU AI Act (1), ISO/IEC 42001 (1), Cyber Resilience Act (1)