Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Hosting and cloud providers

Hosting and cloud providers: its risk register

Shared hosts, managed PHP platforms and clouds: they patch for millions of customers at once, or leave the customer to do it.

Kind group · Assigned here 1 · In its register 4

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R01 Remote code execution on internet-facing PHP servers15 highSecuritytreaterISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3
R01-1 Default Apache mod_php installations exploited before application code runs15 highSecuritythrough Shared and self-service hosting (owner)ISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3
R06-1 Personal data taken from a compromised PHP application15 highCompliancethrough Managed PHP platforms (treater)GDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable12 highSecuritythrough Managed PHP platforms (treater)NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 20
3 Possible3 6 9 12 R01-215 R01 R01-1 R06-1
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Its parts

Who it shares risks with

Organisations running PHP (1), People who use PHP services (1), The PHP project (1), Edge, WAF and detection vendors (1), Agencies and CERTs (1)

The standards its register touches

GDPR (6), ISO/IEC 27001 (2), CIS Controls (2), NIST CSF 2.0 (1), NIST SP 800-53 (1), MITRE ATT&CK (1), OWASP Top 10s (1), NIS2 (1), Cyber Essentials (1), PCI DSS (1)