# Stakeholders: a php2shell risk register for each, at every scale

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

53 stakeholders in one tree, each with its own risk register, and the risks that connect them.

[GRC](../../grc/index.html) · [Risks](../../grc/risks/index.html) · [Stakeholders](../../grc/stakeholders/index.html) · [Frameworks](../../grc/frameworks/index.html) · [The graph](../../grc/graph/index.html) · [From the network](../../grc/network/index.html)

# Stakeholders: a register for each, at every scale

53 stakeholders in one tree, from everyone with PHP in the path down to the roles inside a single organisation. Each has a register: the risks assigned to it, and the risks that arrive through the parts beneath it. The register belongs to the stakeholder, so it reads the same whether the stakeholder is a sector, a council or a CISO.

| Stakeholder | Kind | Assigned here | In its register |
|---|---|---|---|
| [Everyone with PHP in the path](../../grc/stakeholders/world/index.html) | domain | 1 | 34 |
| [The PHP project](../../grc/stakeholders/php-project/index.html) | group | 3 | 11 |
| [The PHP security team](../../grc/stakeholders/php-security-team/index.html) | team | 7 | 7 |
| [The fix authors](../../grc/stakeholders/php-fix-authors/index.html) | team | 1 | 1 |
| [The PHP Foundation](../../grc/stakeholders/php-foundation/index.html) | organisation | 3 | 3 |
| [The finders](../../grc/stakeholders/finders/index.html) | group | 4 | 7 |
| [Calif](../../grc/stakeholders/calif/index.html) | organisation | 1 | 1 |
| [OpenAI (Patch the Planet)](../../grc/stakeholders/openai/index.html) | organisation | 1 | 1 |
| [Wiz Research](../../grc/stakeholders/wiz/index.html) | organisation | 1 | 1 |
| [Quarkslab and OSTIF](../../grc/stakeholders/quarkslab/index.html) | organisation | 1 | 1 |
| [Distributors and packagers](../../grc/stakeholders/distributors/index.html) | group | 2 | 3 |
| [Chainguard](../../grc/stakeholders/chainguard/index.html) | organisation | 1 | 1 |
| [Linux distributions and image builders](../../grc/stakeholders/distros/index.html) | group | 1 | 1 |
| [Hosting panels and paid long-term support](../../grc/stakeholders/panels/index.html) | group | 1 | 1 |
| [Software built on PHP](../../grc/stakeholders/app-vendors/index.html) | group | 0 | 4 |
| [Suppliers in the NCSC-NL inventory](../../grc/stakeholders/inventory-suppliers/index.html) | group | 3 | 3 |
| [Open-source PHP applications](../../grc/stakeholders/oss-apps/index.html) | group | 1 | 1 |
| [Hosting and cloud providers](../../grc/stakeholders/hosting/index.html) | group | 1 | 4 |
| [Managed PHP platforms](../../grc/stakeholders/managed-hosts/index.html) | group | 2 | 2 |
| [Shared and self-service hosting](../../grc/stakeholders/shared-hosts/index.html) | group | 1 | 1 |
| [Edge, WAF and detection vendors](../../grc/stakeholders/edge/index.html) | group | 2 | 8 |
| [WAF vendors](../../grc/stakeholders/waf-vendors/index.html) | group | 2 | 2 |
| [Threat intelligence and detection](../../grc/stakeholders/threat-intel/index.html) | group | 4 | 4 |
| [Agencies and CERTs](../../grc/stakeholders/agencies/index.html) | group | 3 | 11 |
| [US: CISA and the NSA](../../grc/stakeholders/us-agencies/index.html) | group | 2 | 2 |
| [EU and member-state CERTs](../../grc/stakeholders/eu-agencies/index.html) | group | 5 | 5 |
| [UK NCSC](../../grc/stakeholders/uk-ncsc/index.html) | organisation | 1 | 1 |
| [Organisations running PHP](../../grc/stakeholders/operators/index.html) | group | 9 | 26 |
| [Governments and public services](../../grc/stakeholders/public-sector/index.html) | group | 1 | 3 |
| [Local councils](../../grc/stakeholders/councils/index.html) | group | 1 | 1 |
| [National governments](../../grc/stakeholders/national-gov/index.html) | group | 1 | 1 |
| [Critical infrastructure providers](../../grc/stakeholders/critical-infra/index.html) | group | 2 | 2 |
| [Online shops and payments](../../grc/stakeholders/commerce/index.html) | group | 2 | 2 |
| [Banks, insurers and financial entities](../../grc/stakeholders/finance/index.html) | group | 1 | 1 |
| [Wikis, universities and non-profits](../../grc/stakeholders/non-profits/index.html) | group | 0 | 0 |
| [Inside any one organisation](../../grc/stakeholders/org-roles/index.html) | group | 0 | 22 |
| [Board and executives](../../grc/stakeholders/board/index.html) | role | 5 | 5 |
| [CISO](../../grc/stakeholders/ciso/index.html) | role | 2 | 2 |
| [CTO](../../grc/stakeholders/cto/index.html) | role | 3 | 3 |
| [CFO](../../grc/stakeholders/cfo/index.html) | role | 1 | 1 |
| [Security lead and AppSec](../../grc/stakeholders/security-lead/index.html) | role | 6 | 6 |
| [Platform engineers and developers](../../grc/stakeholders/engineers/index.html) | role | 4 | 4 |
| [Website owner](../../grc/stakeholders/site-owner/index.html) | role | 2 | 2 |
| [Communications team](../../grc/stakeholders/comms/index.html) | role | 2 | 2 |
| [Data protection officer](../../grc/stakeholders/dpo/index.html) | role | 2 | 2 |
| [People who use PHP services](../../grc/stakeholders/people/index.html) | group | 1 | 5 |
| [People whose data is held in PHP applications](../../grc/stakeholders/data-subjects/index.html) | group | 2 | 2 |
| [People who need a service that went offline](../../grc/stakeholders/service-users/index.html) | group | 2 | 2 |
| [The press](../../grc/stakeholders/media/index.html) | group | 2 | 6 |
| [This newsroom](../../grc/stakeholders/newsroom/index.html) | organisation | 1 | 5 |
| [The editor](../../grc/stakeholders/newsroom-editor/index.html) | role | 4 | 4 |
| [The newsroom's agents](../../grc/stakeholders/newsroom-agents/index.html) | group | 4 | 4 |
| [This site's readers](../../grc/stakeholders/readers/index.html) | group | 3 | 3 |

## How the stakeholders are connected

The number in a cell is how many risks the two groups share: a risk assigned to someone in one and someone in the other. A risk that joins many groups is one no single party can treat alone.

|  | PHP | finders | Distributors | Software | Hosting | Edge, | Agencies | Organisations | People | press |
|---|---|---|---|---|---|---|---|---|---|---|
| [The PHP project](../../grc/stakeholders/php-project/index.html) | · | 6 | 2 | 1 | 2 | 2 | 2 | 7 | 1 |  |
| [The finders](../../grc/stakeholders/finders/index.html) | 6 | · | 1 |  |  | 1 |  | 4 |  | 1 |
| [Distributors and packagers](../../grc/stakeholders/distributors/index.html) | 2 | 1 | · |  |  |  |  | 2 |  |  |
| [Software built on PHP](../../grc/stakeholders/app-vendors/index.html) | 1 |  |  | · |  |  | 2 | 4 |  |  |
| [Hosting and cloud providers](../../grc/stakeholders/hosting/index.html) | 2 |  |  |  | · | 1 | 1 | 4 | 2 |  |
| [Edge, WAF and detection vendors](../../grc/stakeholders/edge/index.html) | 2 | 1 |  |  | 1 | · | 3 | 7 | 1 |  |
| [Agencies and CERTs](../../grc/stakeholders/agencies/index.html) | 2 |  |  | 2 | 1 | 3 | · | 11 | 4 | 1 |
| [Organisations running PHP](../../grc/stakeholders/operators/index.html) | 7 | 4 | 2 | 4 | 4 | 7 | 11 | · | 5 | 2 |
| [People who use PHP services](../../grc/stakeholders/people/index.html) | 1 |  |  |  | 2 | 1 | 4 | 5 | · |  |
| [The press](../../grc/stakeholders/media/index.html) |  | 1 |  |  |  |  | 1 | 2 |  | · |


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/stakeholders/index.html