Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Hosting and cloud providers / Managed PHP platforms

Managed PHP platforms: its risk register

Platforms that patch the runtime for their customers, so the customer's risk becomes the platform's.

Kind group · Assigned here 2 · In its register 2

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R06-1 Personal data taken from a compromised PHP application15 highCompliancetreaterGDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable12 highSecuritytreaterNIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 20
3 Possible3 6 9 12 R01-215 R06-1
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Security lead and AppSec (1), The PHP security team (1), Data protection officer (1), People whose data is held in PHP applications (1)

The standards its register touches

GDPR (6), NIST CSF 2.0 (1), ISO/IEC 27001 (1)