Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP

Organisations running PHP: its risk register

Anyone with a PHP application on the internet: governments, councils, shops, banks, universities, wikis. They bear most of the risk and own most of the treatment.

Kind group · Assigned here 9 · In its register 26

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R01-3 Versions the PHP project no longer fixes stay vulnerable20 criticalSecurityownerNIST SP 800-53 SA-22, CIS Controls 2.2, NIST CSF 2.0 PR.PS-02, Cyber Essentials SUM +1
R02 The coordinated disclosure broke before the fix was ready20 criticalDisclosure processbearerISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT
R03 Exploitation outpaces patching20 criticalSecurityownerCISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3
R03-2 Mass scanning and mutated payloads after the leak20 criticalSecurityownerMITRE ATT&CK T1595.002, NIST CSF 2.0 DE.CM-01, CIS Controls 13.10
R04 Services lost to precautionary shutdowns20 criticalOperationalthrough Governments and public services (owner), Board and executives (owner), Communications team (treater)ISO/IEC 27001 A.5.29, ISO/IEC 27001 A.5.30, NIS2 Art.21(2)(c), DORA Art.11 +2
R04-1 National government services offline20 criticalOperationalthrough National governments (owner)NIS2 Art.21(2)(c), ISO/IEC 27001 A.5.29, NIST CSF 2.0 RC.RP-01
R08 Frontier AI finds critical flaws faster than maintainers can fix them20 criticalStrategicthrough CISO (bearer)EU AI Act Art.55, NIST AI RMF GOVERN-6.1, NIST AI RMF MEASURE-2.7, ISO/IEC 42001 6.1.2
R01-6 Products that embed PHP stay vulnerable while their suppliers investigate16 highSupply chainbearerCyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4
R05 A web application firewall taken for a patch16 highSecuritythrough Security lead and AppSec (owner), Online shops and payments (bearer)PCI DSS 6.4.2, CIS Controls 13.10, NIST SP 800-53 SC-7, ISO/IEC 27001 A.8.20 +1
R09 Not knowing where PHP runs16 highOperationalthrough CTO (owner), Platform engineers and developers (treater)NIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2
R01 Remote code execution on internet-facing PHP servers15 highSecurityownerISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3
R01-1 Default Apache mod_php installations exploited before application code runs15 highSecuritythrough Website owner (bearer), Platform engineers and developers (treater)ISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3
R01-4 The fix is incomplete, or a third flaw follows15 highSecuritybearerNIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R01-5 Popular applications compromised before authentication15 highSecuritythrough Website owner (owner), Online shops and payments (bearer)OWASP Top 10s A06:2021, PCI DSS 6.3.1, CIS Controls 16.4
R03-1 Attempts before disclosure15 highSecuritythrough Security lead and AppSec (owner)NIST CSF 2.0 ID.RA-02, ISO/IEC 27001 A.5.7, NIST SP 800-53 SI-4, PCI DSS 12.10.1
R04-2 Councils and police offline without saying why15 highReputationalthrough Local councils (owner), Communications team (treater)Cyber Essentials SUM, NIST CSF 2.0 RS.CO-03, ISO/IEC 27001 A.5.24
R06 A compromise becomes a reportable breach15 highComplianceownerGDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2
R06-1 Personal data taken from a compromised PHP application15 highCompliancethrough Data protection officer (owner)GDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable12 highSecuritythrough Security lead and AppSec (owner)NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2
R03-3 Exploited in the wild without anyone being able to show it12 highGovernancethrough Board and executives (owner)CISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01
R03-4 Detections built on a proof of concept with the wrong mechanism12 highSecuritythrough Security lead and AppSec (owner)NIST SP 800-53 RA-5, SOC 2 CC7.1, NIST CSF 2.0 ID.RA-01
R04-3 The agencies' advice disagrees12 highGovernancethrough Board and executives (owner)ISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20
R06-2 Essential and financial entities miss their reporting clocks12 highCompliancethrough Critical infrastructure providers (owner), Banks, insurers and financial entities (owner), CISO (treater)NIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report12 highCompliancethrough Platform engineers and developers (treater)Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II
R07 Decisions made on numbers that measure something else12 highGovernancethrough Board and executives (owner)NIST CSF 2.0 GV.RM-01, ISO/IEC 27001 6.1.2, OWASP Top 10s LLM09:2025
R02-2 Early mitigation advice to a few providers leaked9 mediumDisclosure processbearerFIRST TLP 2.0 TLP:AMBER+STRICT, ISO/IEC 27001 A.5.14, ISO/IEC 29147 and 30111 29147:coordination

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 R04-220 R02 R03-2 R04 R04-125
4 Likely4 8 12 R04-3 R0716 R01-6 R05 R0920 R01-3 R03 R08
3 Possible3 6 9 R02-212 R01-2 R03-3 R03-4 R06-2 R06-315 R01 R01-1 R01-4 R01-5 R03-1 R06 R06-1
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Its parts

Who it shares risks with

The PHP security team (3), CTO (2), The finders (2), EU and member-state CERTs (2), Security lead and AppSec (2), People who use PHP services (1), The PHP project (1), Hosting and cloud providers (1), Edge, WAF and detection vendors (1), Agencies and CERTs (1), Hosting panels and paid long-term support (1), Linux distributions and image builders (1)

The standards its register touches

ISO/IEC 27001 (13), NIST CSF 2.0 (11), NIST SP 800-53 (8), NIS2 (6), GDPR (6), CIS Controls (5), DORA (5), PCI DSS (4), Cyber Resilience Act (4), OWASP Top 10s (3), MITRE ATT&CK (2), Cyber Essentials (2), NIST SSDF (2), ISO/IEC 29147 and 30111 (2), SOC 2 (2), CISA KEV and BOD 22-01 (2), NIST AI RMF (2), FIRST TLP 2.0 (1), EU AI Act (1), ISO/IEC 42001 (1)