Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation

Inside any one organisation: its risk register

The same register again at the scale of one organisation: the roles that decide, act and communicate. Each has a briefing on this site.

Kind group · Assigned here 0 · In its register 22

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

Risk	Rating	Kind	Part played	Controls
R01-3 Versions the PHP project no longer fixes stay vulnerable	20 critical	Security	through CTO (owner), CFO (bearer)	NIST SP 800-53 SA-22, CIS Controls 2.2, NIST CSF 2.0 PR.PS-02, Cyber Essentials SUM +1
R02 The coordinated disclosure broke before the fix was ready	20 critical	Disclosure process	through Security lead and AppSec (bearer)	ISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT
R03 Exploitation outpaces patching	20 critical	Security	through Security lead and AppSec (treater)	CISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3
R04 Services lost to precautionary shutdowns	20 critical	Operational	through Board and executives (owner), Communications team (treater)	ISO/IEC 27001 A.5.29, ISO/IEC 27001 A.5.30, NIS2 Art.21(2)(c), DORA Art.11 +2
R08 Frontier AI finds critical flaws faster than maintainers can fix them	20 critical	Strategic	through CISO (bearer)	EU AI Act Art.55, NIST AI RMF GOVERN-6.1, NIST AI RMF MEASURE-2.7, ISO/IEC 42001 6.1.2
R01-6 Products that embed PHP stay vulnerable while their suppliers investigate	16 high	Supply chain	through CTO (owner)	Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4
R05 A web application firewall taken for a patch	16 high	Security	through Security lead and AppSec (owner)	PCI DSS 6.4.2, CIS Controls 13.10, NIST SP 800-53 SC-7, ISO/IEC 27001 A.8.20 +1
R09 Not knowing where PHP runs	16 high	Operational	through CTO (owner), Platform engineers and developers (treater)	NIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2
R01-1 Default Apache mod_php installations exploited before application code runs	15 high	Security	through Website owner (bearer), Platform engineers and developers (treater)	ISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3
R01-4 The fix is incomplete, or a third flaw follows	15 high	Security	through Platform engineers and developers (bearer)	NIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R01-5 Popular applications compromised before authentication	15 high	Security	through Website owner (owner)	OWASP Top 10s A06:2021, PCI DSS 6.3.1, CIS Controls 16.4
R03-1 Attempts before disclosure	15 high	Security	through Security lead and AppSec (owner)	NIST CSF 2.0 ID.RA-02, ISO/IEC 27001 A.5.7, NIST SP 800-53 SI-4, PCI DSS 12.10.1
R04-2 Councils and police offline without saying why	15 high	Reputational	through Communications team (treater)	Cyber Essentials SUM, NIST CSF 2.0 RS.CO-03, ISO/IEC 27001 A.5.24
R06 A compromise becomes a reportable breach	15 high	Compliance	through Data protection officer (owner), Board and executives (owner)	GDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2
R06-1 Personal data taken from a compromised PHP application	15 high	Compliance	through Data protection officer (owner)	GDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable	12 high	Security	through Security lead and AppSec (owner)	NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2
R03-3 Exploited in the wild without anyone being able to show it	12 high	Governance	through Board and executives (owner)	CISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01
R03-4 Detections built on a proof of concept with the wrong mechanism	12 high	Security	through Security lead and AppSec (owner)	NIST SP 800-53 RA-5, SOC 2 CC7.1, NIST CSF 2.0 ID.RA-01
R04-3 The agencies' advice disagrees	12 high	Governance	through Board and executives (owner)	ISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20
R06-2 Essential and financial entities miss their reporting clocks	12 high	Compliance	through CISO (treater)	NIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report	12 high	Compliance	through Platform engineers and developers (treater)	Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II
R07 Decisions made on numbers that measure something else	12 high	Governance	through Board and executives (owner)	NIST CSF 2.0 GV.RM-01, ISO/IEC 27001 6.1.2, OWASP Top 10s LLM09:2025

Where its risks sit

Likelihood / impact	1 Minor	2 Moderate	3 Significant	4 Major	5 Severe
5 Happening	5	10	15 R04-2	20 R02 R04	25
4 Likely	4	8	12 R04-3 R07	16 R01-6 R05 R09	20 R01-3 R03 R08
3 Possible	3	6	9	12 R01-2 R03-3 R03-4 R06-2 R06-3	15 R01-1 R01-4 R01-5 R03-1 R06 R06-1
2 Unlikely	2	4	6	8	10
1 Rare	1	2	3	4	5

Its parts

Board and executives: 5 risks
CISO: 2 risks
CTO: 3 risks
CFO: 1 risks
Security lead and AppSec: 6 risks
Platform engineers and developers: 4 risks
Website owner: 2 risks
Communications team: 2 risks
Data protection officer: 2 risks

The standards its register touches

ISO/IEC 27001 (12), NIST CSF 2.0 (11), NIST SP 800-53 (7), GDPR (6), NIS2 (5), DORA (5), CIS Controls (4), PCI DSS (4), Cyber Resilience Act (4), OWASP Top 10s (3), Cyber Essentials (2), NIST SSDF (2), ISO/IEC 29147 and 30111 (2), SOC 2 (2), CISA KEV and BOD 22-01 (2), NIST AI RMF (2), FIRST TLP 2.0 (1), MITRE ATT&CK (1), EU AI Act (1), ISO/IEC 42001 (1)