Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / The PHP project / The PHP Foundation

The PHP Foundation: its risk register

Funds core developers; published the account of discovery and the leak; the kind of body the Cyber Resilience Act calls an open-source steward.

Kind organisation · Assigned here 3 · In its register 3 · in the story as The PHP Foundation

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R08-1 A known bug left unexploited, then unfixed, for two years16 highStrategictreaterNIST SSDF PW.7, NIST SSDF RV.2, Cyber Resilience Act Art.24, ISO/IEC 27001 A.8.25
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report12 highComplianceinformerCyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II
R08-2 Several finders, one small team12 highOperationalownerISO/IEC 29147 and 30111 29147:receipt, NIST CSF 2.0 ID.RA-08, NIST SSDF RV.1

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 R08-216 R08-120
3 Possible3 6 9 12 R06-315
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Suppliers in the NCSC-NL inventory (1), EU and member-state CERTs (1), Platform engineers and developers (1), The PHP project (1), Quarkslab and OSTIF (1), The PHP security team (1), The finders (1)

The standards its register touches

Cyber Resilience Act (4), NIST SSDF (3), ISO/IEC 27001 (1), ISO/IEC 29147 and 30111 (1), NIST CSF 2.0 (1)