Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / The PHP project

The PHP project: its risk register

The people who write, fix and release PHP: the PHP Group, the PHP Foundation, the security team and the fix authors.

Kind group · Assigned here 3 · In its register 11 · in the story as The PHP Group / php.net, The PHP Foundation

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

Risk	Rating	Kind	Part played	Controls
R02 The coordinated disclosure broke before the fix was ready	20 critical	Disclosure process	through The PHP security team (owner)	ISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT
R02-1 The CVE IDs and the proof-of-concept video circulated before release	20 critical	Disclosure process	through The PHP security team (owner)	ISO/IEC 29147 and 30111 29147:coordination, NIST CSF 2.0 ID.RA-08
R08 Frontier AI finds critical flaws faster than maintainers can fix them	20 critical	Strategic	bearer	EU AI Act Art.55, NIST AI RMF GOVERN-6.1, NIST AI RMF MEASURE-2.7, ISO/IEC 42001 6.1.2
R02-3 Patched builds published before the embargo lifted	16 high	Supply chain	through The PHP security team (regulator)	ISO/IEC 29147 and 30111 29147:coordination, Cyber Resilience Act Art.13, NIST CSF 2.0 GV.SC-05, OWASP Top 10s A03:2025
R08-1 A known bug left unexploited, then unfixed, for two years	16 high	Strategic	owner	NIST SSDF PW.7, NIST SSDF RV.2, Cyber Resilience Act Art.24, ISO/IEC 27001 A.8.25
R01 Remote code execution on internet-facing PHP servers	15 high	Security	treater	ISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3
R01-4 The fix is incomplete, or a third flaw follows	15 high	Security	through The fix authors (owner), The PHP security team (treater)	NIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable	12 high	Security	through The PHP security team (informer)	NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2
R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report	12 high	Compliance	through The PHP Foundation (informer)	Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II
R08-2 Several finders, one small team	12 high	Operational	through The PHP security team (bearer), The PHP Foundation (owner)	ISO/IEC 29147 and 30111 29147:receipt, NIST CSF 2.0 ID.RA-08, NIST SSDF RV.1
R02-2 Early mitigation advice to a few providers leaked	9 medium	Disclosure process	through The PHP security team (owner)	FIRST TLP 2.0 TLP:AMBER+STRICT, ISO/IEC 27001 A.5.14, ISO/IEC 29147 and 30111 29147:coordination

Where its risks sit

Likelihood / impact	1 Minor	2 Moderate	3 Significant	4 Major	5 Severe
5 Happening	5	10	15	20 R02 R02-1	25
4 Likely	4	8	12 R08-2	16 R02-3 R08-1	20 R08
3 Possible	3	6	9 R02-2	12 R01-2 R06-3	15 R01 R01-4
2 Unlikely	2	4	6	8	10
1 Rare	1	2	3	4	5

Its parts

Who it shares risks with

Organisations running PHP (1), People who use PHP services (1), Hosting and cloud providers (1), Edge, WAF and detection vendors (1), Agencies and CERTs (1), OpenAI (Patch the Planet) (1), The finders (1), Everyone with PHP in the path (1), CISO (1), Quarkslab and OSTIF (1), The PHP Foundation (1)

The standards its register touches

ISO/IEC 27001 (5), NIST SSDF (5), Cyber Resilience Act (4), NIST CSF 2.0 (3), ISO/IEC 29147 and 30111 (3), OWASP Top 10s (2), NIS2 (2), NIST AI RMF (2), NIST SP 800-53 (1), CIS Controls (1), MITRE ATT&CK (1), FIRST TLP 2.0 (1), EU AI Act (1), ISO/IEC 42001 (1)