Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / The PHP project / The PHP security team

The PHP security team: its risk register

Received the reports, ran the embargo, published the advisories and the oss-security announcements.

Kind team · Assigned here 7 · In its register 7 · in the story as Jakub Zelenka, Alexandre Daubois, PHP security team

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R02 The coordinated disclosure broke before the fix was ready20 criticalDisclosure processownerISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT
R02-1 The CVE IDs and the proof-of-concept video circulated before release20 criticalDisclosure processownerISO/IEC 29147 and 30111 29147:coordination, NIST CSF 2.0 ID.RA-08
R02-3 Patched builds published before the embargo lifted16 highSupply chainregulatorISO/IEC 29147 and 30111 29147:coordination, Cyber Resilience Act Art.13, NIST CSF 2.0 GV.SC-05, OWASP Top 10s A03:2025
R01-4 The fix is incomplete, or a third flaw follows15 highSecuritytreaterNIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable12 highSecurityinformerNIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2
R08-2 Several finders, one small team12 highOperationalbearerISO/IEC 29147 and 30111 29147:receipt, NIST CSF 2.0 ID.RA-08, NIST SSDF RV.1
R02-2 Early mitigation advice to a few providers leaked9 mediumDisclosure processownerFIRST TLP 2.0 TLP:AMBER+STRICT, ISO/IEC 27001 A.5.14, ISO/IEC 29147 and 30111 29147:coordination

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 R02 R02-125
4 Likely4 8 12 R08-216 R02-320
3 Possible3 6 9 R02-212 R01-215 R01-4
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Organisations running PHP (3), The finders (3), Security lead and AppSec (2), Distributors and packagers (2), Managed PHP platforms (1), The fix authors (1), Platform engineers and developers (1), Calif (1), Edge, WAF and detection vendors (1), Critical infrastructure providers (1), Chainguard (1), The PHP Foundation (1)

The standards its register touches

NIST CSF 2.0 (3), ISO/IEC 27001 (3), NIST SSDF (3), ISO/IEC 29147 and 30111 (3), NIS2 (1), FIRST TLP 2.0 (1), Cyber Resilience Act (1), OWASP Top 10s (1)