Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Agencies and CERTs / US: CISA and the NSA

US: CISA and the NSA: its risk register

Advised taking systems offline where an update is not possible; keep the KEV catalogue that binds federal agencies.

Kind group · Assigned here 2 · In its register 2

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R03 Exploitation outpaces patching20 criticalSecurityregulatorCISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3
R03-3 Exploited in the wild without anyone being able to show it12 highGovernanceregulatorCISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 20 R03
3 Possible3 6 9 12 R03-315
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Threat intelligence and detection (2), Organisations running PHP (1), Security lead and AppSec (1), Board and executives (1)

The standards its register touches

NIST CSF 2.0 (3), CISA KEV and BOD 22-01 (2), ISO/IEC 27001 (2), NIST SP 800-53 (1), MITRE ATT&CK (1)