Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Edge, WAF and detection vendors / WAF vendors
WAF vendors: its risk register
Rules live hours before disclosure, each vendor saying in its own words that a rule is not a patch.
Kind group · Assigned here 2 · In its register 2 · in the story as Cloudflare, Akamai, Fastly, Imperva Threat Research
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R03-2 Mass scanning and mutated payloads after the leak | 20 critical | Security | treater | MITRE ATT&CK T1595.002, NIST CSF 2.0 DE.CM-01, CIS Controls 13.10 |
| R05 A web application firewall taken for a patch | 16 high | Security | informer | PCI DSS 6.4.2, CIS Controls 13.10, NIST SP 800-53 SC-7, ISO/IEC 27001 A.8.20 +1 |
Where its risks sit
The standards its register touches
MITRE ATT&CK (1), NIST CSF 2.0 (1), CIS Controls (1), PCI DSS (1), NIST SP 800-53 (1), ISO/IEC 27001 (1), Cyber Essentials (1)