| R01-3 Versions the PHP project no longer fixes stay vulnerable | 20 critical | Security | through Organisations running PHP (owner), Hosting panels and paid long-term support (treater), Linux distributions and image builders (treater), CTO (owner), CFO (bearer) | NIST SP 800-53 SA-22, CIS Controls 2.2, NIST CSF 2.0 PR.PS-02, Cyber Essentials SUM +1 |
| R02 The coordinated disclosure broke before the fix was ready | 20 critical | Disclosure process | through The PHP security team (owner), The finders (source), Distributors and packagers (source), Organisations running PHP (bearer), Security lead and AppSec (bearer) | ISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT |
| R02-1 The CVE IDs and the proof-of-concept video circulated before release | 20 critical | Disclosure process | through Calif (source), The PHP security team (owner), Edge, WAF and detection vendors (treater) | ISO/IEC 29147 and 30111 29147:coordination, NIST CSF 2.0 ID.RA-08 |
| R03 Exploitation outpaces patching | 20 critical | Security | through Organisations running PHP (owner), Threat intelligence and detection (informer), US: CISA and the NSA (regulator), Security lead and AppSec (treater) | CISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3 |
| R03-2 Mass scanning and mutated payloads after the leak | 20 critical | Security | through WAF vendors (treater), Organisations running PHP (owner) | MITRE ATT&CK T1595.002, NIST CSF 2.0 DE.CM-01, CIS Controls 13.10 |
| R04 Services lost to precautionary shutdowns | 20 critical | Operational | through Governments and public services (owner), People who need a service that went offline (bearer), Agencies and CERTs (source), Board and executives (owner), Communications team (treater) | ISO/IEC 27001 A.5.29, ISO/IEC 27001 A.5.30, NIS2 Art.21(2)(c), DORA Art.11 +2 |
| R04-1 National government services offline | 20 critical | Operational | through National governments (owner), People who need a service that went offline (bearer), EU and member-state CERTs (informer) | NIS2 Art.21(2)(c), ISO/IEC 27001 A.5.29, NIST CSF 2.0 RC.RP-01 |
| R08 Frontier AI finds critical flaws faster than maintainers can fix them | 20 critical | Strategic | bearer | EU AI Act Art.55, NIST AI RMF GOVERN-6.1, NIST AI RMF MEASURE-2.7, ISO/IEC 42001 6.1.2 |
| R01-6 Products that embed PHP stay vulnerable while their suppliers investigate | 16 high | Supply chain | through Suppliers in the NCSC-NL inventory (owner), Organisations running PHP (bearer), EU and member-state CERTs (informer), CTO (owner) | Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4 |
| R02-3 Patched builds published before the embargo lifted | 16 high | Supply chain | through Chainguard (source), Distributors and packagers (owner), The PHP security team (regulator) | ISO/IEC 29147 and 30111 29147:coordination, Cyber Resilience Act Art.13, NIST CSF 2.0 GV.SC-05, OWASP Top 10s A03:2025 |
| R05 A web application firewall taken for a patch | 16 high | Security | through WAF vendors (informer), Security lead and AppSec (owner), Online shops and payments (bearer) | PCI DSS 6.4.2, CIS Controls 13.10, NIST SP 800-53 SC-7, ISO/IEC 27001 A.8.20 +1 |
| R08-1 A known bug left unexploited, then unfixed, for two years | 16 high | Strategic | through The PHP project (owner), Quarkslab and OSTIF (informer), The PHP Foundation (treater) | NIST SSDF PW.7, NIST SSDF RV.2, Cyber Resilience Act Art.24, ISO/IEC 27001 A.8.25 |
| R09 Not knowing where PHP runs | 16 high | Operational | through CTO (owner), Platform engineers and developers (treater), Suppliers in the NCSC-NL inventory (informer) | NIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2 |
| R01 Remote code execution on internet-facing PHP servers | 15 high | Security | through Organisations running PHP (owner), People who use PHP services (bearer), The PHP project (treater), Hosting and cloud providers (treater), Edge, WAF and detection vendors (treater), Agencies and CERTs (informer) | ISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3 |
| R01-1 Default Apache mod_php installations exploited before application code runs | 15 high | Security | through Shared and self-service hosting (owner), Website owner (bearer), Platform engineers and developers (treater) | ISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3 |
| R01-4 The fix is incomplete, or a third flaw follows | 15 high | Security | through The fix authors (owner), The PHP security team (treater), Organisations running PHP (bearer), Platform engineers and developers (bearer), The finders (informer) | NIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling |
| R01-5 Popular applications compromised before authentication | 15 high | Security | through Open-source PHP applications (informer), Website owner (owner), Online shops and payments (bearer) | OWASP Top 10s A06:2021, PCI DSS 6.3.1, CIS Controls 16.4 |
| R03-1 Attempts before disclosure | 15 high | Security | through Threat intelligence and detection (informer), Security lead and AppSec (owner) | NIST CSF 2.0 ID.RA-02, ISO/IEC 27001 A.5.7, NIST SP 800-53 SI-4, PCI DSS 12.10.1 |
| R04-2 Councils and police offline without saying why | 15 high | Reputational | through Local councils (owner), Communications team (treater), UK NCSC (informer) | Cyber Essentials SUM, NIST CSF 2.0 RS.CO-03, ISO/IEC 27001 A.5.24 |
| R06 A compromise becomes a reportable breach | 15 high | Compliance | through Organisations running PHP (owner), Data protection officer (owner), People whose data is held in PHP applications (bearer), EU and member-state CERTs (regulator), Board and executives (owner) | GDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2 |
| R06-1 Personal data taken from a compromised PHP application | 15 high | Compliance | through Data protection officer (owner), People whose data is held in PHP applications (bearer), Managed PHP platforms (treater) | GDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2 |
| R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable | 12 high | Security | through Security lead and AppSec (owner), Managed PHP platforms (treater), The PHP security team (informer) | NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2 |
| R03-3 Exploited in the wild without anyone being able to show it | 12 high | Governance | through Threat intelligence and detection (informer), US: CISA and the NSA (regulator), Board and executives (owner) | CISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01 |
| R03-4 Detections built on a proof of concept with the wrong mechanism | 12 high | Security | through Threat intelligence and detection (treater), Security lead and AppSec (owner) | NIST SP 800-53 RA-5, SOC 2 CC7.1, NIST CSF 2.0 ID.RA-01 |
| R04-3 The agencies' advice disagrees | 12 high | Governance | through Agencies and CERTs (source), Board and executives (owner), The press (informer) | ISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20 |
| R06-2 Essential and financial entities miss their reporting clocks | 12 high | Compliance | through Critical infrastructure providers (owner), Banks, insurers and financial entities (owner), EU and member-state CERTs (regulator), CISO (treater) | NIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1 |
| R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report | 12 high | Compliance | through Suppliers in the NCSC-NL inventory (owner), The PHP Foundation (informer), EU and member-state CERTs (regulator), Platform engineers and developers (treater) | Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II |
| R07 Decisions made on numbers that measure something else | 12 high | Governance | through The press (source), Wiz Research (source), Board and executives (owner), This newsroom (treater) | NIST CSF 2.0 GV.RM-01, ISO/IEC 27001 6.1.2, OWASP Top 10s LLM09:2025 |
| R08-2 Several finders, one small team | 12 high | Operational | through The PHP security team (bearer), The finders (source), The PHP Foundation (owner) | ISO/IEC 29147 and 30111 29147:receipt, NIST CSF 2.0 ID.RA-08, NIST SSDF RV.1 |
| R10 This newsroom's own agents are steered, leak or mislead | 12 high | AI and agents | through The editor (owner), The newsroom's agents (treater), This site's readers (bearer) | EU AI Act Art.50, NIST AI RMF MANAGE-2.4, ISO/IEC 42001 6.1.3, OWASP Top 10s LLM06:2025 |
| R10-1 Prompt injection through captured material | 12 high | AI and agents | through The newsroom's agents (treater), The editor (owner) | OWASP Top 10s LLM01:2025, NIST AI RMF MEASURE-2.7, EU AI Act Art.15 |
| R10-3 A status word stronger than its evidence | 12 high | AI and agents | through The newsroom's agents (source), This site's readers (bearer), The editor (owner) | OWASP Top 10s LLM09:2025, EU AI Act Art.50 |
| R10-2 A vault key or token published | 10 medium | AI and agents | through The newsroom's agents (treater), The editor (owner), This site's readers (bearer) | OWASP Top 10s LLM02:2025, GDPR Art.32, ISO/IEC 27001 A.5.14 |
| R02-2 Early mitigation advice to a few providers leaked | 9 medium | Disclosure process | through Critical infrastructure providers (source), The PHP security team (owner), Organisations running PHP (bearer) | FIRST TLP 2.0 TLP:AMBER+STRICT, ISO/IEC 27001 A.5.14, ISO/IEC 29147 and 30111 29147:coordination |