Sovereign Tech Agency expands Resilience program and highlights PHP2Shell impact

The Sovereign Tech Agency (STF) has announced an expansion of its Sovereign Tech Resilience program, adding four new specialized service areas to its existing security offerings. These new services focus on memory safety transition, post-quantum readiness, supply chain security, and compliance with the Cyber Resilience Act. The expansion aims to help critical open-source projects manage long-term security and technical debt through hands-on engineering and audits.

This update follows the emergence of the PHP2Shell vulnerabilities, which allowed unauthenticated remote code execution on web servers. The agency noted that its previous 2024 security audit of the PHP core, which identified 17 findings, contributed to addressing the underlying issues behind these vulnerabilities. Having invested over €60 million across 110 projects since its inception, the agency is reinforcing its role in securing European digital infrastructure.

Expansion of Sovereign Tech Resilience services

• New Service Domains: The program now includes dedicated support for memory safety transitions, post-quantum cryptography readiness, supply chain security, and Cyber Resilience Act compliance.
• Existing Service Scaling: The agency is increasing the number of service providers for its established technical debt management and security audit tracks to support more programming languages and ecosystems.
• PHP2Shell Context: The agency's 2024 core audit of PHP identified 17 security findings that informed subsequent work on the vulnerabilities collectively known as PHP2Shell, which enable unauthenticated code execution.
• Funding Model: The Resilience program provides engineering, audits, and bug-and-fix bounties to FOSS projects at no cost to the maintainers through specialized implementation partners.

Why it matters

By funding memory safety transitions and post-quantum readiness, the agency is addressing systemic technical debt in critical infrastructure before vulnerabilities are exploited. This proactive investment helps open-source maintainers meet emerging regulatory requirements like the Cyber Resilience Act without diverting limited project resources.