Permit portals, payment pages, council sites and records search often run on PHP. CivicOps helps city, county and agency IT teams patch CVE-2026-109618 and CVE-2026-109619, confirm every vendor did too, and explain it all to leadership in plain language.
Enter the PHP version from php -v, your hosting panel, or your vendor's reply. The check runs in your browser — nothing is sent.
Vendor-managed servers often run distribution packages that carry the fix under an older number. Ask the vendor to confirm in writing.
PHP2Shell is the name for two critical flaws in PHP — CVE-2026-109618 and CVE-2026-109619 — the software that runs a large share of government websites and online services. An attacker on the internet can send a crafted request and take control of an unpatched server, with no login. Fixes were released on October 21, 2026. Updating Drupal, WordPress or a vendor's application is not enough: the PHP software underneath must be patched.
A practical sequence for city, county and agency IT. Follow it yourself — or hand any phase to a CivicOps engineer who works alongside your staff.
CivicOps can: build the inventory with your team — including the systems nobody remembers owning.
CivicOps can: patch and test alongside your staff, and handle the vendor follow-up so your one IT person isn't on hold all day.
CivicOps can: verify every fix independently and deliver a council-ready status report with an upgrade plan.
Put a CivicOps engineer on your systems and your vendors. You keep control; we do the heavy lifting and the paperwork.
Leadership needs to know what happened, what it means for residents, and what IT is doing. Copy this, adjust it, send it.
Subject: Critical PHP security update (PHP2Shell) — status and next steps
A CivicOps Assessment tells you exactly which systems are patched, which are pending, and which need replacing — in a report written for council.
PHP2Shell isn't only an IT problem. Pick your role to see your next steps — and what CivicOps takes off your plate.
You own the fix. Exposure first, perfection later.
InventoryPatching with rollbackVendor follow-upIndependent verification
Start with anything residents reach from the internet. Vendor-hosted doesn't mean vendor-patched.
Drupal and WordPress sites for departments, news, agendas and emergency alerts.
Building permits, business licenses, inspections scheduling and applications.
Utility bills, parking tickets, court fees, recreation registration.
Public records requests, document archives, open data and meeting video portals.
311-style reporting, maps and property lookups built on PHP front ends.
Staff portals and legacy custom apps — often the oldest PHP in the building.
| Branch | Fixed in | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Official fix |
| PHP 8.4 | 8.4.27 | Official fix |
| PHP 8.3 | 8.3.36 | Official fix |
| PHP 8.2 | 8.2.35 | Official fix |
| PHP 7.4 – 8.1 | Backports / vendor packages | End-of-life |
| PHP 5.4 – 7.3 | None from PHP | Upgrade or isolate |
Restart every PHP worker after updating. Interim settings from the PHP security team (an enforced memory_limit=-1, session.upload_progress.enabled=0) reduce exposure but are not a fix.
Systems that can't be patched promptly should be restricted or taken offline until fixed, as the UK NCSC and CERT-EU advise.
CivicOps will send the questions, follow up, and independently verify each answer — so “we're patched” becomes evidence you can file.
Nine quick questions. You'll get a readiness score and a short list of gaps — and can send it straight to a CivicOps engineer.
Taking an unpatched portal offline is often the safest call. Tell residents clearly, give them another way to get it done, and line up help the right way.
[Service name] temporarily unavailable for a security update
To protect residents' information, [City/County] has temporarily taken [service name] offline while we apply an important security update. No action is needed from you.
While the service is unavailable, you can [pay / apply / request records] by calling [phone], emailing [email], or visiting [location] during business hours. Deadlines affected by this outage will be [extended / handled case by case].
We expect the service to return by [date]. We'll post an update here when it's back. Thank you for your patience.
CivicOps can: provide a fixed-scope statement of work, a quote written for public purchasing review, and documentation that supports an urgent-need justification.
This is general guidance, not legal or procurement advice. Follow your jurisdiction's purchasing rules.
Start small with an assessment, fix what matters, or keep engineers alongside your team.
Understand the workflow, systems and constraints, then define a useful scope.
A defined build, deployment and handover around an agreed departmental improvement.
Ongoing engineering capacity with agreed responsibilities, priorities and working reviews.
A short assessment produces a clear, fixed scope before any larger commitment.
Statements of work and quotes written for public purchasing review.
We work inside your change process, alongside IT staff and existing vendors.
Plain-language records of what changed, for leadership, auditors and future staff.
Three short steps. An engineer reads every request and replies with a proposed first step and scope.
If any public website or portal runs PHP and hasn't been patched, yes. That includes many Drupal and WordPress government sites and a large share of permitting, licensing, payment and records portals. Both flaws can allow remote takeover without a login.
Only if the vendor patched PHP on the servers that run your systems. Ask for written confirmation of the installed version or package, the install date, whether PHP workers were restarted, and how they verified it. Our vendor checklist above has the exact questions.
List every public-facing system that uses PHP, including vendor-hosted ones. Patch or confirm patching for internet-facing systems first, restart PHP workers, and restrict or take offline anything that can't be fixed quickly. Then document what was done for leadership.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4–8.1 have no official release (source backports and some vendor packages exist). PHP 5.4–7.3 get no fix from the PHP project and need upgrading or isolation.
Three questions: Are any of our public systems affected? Are they patched — including vendor-hosted ones? What is still pending, and when will it be done? Ask for a short written update, and support brief service interruptions if IT needs them. See the role guide above.
If an internet-facing PHP system can't be patched promptly, restricting or taking it offline is the safer call. Post a resident notice with another way to pay, apply or request records, and an expected return date — the template above is ready to copy.
Yes. We start with a fixed-scope assessment and write statements of work and quotes for public purchasing review. Tell us your requirements in the form and we'll match them.
Especially. CivicOps engineers work alongside your staff and vendors so one person isn't carrying an emergency alone, and we leave documentation behind so the knowledge stays with you.
Last reviewed October 21, 2026.