Why October’s PHP Security Incident is a Big Deal for Local Government – And What To Do About It
What happened and who was impacted
On October 21, the FBI warned that new PHP flaws could let attackers take over systems. Many software providers went offline to patch, including two of the largest in local government:
- Granicus took several services offline, including Media Manager. Fairfax and Vienna, Virginia lost meeting video and agendas for about a day.
- CivicPlus took its municipal website platform offline. Naples, Florida lost its site for a time. Two CivicPlus products were still down a week later.
Both called it a precaution, and neither reported a breach. That was the responsible call, and city staff quickly pointed residents elsewhere.
Why is this a big deal?
The severity of the flaw and the speed at which attackers acted upon it was unprecedented.
The flaws let an attacker take over an unpatched site without a password. When word of the vulnerability got out, exploit attempts seen by Cloudflare went from thousands to millions in a matter of hours. CISA, the FBI and the NSA said patch now or take the site offline.
Going offline for days is not an option for public organizations whose legal mandates require specific public notice timelines. The posting deadline in open meetings law doesn’t move, and canceling meetings can create major disruptions.
This can result in non-compliance with legal mandates, exposure to litigation, or worse – disruption and delays to critical resident services.
This was bad, but it will probably get worse
The PHP Foundation wrote that “tools now find bugs faster than ever, for defenders and attackers alike.” Odds are there are more, and the frequency is only going to increase.
The trouble starts when code any AI model can read in full is kept up by a small, underfunded team and runs on versions past end of support. That can look like an entire codebase, like PHP or homegrown systems maintained by understaffed IT teams. Teams are not well equipped to deal with a doubling or tripling of patching workloads on ever-shorter timelines.
How is it changing how organizations think about security?
If you run homegrown systems, it’s time to revisit the trade-offs of building and maintaining your own. That math worked when patches came a few times a year. With fixes arriving faster and attacks following within hours, the bigger cost is keeping it current.
If you rely on legacy software from a large vendor, it’s a reason to pick your head up and ask how current that foundation is, and to look at vendors who can move faster on more secure, trusted and reliable frameworks.
How IT teams are modernizing to secure, trusted, reliable infrastructure
Cities are being urged to shore up their systems, and homegrown sites get the hardest look. The team that built a custom site owns every patch on it. With fixes arriving faster and attacks days behind, that’s a standing job most small IT shops don’t have the staff or budget for. Many are moving public-facing tools to hosted platforms where the vendor patches. Three places to start:
- Ask each vendor whether it ran affected software, when it patched, and how fast it ships security fixes.
- List every homegrown public-facing system and who patches it.
- Flag anything past end of support.
- Evaluate modern alternatives to legacy and homegrown solutions
How PublicInput takes a modern approach to infrastructure security and stability
Our customers’ meetings, agendas and engagement projects stayed online that week. PublicInput runs on Microsoft .NET with no PHP on its production servers, so the flaw didn’t touch it.
We leverage continuous patching approaches built upon Microsoft’s managed .NET infrastructure, placing the platform’s stability and security on a strong foundation backed by a multi-trillion-dollar team at the forefront of IT security and infrastructure.
If your IT team is reviewing public-facing systems, put your meeting and engagement tools on the list and bring us in on that review. Meeting day shouldn’t hinge on the next patch.
