{"id":233432,"date":"2026-10-29T05:48:56","date_gmt":"2026-10-28T21:48:56","guid":{"rendered":"https:\/\/publicinput.com\/wp\/?p=233432"},"modified":"2026-10-30T00:35:07","modified_gmt":"2026-10-29T16:35:07","slug":"why-octobers-php-security-incident-is-a-big-deal-for-local-government-and-what-to-do-about-it","status":"publish","type":"post","link":"https:\/\/publicinput.com\/wp\/why-octobers-php-security-incident-is-a-big-deal-for-local-government-and-what-to-do-about-it\/","title":{"rendered":"Why October&#8217;s PHP Security Incident is a Big Deal for Local Government &#8211; And What To Do About It"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"233432\" class=\"elementor elementor-233432\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fde04f3 e-flex e-con-boxed e-con e-parent\" data-id=\"fde04f3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-61baf8e elementor-widget elementor-widget-text-editor\" data-id=\"61baf8e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2><b>What happened and who was impacted<\/b><\/h2><p><span style=\"font-weight: 400;\">On October 21, <\/span><a href=\"https:\/\/www.ic3.gov\/PSA\/2026\/PSA261023\"><span style=\"font-weight: 400;\">the FBI warned<\/span><\/a><span style=\"font-weight: 400;\"> that new PHP flaws could let attackers take over systems. Many software providers went offline to patch, including two of the largest in local government:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Granicus took several services offline, including Media Manager. <\/span><a href=\"https:\/\/www.ffxnow.com\/2026\/10\/21\/fairfax-city-meetings-go-offline-as-fbi-warns-of-ai-detected-vulnerability\/\"><span style=\"font-weight: 400;\">Fairfax and Vienna, Virginia<\/span><\/a><span style=\"font-weight: 400;\"> lost meeting video and agendas for about a day.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">CivicPlus <\/span><a href=\"https:\/\/dysruptionhub.com\/civicplus-php-security-website-shutdown\/\"><span style=\"font-weight: 400;\">took its municipal website platform offline<\/span><\/a><span style=\"font-weight: 400;\">. Naples, Florida lost its site for a time. Two CivicPlus products were still down a week later.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">Both called it a precaution, and neither reported a breach. That was the responsible call, and city staff quickly pointed residents elsewhere.<\/span><\/p><h2><b>Why is this a big deal?<\/b><\/h2><p><span style=\"font-weight: 400;\">The severity of the flaw and the speed at which attackers acted upon it was unprecedented.<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">The flaws let an attacker take over an unpatched site without a password. When word of the vulnerability got out, exploit attempts <\/span><a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2026\/10\/php-flaws-draw-millions-hacking-attempts-amid-global-push-fixes\/416771\/\"><span style=\"font-weight: 400;\">seen by Cloudflare<\/span><\/a><span style=\"font-weight: 400;\"> went from thousands to millions in a matter of hours. <\/span><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/21\/critical-vulnerabilities-php-require-immediate-patching\"><span style=\"font-weight: 400;\">CISA<\/span><\/a><span style=\"font-weight: 400;\">, the <\/span><a href=\"https:\/\/www.ic3.gov\/PSA\/2026\/PSA261023\"><span style=\"font-weight: 400;\">FBI<\/span><\/a><span style=\"font-weight: 400;\"> and the <\/span><a href=\"https:\/\/www.nsa.gov\/Press-Room\/Press-Releases-Statements\/Press-Release-View\/Article\/4630238\/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities\/\"><span style=\"font-weight: 400;\">NSA<\/span><\/a><span style=\"font-weight: 400;\"> said patch now or take the site offline.\u00a0<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">Going offline for days is not an option for public organizations whose legal mandates require specific public notice timelines. The posting deadline in open meetings law doesn&#8217;t move, and canceling meetings can create major disruptions.\u00a0<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">This can result in non-compliance with legal mandates, exposure to litigation, or worse &#8211; disruption and delays to critical resident services.<\/span><\/p><h2><b>This was bad, but it will probably get worse<\/b><\/h2><p><a href=\"https:\/\/thephp.foundation\/blog\/2026\/10\/21\/todays-php-security-release-and-how-were-strengthening-php-security\/\"><span style=\"font-weight: 400;\">The PHP Foundation<\/span><\/a><span style=\"font-weight: 400;\"> wrote that &#8220;tools now find bugs faster than ever, for defenders and attackers alike.&#8221; Odds are there are more, and the frequency is only going to increase.<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">The trouble starts when code any AI model can read in full is kept up by a <\/span><a href=\"https:\/\/www.tomshardware.com\/tech-industry\/cyber-security\/lack-of-funding-likely-led-to-the-recent-php-security-snafu-but-thats-just-the-tip-of-the-iceberg-a-dreary-situation-caused-by-services-running-old-versions-with-no-support\"><span style=\"font-weight: 400;\">small, underfunded team<\/span><\/a><span style=\"font-weight: 400;\"> and runs on versions past end of support. That can look like an entire codebase, like PHP or homegrown systems maintained by understaffed IT teams. Teams are not well equipped to deal with a doubling or tripling of patching workloads on ever-shorter timelines.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c810b85 elementor-widget elementor-widget-image\" data-id=\"c810b85\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"938\" src=\"https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-3.34.55-PM-1024x938.png\" class=\"attachment-large size-large wp-image-233435\" alt=\"Why open-source software sees security breaches\" srcset=\"https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-3.34.55-PM-1024x938.png 1024w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-3.34.55-PM-300x275.png 300w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-3.34.55-PM-768x704.png 768w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-3.34.55-PM-1536x1407.png 1536w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-3.34.55-PM.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-37736e8 elementor-widget elementor-widget-text-editor\" data-id=\"37736e8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2><b>How is it changing how organizations think about security?<\/b><\/h2><p><span style=\"font-weight: 400;\">If you run homegrown systems, it&#8217;s time to revisit the trade-offs of building and maintaining your own. That math worked when patches came a few times a year. With fixes arriving faster and attacks following within hours, the bigger cost is keeping it current.<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">If you rely on legacy software from a large vendor, it&#8217;s a reason to pick your head up and ask how current that foundation is, and to look at vendors who can move faster on more secure, trusted and reliable frameworks.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-263abee elementor-widget elementor-widget-image\" data-id=\"263abee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"1024\" height=\"699\" src=\"https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-4.22.43-PM-1024x699.png\" class=\"attachment-large size-large wp-image-233437\" alt=\"PHP vulnerability\" srcset=\"https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-4.22.43-PM-1024x699.png 1024w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-4.22.43-PM-300x205.png 300w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-4.22.43-PM-768x524.png 768w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-4.22.43-PM-1536x1048.png 1536w, https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-28-at-4.22.43-PM.png 1770w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b827ad elementor-widget elementor-widget-text-editor\" data-id=\"8b827ad\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2><b>How IT teams are modernizing to secure, trusted, reliable infrastructure<\/b><\/h2><p><span style=\"font-weight: 400;\">Cities are being <\/span><a href=\"https:\/\/www.smartcitiesdive.com\/news\/php-vulnerabilities-identified-cities-cybersecurity\/872865\/\"><span style=\"font-weight: 400;\">urged to shore up their systems<\/span><\/a><span style=\"font-weight: 400;\">, and homegrown sites get the hardest look. The team that built a custom site owns every patch on it. With fixes arriving faster and attacks days behind, that&#8217;s a standing job most small IT shops don&#8217;t have the staff or budget for. Many are moving public-facing tools to hosted platforms where the vendor patches. Three places to start:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/www.lmc.org\/news-publications\/news\/all\/php-security-issue-what-cities-should-do-now\/\"><span style=\"font-weight: 400;\">Ask each vendor<\/span><\/a><span style=\"font-weight: 400;\"> whether it ran affected software, when it patched, and how fast it ships security fixes.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">List every homegrown public-facing system and who patches it.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Flag anything past end of support.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Evaluate modern alternatives to legacy and homegrown solutions<\/span><\/li><\/ul><h2><b>How PublicInput takes a modern approach to infrastructure security and stability<\/b><\/h2><p><span style=\"font-weight: 400;\">Our customers&#8217; meetings, agendas and engagement projects stayed online that week. PublicInput runs on Microsoft .NET with no PHP on its production servers, so the flaw didn&#8217;t touch it.\u00a0<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">We leverage continuous patching approaches built upon Microsoft\u2019s managed .NET infrastructure, placing the platform&#8217;s stability and security on a strong foundation backed by a multi-trillion-dollar team at the forefront of IT security and infrastructure.\u00a0<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">If your IT team is reviewing public-facing systems, put your meeting and engagement tools on the list and bring us in on that review. Meeting day shouldn&#8217;t hinge on the next patch.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7bdc63e e-flex e-con-boxed e-con e-parent\" data-id=\"7bdc63e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2ed7c8f elementor-widget elementor-widget-button\" data-id=\"2ed7c8f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/publicinput.com\/wp\/request-a-demo\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Talk to Our Team<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>A security flaw in PHP, a decades-old web programming language, briefly took local government meeting and website platforms offline. Here&#8217;s what happened, what it means for agencies, and why PublicInput kept running.<\/p>\n","protected":false},"author":30,"featured_media":233434,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":1358,"footnotes":""},"categories":[1358],"tags":[],"class_list":["post-233432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"jetpack_featured_media_url":"https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature.png","rttpg_featured_image_url":{"full":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature.png",1200,628,false],"landscape":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature.png",1200,628,false],"portraits":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature.png",1200,628,false],"thumbnail":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature-150x150.png",150,150,true],"medium":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature-300x157.png",300,157,true],"large":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature-1024x536.png",1024,536,true],"1536x1536":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature.png",1200,628,false],"2048x2048":["https:\/\/publicinput.com\/wp\/wp-content\/uploads\/2026\/10\/PHP-Security-Incident-feature.png",1200,628,false]},"rttpg_author":{"display_name":"Allison Voigts","author_link":"https:\/\/publicinput.com\/wp\/author\/avoigts\/"},"rttpg_comment":0,"rttpg_category":"<a href=\"https:\/\/publicinput.com\/wp\/category\/blog\/\" rel=\"category tag\">Blog<\/a>","rttpg_excerpt":"A security flaw in PHP, a decades-old web programming language, briefly took local government meeting and website platforms offline. Here's what happened, what it means for agencies, and why PublicInput kept running.","_links":{"self":[{"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/posts\/233432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/comments?post=233432"}],"version-history":[{"count":7,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/posts\/233432\/revisions"}],"predecessor-version":[{"id":233443,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/posts\/233432\/revisions\/233443"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/media\/233434"}],"wp:attachment":[{"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/media?parent=233432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/categories?post=233432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/publicinput.com\/wp\/wp-json\/wp\/v2\/tags?post=233432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}