PHP2Shell for City, County and Special District Websites

As of 23 October 2026, CISA is urging every organization to patch PHP2Shell immediately and to take PHP-based systems offline if they cannot be updated right away or still run PHP 8.1 or older. CISA said at publication that it had not observed exploitation, and the flaws are not on its Known Exploited Vulnerabilities list as of 23 October, but exploitation attempts are widely reported. PHP2Shell is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. PHP runs on the server behind many city, county and special district websites, including most WordPress, Drupal and Joomla sites.

The direct answer for a local government: find every public-facing system that runs PHP, including the ones your vendors host, and get written confirmation that each one is on a patched build and was restarted. Anything that can't be patched quickly should be restricted or taken offline until it is. Then sign up for CISA's free Cyber Hygiene scanning so the next one is caught sooner.

This guide is for city and county IT staff, communications teams, clerks and special district managers. For the patched version numbers, see our PHP2Shell fixed versions guide.

What the Agencies Said, and When

The core message from every agency is the same: patch now, and isolate what you can't patch.

Two dated details matter. MS-ISAC's page shows an issue date of 19 October, before the CVE numbers were public, and 21 October in its sidebar, so cite it by number. And on 23 October, PHP published an informational advisory for a third issue, CVE-2026-115560, which Canada's update says "is not addressed by the security updates released on October 21, 2026." PHP's advice is to set session.upload_progress.enabled=0 until the next regular release. If that setting is already in place, no further action is needed for it.

Exploitation status changes daily. Our PHP2Shell exploitation tracker keeps the latest dated reports.

Why Government Websites Went Offline This Week

On 21 October, government websites in several countries went offline or became partly unavailable. All of the following come from news reports unless marked first-party, and every one describes the action as precautionary or done while patching.

• Netherlands (Reuters). Reuters reported that the Dutch cybersecurity agency took its own site offline "as a precaution," and that several organizations followed its example, including the government portal Overheid.nl.
• Finland (Reuters). State IT provider Valtori said government public network services had been taken offline "as a precautionary measure."
• Denmark (Reuters). Municipal IT company Kombit said it had shut down several services, including the national school communication platform.
• Germany and Belgium (Australian Associated Press). AAP listed both among governments that made "precautionary website and internet services shutdowns."
• Australia (AAP). The Australian Signals Directorate said it was aware of "an outage that may be affecting government websites, including https://cyber.gov.au," and that it was not aware of active exploitation.
• Latvia (CERT.LV, first-party). Access from abroad to several state resources was restricted. By 23:00 on 21 October, the shared platform that hosts state and municipal websites had been patched and access from within Latvia restored. CERT.LV identified about 6,000 potentially affected resources in Latvia, only a few hundred of them in the state sector.

No source we reviewed attributes any of these outages to a successful PHP2Shell attack. Taking a site offline to patch is a recognized, cautious response.

Should Your Site Go Offline?

Use CISA's rule as the starting point. If a public-facing PHP system cannot be updated immediately, or runs PHP 8.1 or earlier, CISA says organizations "should take PHP-based systems offline until they can be patched or updated." PHP 8.1 and older get no official releases, only source backports and vendor fixes, so treat them as unpatched until a vendor confirms otherwise.

Taking a system offline does not have to mean pulling the plug:

• Serve a maintenance page. The security firm Beazley advises using "a maintenance response or network restriction rather than disabling the PHP handler, which can expose application source code and credentials."
• Restrict who can reach it. Internal tools and staff portals can be limited to your network or VPN. Beazley says to "Restrict PHP applications that do not require public access to trusted networks or a VPN."
• Keep residents informed. Post a short notice on your social channels or another site you control, with a phone number for urgent services. Our suggestion: make that notice accessible, with plain text rather than an image of text.

Before you restart or rebuild a system you suspect was attacked, preserve its logs. The UK NCSC advises assessing systems "for any evidence of compromise prior to your upgrade or mitigation." Our guides on checking whether a site was hacked through PHP2Shell and the first hour of a website incident cover what to keep and who to call.

Find Every PHP System, Including the Ones Vendors Run

The main website is rarely the only PHP system a jurisdiction depends on. CISA warns that "PHP is often a component of other software and prevalence may not be directly observable," and the Dutch NCSC notes that PHP "is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly." It maintains a public list of affected third-party products on GitHub that ENISA and Canada both point to.

Build a quick list, then ask the owner of each item whether it runs PHP. Categories worth checking:

• The main website and any department or microsites, including old ones still online.
• Online payment, permitting, licensing and reservation front ends.
• Agenda, meeting video and public records portals.
• Webmail, intranets and staff portals.
• Library, recreation and utility billing sites, plus network appliances with web admin consoles.

Don't sort by version number. The NCSC says "As all versions may be affected, do not limit discovery to outdated PHP versions," and Linux distributions often fix PHP without changing the version number, so a site can look old and be patched, or look current and still need a restart.

Vendor-run does not mean vendor-responsible in the eyes of your residents. The same principle shows up in the ADA rule, which says a county web page must meet the accessibility standard "even if a local web design company made the web page and updates it for the county." Our guide to the shared responsibility model helps map who owns what.

Questions to Send Your Website Vendor or Host

Ask for dated, written answers for your incident file.

1. Which of our sites and systems run PHP, and which PHP version and build serves each one?
2. Has each been updated to a release or vendor package that fixes CVE-2026-109618 and CVE-2026-109619? How did you confirm it: package changelog, build date or version?
3. Were all PHP workers and web services restarted after the update? The fix does not take effect until they are.
4. Is session.upload_progress.enabled set to 0, per PHP's 23 October advisory on CVE-2026-115560?
5. Are any of our systems on PHP 8.1 or older? If so, what is the plan and date to move them?
6. Have you reviewed logs from at least 17 October 2026 for signs of compromise, and will you share the result?
7. Is a web application firewall in front of our sites, and is it in blocking mode?

A good answer names versions, dates and the check performed; "we're aware and monitoring" deserves a follow-up. Our copy-and-paste message for your web host has a ready-made version and examples of good and weak replies.

Free and Low-Cost Help: CISA Cyber Hygiene and MS-ISAC

CISA Cyber Hygiene (free)

CISA's Cyber Hygiene services "are available at no cost" to "U.S.-based federal, state, local, tribal and territorial governments," as well as critical infrastructure organizations. Two services are most relevant to websites:

• Vulnerability Scanning "continuously monitors and assesses internet-accessible network assets (public, static IPv4 addresses)," with weekly reports and ad-hoc alerts about urgent findings, including known exploited vulnerabilities.
• Web Application Scanning examines publicly accessible web applications, with detailed monthly reports.

To sign up, email vulnerability@cisa.dhs.gov with the subject line Requesting Cyber Hygiene Services. CISA says services "typically begin within three business days after completing sign up," with reports "within two weeks of the scanning start date." That is too slow to fix PHP2Shell this week, but it is the cheapest way to catch the next critical flaw before attackers do. CISA also has staff in 10 regional offices who can help local governments with no-cost services.

MS-ISAC (now fee-based)

The Multi-State Information Sharing and Analysis Center (MS-ISAC) was historically free to state and local governments through federal funding. That ended: CIS says organizations that had not pursued paid membership "will begin to lose access to MS-ISAC services after October 1, 2025." A CIS page that states its fee-based model applies "As of June 23, 2025" says Tier 1 membership "tops out at just $1,495 annually for organizations with annual operating budgets under $25 million," and that Tier 1 organizations can request a hardship waiver for a free first year. Those 2025 prices may have changed; confirm with CIS. The no-cost CIS SecureSuite membership continues separately.

Grant funding

As of 23 October 2026, the status of the State and Local Cybersecurity Grant Program after 30 September 2026 is unclear. Check with your State Administrative Agency for current funding before planning around it.

Emergency Procurement: What You Can and Can't Assume

If you need outside help quickly, check your purchasing rules before signing anything. This is general information, not legal advice.

• State and local rules vary. Emergency purchasing thresholds, approvals and documentation differ by state, county, city and district. Ask your procurement office and check your own code before treating PHP2Shell work as an emergency purchase.
• Federal grant money has its own rule. If the purchase is paid with federal grant funds, 2 CFR 200.320(c)(3) allows a noncompetitive purchase only when "the public exigency or emergency for the requirement will not permit a delay resulting from providing public notice of a competitive solicitation." Under 2 CFR 200.317, a state uses its own procurement policies for federal-award purchases, while all other recipients and subrecipients, including subrecipients of a state, follow 2 CFR 200.318 through 200.327.
• Document as you go. Our suggestion: record why the work could not wait, the dated agency advisories you relied on, and the scope you bought, so the file supports the decision later.

Turn the Fix Into a Combined Project: ADA Title II

Many local government sites that struggle with PHP2Shell are older sites on unsupported PHP versions or platforms. Fixing them properly may mean a migration or rebuild, and that same site has an accessibility deadline coming.

The Department of Justice's ADA Title II rule makes WCAG 2.1 Level AA the technical standard for state and local government web content and mobile apps. Under an April 2026 interim final rule, the compliance dates are:

If you are already moving off PHP 8.1, retiring an old CMS or rebuilding a vendor site, scoping accessibility into the same project avoids paying for two rebuilds. Our guide to the ADA Title II web accessibility rule explains the requirements, and our government web design team builds sites with both security and accessibility in scope.

A Short Checklist for Small Jurisdictions

Conclusion

As of 23 October 2026, every major agency gives local governments the same instruction for PHP2Shell: find every PHP system, patch and restart it, and isolate anything that can't be fixed quickly. The European outages were precautionary per the reports, and a planned, well-communicated outage is a reasonable choice for a small jurisdiction too. Use this incident to get written answers from vendors, enroll in CISA's free Cyber Hygiene scanning, and fold any rebuild into your ADA Title II plans. If your city, county or district needs help assessing or patching its sites, our government website security team works with public agencies. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions