Government Website Security. Patched now, rebuilt right.

PHP2Shell put every city, county and special district site running on PHP on the same deadline. We patch what's exposed, review what your vendors run, and rebuild sites that can't be kept safe, with ADA Title II accessibility built into the same project.

Why now

Two duties, one window

On 21 October 2026 the PHP project fixed two critical flaws, known as PHP2Shell, in the engine that runs most WordPress, Drupal and Joomla sites. CISA urged immediate patching and said organizations that can't update, or that still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated." The UK NCSC and an EU joint statement led by ENISA gave the same advice.

Many public-sector sites run on older PHP, managed by a vendor or a small IT team that also runs everything else. Reuters reported government websites going offline after the disclosure, as operators patched or followed official advice. No source we've reviewed attributes those outages to attacks.

The same sites face a second deadline. Under the Department of Justice's ADA Title II web rule, as extended in April 2026, state and local governments serving 50,000 or more people must meet WCAG 2.1 AA by 26 April 2027, and smaller governments and special districts by 26 April 2028. A site that has to be patched now and made accessible within 18 months is often cheaper to fix once.

How we work

From exposed to compliant

Security first, then the long-term fix. Each step stands on its own, so you can stop where your budget does.

Emergency check and patch

We confirm what PHP your sites run, who controls it, and get it onto a fixed build, with your vendor or host if they run it. Details on our emergency PHP patching page.

Compromise review

We look for the warning signs researchers have described, back to 17 October 2026, and report what we find before changing anything that could be evidence.

Inventory and vendor review

A list of every public-facing site and tool, what it runs, who maintains it and whether it's supported. We give you the questions to put to each vendor.

Accessibility and security audit

A WCAG 2.1 AA review alongside the security review, so one report covers both duties. See our accessibility audit.

Rebuild where it pays

For sites on end-of-life PHP or unmaintained themes, a rebuild on a supported stack with accessibility built in, URLs preserved and content migrated.

Deadlines

The dates that matter

Date	What	Source
21 Oct 2026	PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix PHP2Shell	php.net
31 Dec 2026	PHP 8.2 stops receiving security fixes	php.net
26 Apr 2027	ADA Title II web rule: governments serving 50,000+ people	ada.gov
26 Apr 2028	ADA Title II web rule: under 50,000 and special districts	ada.gov

Procurement-ready

What your purchasing office will ask for

✓

Written scope and fixed-fee options

✓

W-9 on request

✓

Security questionnaire answers

✓

Accessibility conformance approach (WCAG 2.1 AA)

✓

Section 508 experience

✓

Plain-English reporting for councils and boards

✓

Work with your existing host or vendor

✓

Data handled only as the engagement needs

Buying

Emergency now, full procurement later

Purchasing rules differ by state, county and city, and many allow faster paths for urgent security work. We don't assume yours does. Tell us what your office allows and we'll scope to it: a small emergency engagement first, with the larger rebuild through your normal RFP or quote process.

If you already have a solicitation, our RFP FAQ explains how we respond, and our government web design and municipal website design pages describe the rebuild work.

Read first

Guides for public-sector teams

Blog

FAQ

Common questions

Our site is run by a vendor. Do we still need to act?

Yes. Ask the vendor in writing which PHP version and build your site runs, whether it has the PHP2Shell fix, and when workers were restarted. We can review their answer or talk to them directly.

Is the site safe if it shows a recent PHP version number?

Not necessarily. Linux distributions patch PHP without changing the version number, and the opposite can also be true. The reliable check is the package version from the vendor's advisory, or a written answer from your host.

Can you work under our emergency procurement rules?

We scope to whatever your rules allow. We don't assume a particular threshold or process; your purchasing office decides that.

Do we have to rebuild?

No. Patching comes first and is often enough. A rebuild makes sense when a site runs end-of-life PHP or unmaintained software, or when it also needs substantial accessibility work before the Title II date.

Are there free federal resources we should use too?

Yes. CISA says its Cyber Hygiene services are "available at no cost" to state, local, tribal and territorial governments, including vulnerability scanning of internet-facing systems and web application scanning. To enroll, CISA asks you to email vulnerability@cisa.dhs.gov with the subject "Requesting Cyber Hygiene Services". It complements a website review; it doesn't replace patching.

Can you help with ADA Title II at the same time?

Yes. Our accessibility audit reviews against WCAG 2.1 AA, and a rebuild can build conformance in from the start.