Is Your Municipal Website Built on PHP? What the PHP Security Flaw Means for Local Governments
Key Takeaways:
What happened: On October 21, 2026, two critical flaws were found in PHP, the language behind about 70% of websites. They let attackers take over a server without logging in, and millions of attack attempts followed.
Why it matters for local governments: Many municipal websites run on PHP through WordPress. Updating WordPress did not fix this; the patch had to happen at the server level.
The Munibit difference: Munibit does not use PHP or WordPress. It is a fully managed, in-house platform with no plugins to patch, so this flaw does not apply to Munibit sites.
This week, a critical security flaw in PHP, the programming language behind roughly 70% of the web, sent governments and companies around the world scrambling to patch their websites, and some took their sites offline entirely.¹
For a city clerk or county administrator, that raises one simple question: Is our website one of them?
Your municipal website is where residents pay utility bills, find meeting agendas, download permits, and check for emergency alerts. When it goes down or gets compromised, the impact lands on your community and your staff. Here is what happened, why so many local government websites are exposed, and how Munibit is built differently.
What Happened: The "PHP2Shell" Vulnerabilities
On October 21, 2026, the team that maintains PHP released an emergency fix for two serious security holes, nicknamed "PHP2Shell." Both were rated 9.2 out of 10 for severity, which puts them in the most dangerous category.²
Here is why they matter:
No login required. Both flaws can allow an attacker to run their own code on a web server without ever signing in.
They sit inside PHP itself. The problem is in the language underneath the website, not in a single plugin or theme. Researchers demonstrated working attacks against the latest versions of WordPress, Drupal, and Joomla³.
Attacks started fast. Cloudflare reported attacks on the morning of October 21, before the patch was even available⁴.
The NSA said to take sites offline if needed. If a PHP website cannot be patched right away, it is safer to pull it offline until it can be⁵.
There is one more detail every local government should notice. PHP 8.1 and older versions are already past end of life, and for those versions the fix was published only as a source patch, not a simple update⁶. Many websites quietly run on outdated PHP for years because no one is assigned to watch it.
Why Local Government Websites Should Pay Attention
Many local government websites run on PHP, most often through WordPress. WordPress is built on PHP and is a common choice for city, county, and special district websites, especially sites built by local web design firms. A typical WordPress site combines a theme with a stack of third-party plugins.
In this case, keeping WordPress up to date was not enough. The flaws live in PHP on the server, below WordPress and its plugins, and WordPress.org confirmed that no WordPress update would fix them⁴. The fix had to come from whoever manages the server.
For many small governments, that raises a hard question: who actually manages your server? Is it your website provider, a hosting company, the firm that built the site five years ago, or no one at all?
The Hidden Burden on Small Governments
Large organizations have security teams that patch servers within hours. Most small municipalities or special districts do not. The website often belongs to a clerk or administrator who already wears five other hats.
To keep a WordPress site safe, someone has to monitor and update:
Your server's PHP version and its security updates
WordPress core updates
Every plugin and theme, each on its own update schedule
Your hosting company's emergency fixes
Miss one, and the site can become an easy target. When a flaw like PHP2Shell hits, the only safe choices may be an emergency patch you do not control or taking your website offline. That means residents lose access to bill pay, forms, and public notices at the moment they need you.
Munibit: Built for Municipalities, Built for Peace of Mind
Munibit was designed from the ground up for small local governments, and it was built without PHP or WordPress. Our content management system is developed entirely in-house by our own team, so flaws in the PHP language, like this week's, are not part of the Munibit platform.
Here is what that means for your community:
No PHP. Munibit does not run on PHP, the language behind WordPress.
No plugin headaches. There is no patchwork of third-party plugins to install, track, and update. Every feature is built and maintained by Munibit.
Fully managed platform. Hosting, updates, and security are handled for you. Your staff spends time serving residents, not chasing server patches.
Built-in municipal features. Agendas and minutes, online payments, forms, AI-powered search, and accessibility tools to support your ADA Title II efforts are all included.
100% USA-based development and support. When you call, you reach a knowledgeable team right here in America.
One price, all features. No add-on fees and no collection of plugins to license.
Munibit is trusted by hundreds of local governments serving over millions of residents across the United States.
Five Questions to Ask Your Current Website Provider Today
Whatever platform you use now, these questions will tell you a lot about your risk:
Does our website run on PHP or WordPress?
Has the October 21, 2026 PHP security fix been applied to our server, and on what date?
Which version of PHP are we running, and does it still receive security updates?
How many third-party plugins does our site use, and who is responsible for updating them?
If a critical flaw is announced tomorrow, who patches our site, and how quickly?
If the answers are unclear, or if the answer to question five is "you are," it may be time to look at a different approach.
Make the Switch to Munibit
Your municipality should not need an IT department to keep its website safe and online. Don't wait for outdated software or an overlooked plugin to become your next emergency.
Schedule a demo to see a simpler, fully managed website platform designed specifically for local government.
Sources
Websites across world hit by millions of attempts to exploit PHP code flaw, The Guardian
Critical PHP Security Release October 21, 2026, InMotion Hosting
Major security alert: PHP vulnerable to critical RCE, Patchstack
PHP Security Release on 21 October 2026: What WordPress Site Owners Need to Do, Codeable
PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet, TechCrunch
NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities, NSA
Don’t wait for the next security flaw to make the decision for you.
See how easy it is to move your website to Munibit.
Frequently Asked Questions
-
WordPress can be secure when it is carefully maintained, but it runs on PHP, so it depends on regular server updates, plugin updates, and core updates. The October 2026 PHP flaw showed that keeping WordPress current is not always enough, because the fix had to be applied at the server level. Munibit takes that burden off your staff with a fully managed platform that does not use PHP or WordPress.
-
Start by asking your website provider or hosting company whether your site runs on PHP, which PHP version it uses, and whether the October 21, 2026 security fix has been applied. If your site runs on WordPress, it runs on PHP. Munibit websites do not use PHP, so this vulnerability does not apply to them.
-
Look for a fully managed platform where hosting, updates, and security are handled for you, with as few third-party plugins as possible. Built-in features like agendas and minutes, online payments, forms, and accessibility tools to support your ADA Title II efforts reduce the add-ons you have to maintain. Munibit includes all of these in one price, plus a US-based account manager, with plans starting at just $99/month.