On October 21, a day after pre-announcing it, the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619 — two unauthenticated remote code execution bugs in the interpreter itself, both CVSS v4.0 9.2. The project put the risk highest for mod_php: "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." Neither CVE is in CISA's KEV catalog as of the October 23 release.
CivicPlus, which runs municipal websites and permitting software for local governments, opened an incident at 12:30 PM that day. DysruptionHub reported that afternoon that the shutdown covered all versions of Web Open, and that Naples, Florida had its city site among those down. CivicPlus has not named a CVE: as of October 26 its entries say only "a security vulnerability affecting PHP," and that "There is no evidence that customer data has been compromised."
The restore order is the interesting part
The press covered the websites, and the websites came back. CivicPlus's status history shows five products resolving on October 22 inside nine hours: CP Authentication at 9:10 AM, Central at 3:06 PM, Community Development v4 and Municipal Websites Open both at 3:10 PM, Municode Codification at 3:52 PM, SeeClickFix 311 at 6:24 PM.
Community Development v3 and FMO are still listed offline. That entry opened October 21 at 12:30 PM, its state is "Identified," and the page counts it as ongoing for five days. Cost Recovery, opened October 22 at 10:16 AM, is still "Investigating" on day four.
Same vendor, same week, same stated cause. The split is not an operations story. These CVEs are in the PHP interpreter, not in anyone's application code, so remediation is a runtime version bump — and PHP's advisory divides its own audience along exactly that line. Updating means moving to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. For everything else, "PHP 8.1 and older no longer receive updates from the PHP project," and the security team "provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor."
A product that takes a package upgrade comes back the next afternoon. A product where somebody has to apply a source backport, rebuild and regression-test a code base old enough to need one does not — the same shape as a CVE whose fix exists for some release trains and not others. Nobody has to tell you which a product is. The restore clock does.
Reading a status page as a version inventory
Ten minutes per vendor, no cooperation required.
Sort by time-to-resolve, not by severity. During a runtime-level critical, every product in a catalog is hit by the same bug on the same day, so resolution time is close to a controlled experiment: the variable is the stack each product sits on. More than two days while a sibling took one is a version-pinning signal.
Read the component names. CivicPlus lists "Community Development (v3 + FMO)" and "Community Development (v4)" as separate entries. A vendor that publishes two major versions as two components is telling you it maintains two code bases, and the lower number has the shorter runway — the same read as dating a maintenance gap from outside, run against an ops artifact instead of a response header.
Count the sub-components. v4 breaks out into seven — Payments, Property Management, Inspections, Invoicing, Reports, Mapping System, Login. v3 + FMO is one, and one component usually means one deployable: one upgrade decision for every customer on it.
Then ask what the questionnaire doesn't. It asks whether the vendor patches. It does not ask which major version you are on, which runtime minor that version pins, or whether that minor is on upstream support or a backport. Those three are what the restore order proxies for, and they belong in writing alongside the questions worth asking a provider that holds your admin plane.
The cost: a status page carries no SLA, "Identified" is not a restore estimate, and you are reading an ops artifact as an architecture diagram. The version questions also have no leverage behind them mid-term — realistically they land at renewal, which is why writing them down now beats asking them today.
What to check this week
- Pull your vendors' status-page histories for October 21–26 and sort each by time-to-resolve. Flag anything that took more than two days while a sibling took one.
- For each SaaS product you depend on, write down the major version you are on. If your own records cannot answer that, that is the finding.
- Ask each vendor which runtime minor that version pins, and whether it gets upstream fixes or vendor backports. Put the answer in the renewal file.
- Subscribe to status notifications per component rather than globally, so a product you use is not buried with thirty you don't.
- If your permitting portal is one of the products still down, read Fla. Stat. §553.792(1)(e): a local government that misses a permit review deadline must "reduce the building permit fee by 10 percent for each business day that it fails to meet the deadline," unless "the delay is attributable to a force majeure or other extraordinary circumstances." Whether a vendor's precautionary shutdown qualifies is a question for your attorney, and cheaper asked before the first reduced invoice.
North InfoSec runs AI-assisted penetration testing and security assessments, including third-party exposure reviews of the kind described above. northinfosec.com