In short: A vulnerability on a municipality's website is an incident with a public audience. Clarify who operates the server, have the PHP patch and restart confirmed, and keep an emergency page ready in case the site has to go offline temporarily. Communication to citizens and the press should be agreed before questions arrive.
Which PHP systems municipalities typically operate
Many municipal websites run on TYPO3 and others on different PHP systems. Around the main site, further applications arise: online forms for applications and registrations, issue reporters, event calendars, citizen participation, job portals, daycare pre-registration, tourism sites, library catalogues and websites of individual institutions such as the music school or the municipal utilities.
Some of these applications are operated by the municipality itself, others by a municipal data centre, a special-purpose association or a specialist-application vendor. Anyone who wants to close a vulnerability in PHP must first know on whose servers which application runs.
Smaller municipalities often have no IT department of their own. There, a member of the main office looks after the site on the side, the technology is with an agency, and the contracts date from a time when nobody thought about critical vulnerabilities in the programming language. Larger cities have the opposite problem: so many sites for offices, projects and institutions that hardly anyone knows the complete list.
What is at stake on municipal websites
Forms and portals hold citizens' data: addresses, dates of birth, details about children in daycare and school registrations, photos and locations in issue reports, job applications. Public bodies are subject to the GDPR and the state data protection acts (German laws); the data protection supervisory authority of the federal state is usually responsible.
Integrity weighs at least as heavily: a municipality's website is an official source. Manipulated content, forged public notices or redirects to fraud sites under the city's name damage trust far beyond the technical harm.
Municipal domains enjoy the trust of citizens and search engines. That is exactly what makes them attractive to attackers: as a sender for spam, as storage for fraud sites or as a platform for false reports, for example about elections, severe weather or fees.
Municipality and website vulnerability: who decides what?
| Role | Typical task in an incident |
|---|---|
| Municipal data centre or IT service provider | Server, PHP packages, restart, network isolation |
| Main office or IT coordination | Overall management, commissioning, emergency plan |
| Press office | Informing citizens and media |
| Official data protection officer | Assessment of the reporting duty |
| Web agency | CMS, extensions, content |
The gap often arises between data centre and agency: the data centre runs the server, the agency maintains TYPO3, and each side assumes the other takes care of PHP. A TYPO3 update does not close PHP2Shell.
The BSI (German Federal Office for Information Security) has rated the situation as warning level 3 / orange and recommends an immediate update. If a municipal web server cannot be patched immediately, take it offline temporarily and put up a static emergency page.
The first hours in the administration
- List all sites and specialist applications with web access, including institutions and tourism.
- Have each operator confirm in writing: PHP at 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a backport applied, all processes restarted.
- Take unconfirmed systems offline, or secure them until the patch with virtual patching. Cloudflare points out that rules based on request data alone are not sufficient; this is a bridge, not a replacement.
- Preserve logs from 20 October 2026 onward.
- Inform the press office and the data protection officer and agree a factual line to take. The page on crisis communication offers help with this.
What the BSI recommends in detail is summarised on the page BSI recommendations on PHP2Shell. Questions about procurement and emergency commissioning are settled under your internal rules.
Precaution: emergency page, inventory and deputies
The next critical vulnerability will certainly come. Three preparations then save hours: a ready-made static emergency page with phone numbers, opening hours and notes on urgent matters, which can be served without PHP. A maintained inventory of all web applications with operator, contact person and contractual basis. And a deputising arrangement, so that decisions such as switching off the site can also be made in the evening and at weekends.
These points belong in the administration's IT emergency plan. Municipal enterprises, utilities and institutions with their own websites should be explicitly included, because otherwise they are missing from the stocktake.
How does PHP SOS help?
- We support your IT coordination with the inventory and clarify with data centre, vendors and agency who patches which system.
- Where you operate yourself, we take over update, restart and written proof through the PHP patch service.
- If compromise is suspected, we preserve evidence and check content for manipulation before the site goes back online.
- We document the process so that the data protection officer, the administration's management and the audit office can follow it.
Frequently asked questions
May we simply switch off the municipality's website?
The BSI (German Federal Office for Information Security) recommends taking web servers offline temporarily if the update cannot be applied immediately. For municipalities, a static emergency page with the most important contact routes is a good option. Who may decide this internally should be set out in the emergency plan.
Is the council information system affected?
That depends on the technology and operation. Council information systems and online services are often operated by specialist-application vendors or municipal data centres. Ask them specifically about PHP use, patch level and restart.
Which data protection authority is responsible for municipalities?
For public bodies of the federal states and municipalities, the data protection supervisory authority of the respective German federal state is usually responsible. State data protection acts also apply. Your official data protection officer knows the reporting channels.