Security Update: Our Response to the NSA’s Urgent PHP Advisory
Our response is complete. Every APB360 system that runs PHP was on the fixed release by the evening of October 22, the day after the advisory was issued. The portal, the API and the mobile apps were updated the same afternoon, with no downtime. Secure document upload links were back on new servers by the next morning. Every older server that could not take the fix has been rebuilt on the updated platform and the old one switched off.
The Problem
On October 21, 2026, the NSA issued an urgent advisory, joined by the FBI and CISA, about two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. PHP is the programming language behind a large share of the world’s websites, and it runs much of APB360. Both flaws are rated critical. An attacker could exploit them over the internet without signing in, and early proof-of-concept attack code is already circulating. The PHP project released fixed versions that day. The NSA’s guidance to every organization was blunt: install the update now, and if a system cannot be updated, take it offline.
How We Responded
- Same-day inventory. Within hours of the advisory, we checked every server that runs APB360 for its exact PHP version.
- Same-day updates, no downtime. We installed the fixed PHP releases on every server that runs the portal and the API, one server at a time so that APB360 stayed available throughout, and then confirmed that each server was running the fixed version and responding normally.
- Offline where it could not be updated. A few older servers ran a PHP version too old to receive the fix. Following the NSA’s direction, we took them offline the same day rather than leave them exposed.
- Rebuilt, not patched around. We rebuilt the services those servers provided on the same fully updated platform as the rest of APB360, tested each one, and only then put it back in service. Secure document upload links returned on October 22, and the nightly jobs that keep agency employee rosters current moved to a new, updated server the same day, without missing a run.
- Verified. On the evening of October 22 we checked every running APB360 server directly: each one that runs PHP reports the fixed release, and the older servers are switched off.
Status
- Updated and working normally: the APB360 portal, the APB360 API, the mobile apps and scanners that use it, and secure document upload links.
- Updated: the internal systems behind them, including the nightly roster imports.
- Retired: the older servers that could not take the fix. They are switched off, and their work now runs on updated servers.
- Not affected: this website, apb360.com.
What You Need to Do
Nothing. Keep using APB360 as usual. Document upload links that you were sent before the outage work again, as long as they have not expired.
Questions? Email help@apb360.com or call 251-677-7978.