{"resourceId":"idaho-its-php2shell-statewide-response-guidance-2026","versions":[{"version":"external-d893fcfbc32769abd54dcee8d71d1acd375113551006db25d13c282d8efec19a","resource":{"id":"idaho-its-php2shell-statewide-response-guidance-2026","title":"State of Idaho Response to Global Cybersecurity Vulnerability (PHP2Shell guidance)","organization":"State of Idaho, Office of Information Technology Services (ITS)","sector":"State government (statewide IT and cybersecurity)","geography":"Idaho, USA","publishedAt":"2026-10-23","publicationDate":"2026-10-23","eventDate":null,"sourceName":"State of Idaho ITS Cybersecurity","sourceLabel":"State public notice and guidance","sourceUrl":"https://cybersecurity.idaho.gov/state-of-idaho-response-to-global-cybersecurity-vulnerability/","evidenceClass":"standards-guidance","outcomeClass":"cautionary","topics":["infrastructure","governance-procurement","operating-model"],"finding":"Idaho's ITS posted an Oct 23, 2026 public notice that the state is responding to PHP2Shell (CVE-2026-109618 and CVE-2026-109619) through established emergency processes, prioritizing internet-facing systems and public-facing websites that support public safety. Its guidance, based mainly on CISA, NSA and FBI direction, is aimed at state agencies, local governments, public schools, tribal entities and critical infrastructure: inventory all PHP systems, patch to listed versions, take unpatchable public services offline, use WAFs only as a temporary buffer, enhance logging, and retire unsupported PHP.","sledRelevance":"A state CIO office translating federal direction into statewide action for agencies, localities and schools. It shows the operational response SLED organizations took regardless of vendor assessments that exploitation might be constrained.","evidence":"Primary state guidance and public notice. It describes priorities and recommended actions, not completion rates, incidents or outcomes.","architectureImplications":"Requires an inventory of PHP across websites, internal apps, cloud services, vendor systems and appliances, plus process-level monitoring for PHP launching shells.","governanceImplications":"Response is run through established emergency processes with tracking and documentation; vendor-managed platforms require patch timeline confirmation.","securityPrivacyImplications":"Taking public services offline trades availability for security; WAF use is explicitly temporary.","caveats":"No metrics on patched systems or incidents. Does not mention CrowdStrike or AI. Guidance relays federal recommendations rather than independent analysis.","streamIds":["crowdstrike"],"roles":{"sales":"Statewide response is the framing point: Idaho ITS told agencies, local governments and schools to inventory PHP, patch immediately and take unpatchable public services offline. For state and local IT leaders, the bounded conversation is about how they found every PHP system, including vendor-managed ones. Interpretation: offer help with asset inventory and runtime monitoring for the next event. The notice gives no outcome data and never mentions CrowdStrike, so avoid implying any product role in Idaho's response.","engineering":"Inventory completeness is the framing point: the guidance stresses PHP in websites, cloud services, vendor systems and appliances, and monitoring for PHP processes launching shells or downloading files. Interpretation: pre-sales should ask whether endpoint and cloud telemetry can enumerate PHP runtimes and versions and alert on shell spawns from web servers. Appliances and vendor-hosted platforms often lack agents, so coverage gaps must be listed and handled through vendor attestations or network controls.","delivery":"Emergency-process discipline is the framing point: Idaho ran its response through established emergency processes with tracking and documentation. Interpretation: delivery partners supporting states or districts should provide inventory exports, patch tracking and evidence of retirements that fit those processes. Ownership sits with the state or agency CISO and system owners. Proposed acceptance criteria include a reconciled PHP inventory, documented patch or offline status per public-facing system, and a retirement plan for unsupported versions."},"roleDetails":{"sales":{"customerProblem":"Agencies and schools must quickly find and fix every PHP system, including vendor-managed ones, during a mass vulnerability event.","stakeholders":["State CIO/CISO","Agency IT directors","Local government and school IT leads","Emergency management"],"discoveryQuestions":["How did you inventory PHP across vendor-managed systems?","Which public services went offline and for how long?","What monitoring detected PHP spawning shells?"],"valueHypothesis":"Better asset inventory and runtime visibility could shorten the next mass-patch response; unmeasured.","potentialEngagement":"A post-event review of inventory and monitoring gaps.","unsupportedClaims":["Any CrowdStrike role in Idaho's response","Incident or compromise counts","Patch completion rates"]},"engineering":{"fit":"State, local and school environments running public-facing PHP applications.","architectureIntegration":"Combine endpoint/cloud telemetry, vulnerability scanning and WAF rules for interim protection.","prerequisites":["Asset inventory","Telemetry on web servers","Vendor patch contacts"],"constraints":["Appliances without agents","Vendor-hosted platforms","Unsupported PHP versions"],"security":"Alert on PHP processes launching shells or unexpected downloads.","proofOfValue":["Reconcile discovered PHP versions with manual inventory","Test a shell-spawn detection","Confirm post-patch scans"]},"delivery":{"work":"Inventory reconciliation, patch tracking, interim protections and retirement planning.","dependencies":["System owners","Vendors of managed platforms","Emergency process owners"],"ownership":"State or agency CISO with system owners.","skillsAdoption":"Local staff need repeatable inventory and patch verification practices.","governanceCheckpoints":["Emergency process tracking","Decision to take services offline","Closure review"],"acceptanceCriteria":["Proposed: reconciled PHP inventory","Proposed: documented status per public-facing system","Proposed: unsupported-version retirement plan"],"risks":["Hidden PHP in vendor systems","Service disruption","Incomplete verification scans"]}},"retrievedAt":"2026-10-30T22:13:22-05:00","enrichedAt":"2026-10-30T22:21:24-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small local entities may lack staff to perform inventory; guidance does not address capacity.","procurementImplications":"Vendors must confirm PHP versions and patch timelines, implying contract leverage over vendor-managed systems.","operatingModelImplications":"State coordinates with federal and local partners and runs the response as an emergency.","sourceVerification":{"openedUrl":"https://cybersecurity.idaho.gov/state-of-idaho-response-to-global-cybersecurity-vulnerability/","referenceExcerpt":"It provides actionable steps for Idaho agencies, local governments, public schools, tribal entities, and critical infrastructure operators responding to the PHP2Shell vulnerabilities","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}