Andy Thoman
________________________________________
Greensboro, NC – October 22, 2026
This week, two serious security alerts hit technology that millions of organizations rely on. Neither came from careless amateurs, and that's the point: no system is immune. Here's what happened and why MuniBilling customers weren't affected.
What Happened
PHP flaws (CVE-2026-109618 and CVE-2026-109619). On October 21, two critical vulnerabilities were published in PHP, the programming language behind much of the web, including most WordPress sites. They could let an attacker take over an affected server without logging in.
eMudhra certificate compromise. Certificates work like ID cards that prove a website is genuine. eMudhra, one of the companies that issues them, generated some signing keys so weakly that others could recreate them. Major browsers blocked the affected certificates between October 17 and 20, and Chrome will stop trusting eMudhra entirely on October 27.
Security Is a Practice, Not a Status
PHP is mature and well maintained. Certificate authorities exist to be the internet's trusted backbone. Both still had serious problems. What separates a scare from a crisis is how well an organization prepares before an alert arrives and how quickly it responds after. For utilities holding residents' names, account numbers, and payment details, that preparation matters.
Where MuniBilling Stands
MuniBilling customers were not affected by either alert, and no action is needed. Our security team, led by Security Architect Jamie Gaines, reviewed both within a day and found no sign of risk to customer data.
- PHP: MuniBilling doesn't use PHP. We searched our codebase and cloud environment and found none, and our web application firewall blocks known PHP attack patterns as an added layer.
- eMudhra: None of our websites or partner integrations relies on an eMudhra certificate, so nothing changes for users on October 27.
- Passwords: We've seen no signs of misuse, so no password changes are needed.
Questions to Ask Any Software Vendor
- Can you quickly confirm what's in your software, backed by an actual search?
- How fast do you review industry alerts?
- Do you layer defenses and retire old systems?
- Will you tell us plainly whether we're affected?
On your side, keep browsers and operating systems updated and turn on multi-factor authentication wherever possible.
The Best Alerts Are Quiet Ones
Good security is mostly invisible: a quick review, a clean result, and no disruption. Questions about either alert? Contact your MuniBilling representative, or reach out to our team to learn how we protect your data.
Sources
- Canadian Centre for Cyber Security, alert AL26-026, "Critical vulnerabilities impacting PHP," October 21, 2026
- Google Security Blog, "Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates," October 20, 2026
Media Contact
Andy ThomanMarketing Manager
marketing@munibilling.com
