Response to PHP2Shell Vulnerability

On October 21, 2026, the PHP project publicly disclosed a pair of vulnerabilities collectively known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) and released patched versions of PHP that fix them.

Background

On October 21, 2026, the PHP project publicly disclosed a pair of vulnerabilities collectively known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) and released patched versions of PHP that fix them. Both vulnerabilities are rated critical.

COTAK (Colorado Team Awareness Kit) Response

Early on October 21, 2026, portions of the COTAK infrastructure that could have been vulnerable were taken offline to prevent any potential exploitation. An initial review found no indication that the vulnerabilities had been exploited. The team’s priority was isolating the affected systems and replacing them rather than extended forensic analysis. The COTAK status page was updated to reflect these limitations. Vulnerable systems remained offline while the COTAK development team waited for patched PHP packages for COTAK’s server platform to become available. These systems were then rebuilt, from scratch, on new server instances that had never had vulnerable versions of PHP installed. Once the new instances were configured and verified to be running only PHP versions that include the fixes for both vulnerabilities, the full COTAK system was brought back online. COTAK was fully restored at 21:14 MDT.

Impact on COTAK System Operations

The impact on COTAK and its users was minimal. All current users could continue to use COTAK during routine or emergency response and related real time data continued to be available to users. Agencies could not, however, self-manage members or channels. New agencies could not be added through the normal process. It is important to note that, in the event of a public safety emergency, the COTAK staff could have made any required changes to the membership and configuration of the system using secure methods. COTAK staff are on 24-hour call and during this outage were operating at an enhanced level.

Further technical background information on COTAK

The Colorado Team Awareness Kit comprises a number of separate computer servers and systems operating in cooperation. These systems operate on separate server instances used only by COTAK, not shared with any other systems or users. Backend systems sit on private networks that are not publicly accessible; only the required public-facing services are exposed to the internet, and those are the services that were taken offline. COTAK is operated directly by Colorado employees.