Skip to Content
League of Minnesota Cities
Search
close
close

How to save a PDF

If you would like to save the page you’re viewing as a PDF document, here are the steps:

  1. Click icon with 3 stacked dots Setting button with vertical dots / Setting button with horizontal dots or Setting button with stacked lines lines to the right of the URL bar at the top of your browser
  2. Select the “Print” option
  3. A pop up window like this one should appear, ensure the Destination field is set to “Save as PDF” (this may be a dropdown or “Change” button)
  4. Click “Save,” then select the location and name for the file on your computer

Still not sure? 

View additional instructions for the most common browsers.

PHP Security Issue: What Cities Should Do Now

October 26, 2026

Following the recent discovery of a global software security issue nicknamed “PHP2Shell,” cities should take steps to ensure their online platforms and digital services are properly protected.

On Oct. 21, emergency fixes were released for two serious vulnerabilities in PHP, the software used by many websites and online services. Attackers may be able to take control of an unpatched web server without a password. Your city could be using PHP software directly or through a vendor.

What is PHP in plain terms?

PHP is a programming language that powers a large share of the web and underpins many popular content management systems, website backends, form solutions, online portals, and the web interfaces used to administer them.

Think of PHP as a car engine. These flaws are a defect in the engine itself, not a single car model, meaning any vehicle with that engine is affected until the underlying issue is fixed.

Not sure if your city uses PHP?

That’s OK. City staff do not need to identify PHP themselves, and can use the following steps to work with their IT staff and vendors to identify and address PHP security issues.

Three things every city should do

1.      Ask your IT staff or IT contractor to check for vulnerable systems

Have them identify city-operated systems that use PHP and can be reached from the internet and apply necessary security updates immediately. If a system cannot be secured, ask about taking it offline temporarily.

2.      Ask your website and online-service vendors to check their PHP patch status

Contact all vendors handling public websites, utility billing, payments, permits, or sensitive information. Ask whether your service was affected by the PHP vulnerability, whether it has been fixed, and whether the vendor found signs of misuse.

3.      Pay attention to unusual website or service activity

Ask staff to stay on alert and report any unexpected website changes, unusual payment links, or unexplained service behavior to your IT provider or vendor. If a cyber incident is suspected, follow your city’s incident response and notification procedures.

If you suspect a cyber incident

  • Promptly contact your IT provider or the affected vendor, and ask that the issue be investigated as a security incident.
  • Avoid deleting files, wiping systems, or cleaning up suspicious changes so IT can preserve evidence.
  • Promptly notify the League of Minnesota Cities Insurance Trust (LMCIT), and follow your city’s incident response plan. Contact LMCIT for help with cyber incidents.
  • Determine whether Minnesota’s cybersecurity incident reporting law applies. (Note: A suspicious symptom is not necessarily a reportable incident.) Read more about the cybersecurity incident reporting law.

For more information

Contact:

Read more news articles.

Your LMC Resource

Christian Torkelson

Cybersecurity Loss Control Field Consultant

(651) 281-1296

g4r4o4.4c4m4l4@4n4o4s4l4e4k4r4o4t4c