MPISoft GovSites, built on WordPress

When a critical flaw hits, your website shouldn't wait for everyone else's.

On October 21, 2026, a critical PHP flaw forced websites everywhere offline. On a shared platform, every customer comes back when the vendor's whole rollout is done. With MPISoft GovSites, each agency has its own server, so each site is patched, checked and brought back on its own, starting as soon as the fix is ready. Sources, prices and two live references are below.

Book a free security and uptime review See the comparison

~10 hoursCivicPlus Web Open offline, 7:53 AM to 5:31 PM PT, October 21¹
1 server eachso each agency is patched and back online on its own
No license feesopen-source CMS, no per-posting fees

Step 5 of 8. Agencies 1 and 2 are back. Agency 3 is being patched; agency 4 is next. Every shared-platform customer is still offline.

How a critical vulnerability plays out on each model. An animated schematic, not a record of a specific day.

When a critical flaw hits: two ways back

Two critical PHP flaws, together called PHP2Shell (CVSS 9.2), were patched upstream on October 21.¹¹ They allowed remote code execution, so responsible operators took sites offline until they could update; governments in Canada and Europe did.^{13, 16} What differs is how each site comes back. On a shared platform, everyone returns when the vendor's rollout is done. On isolated servers, each site returns as soon as it is patched.

Shared platform: CivicPlus on October 21^{1, 2}

Times come from the status page's own data feed and are shown in your local time zone.

Wed, Oct 21, 7:00 AM PT
PHP's announced release time for the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35).^{11, 12}
Wed, Oct 21, 7:29 AM PT
Community Development (all versions) "taken offline as a precaution due to a security vulnerability affecting PHP."
Wed, Oct 21, 7:53 AM PT
Municipal Websites Open (all versions) taken offline as well. City sites on Web Open stop answering.
Wed, Oct 21, 9:30 AM PT
Separate incident opened for Community Development v3 and FMO, offline as a precaution.
Wed, Oct 21, 3:50 PM PT
Web Open briefly restored, then back to "identified" an hour later.
Wed, Oct 21, 5:31 PM PT
Web Open services restored; monitoring continues. About 10 hours offline in all.
Thu, Oct 22, 12:10 PM PT
Incident marked Resolved, 28 hours 40 minutes after it opened; Web Open had been back up since 5:31 PM the day before.
Now
Community Development v3 and FMO incident still open as of October 24, 2026, 1:35 PM PT, more than three days after it began.²

An archived snapshot from October 22 lists six affected products.³ CivicPlus stated there was no evidence that customer data had been compromised. Figures as of October 24, 2026, 1:35 PM PT.

What residents saw: WTXL ABC 27 reported that the City of Quincy, Florida's website was unavailable after CivicPlus took affected municipal websites offline.⁴

Isolated servers: how MPISoft responds

Flaw announced
Sites that hold resident data or take submissions go offline at once. Public-information sites switch to a read-only copy served from the edge, with PHP unreachable, so residents can still read them. A Cloudflare firewall rule blocks the known attack pattern while the fix is pending.
Fix released
We pull the patched PHP build as soon as it is published and test it on staging.
First agency back
Each server is updated, checked and switched back on by itself. The first agency is back online as soon as its own update is checked, not after the last customer is done.
One by one
Every other site follows the same way. No one waits for a platform-wide rollout, and each agency can log in and confirm its PHP version itself.
In writing
Each agency gets a written note of what was applied to its site and when.

Shared platform, every customer

back together

GovSites agency 1

back first

GovSites agency 2

back second

GovSites agency 3

back third

Flaw announcedShared rollout ends

Bars show time from announcement to back online. An illustration of the two models, not measured times.

Side by side

Every CivicPlus statement comes from its own status page, Master Services Agreement or website, or from public council records. Numbers link to the sources at the end of the page.

Comparison of MPISoft GovSites and CivicPlus across twelve criteria
Criterion	MPISoft GovSites, built on WordPress	CivicPlus
Platform	Open-source WordPress, which runs 39.6% of all websites.W3Techs⁶	Proprietary. Software, templates and modules stay CivicPlus property.MSA §10⁵
Hosting	Your own isolated server, in a cloud account you own, with Cloudflare in front.	One shared platform for 13K+ local government customers.civicplus.com⁷
Critical flaw, such as PHP2Shell	Each site is patched, checked and brought back online on its own, as soon as it is ready.	Products taken offline as a precaution on October 21. Web Open restored about 10 hours later. Community Development v3: still open after 3+ days.Status page^{1, 2}
Blast radius	One issue affects one site.	One issue can take many customers offline at once, as Quincy, Florida found.WTXL⁴
Patching	Standard packages, per site, within hours of release, staging first.	Platform-wide. Products stay offline until the vendor finishes its rollout.Status page¹
Ownership	You own the site, content, theme and code, in your own cloud account.	You own your content. CivicPlus keeps the software, templates and modules under a limited license.MSA §7, §10, §11⁵
Leaving	Any WordPress developer can take over. Nothing to rebuild.	Content can be exported, by you or by the vendor for a quoted fee. The site itself is rebuilt on a new platform. Data may be deleted 30 days after termination.MSA §9⁵
Talent pool	Millions of WordPress developers worldwide.	The vendor's own staff.
Government features	Bids and RFPs, agendas and minutes, notices, Notify Me, document library, forms. Open plugins you keep.	Built-in modules, licensed from the vendor.
Cost	Published below. Switch & Migrate from $3,900; hosting, security and patching $399 per month. No license fees.	Quote only. Public records: Sturgis, MI $23,000 setup plus $8,848 per year (2024); Trenton, MI $10,903.91 renewal (2026); Litchfield, NH $24,919.62 (2027).Council records^{8, 9, 10}
Support	Principal-led. One named contact. The people who built your site answer the phone.	Ticket-based help center; phone 7 AM to 7 PM Central, after hours by toll-free phone; hours vary by product.MSA §27 to §30⁵
Transparency	Full access to code, server and logs.	Vendor status page. No server or code access.

What we are not saying

Not that WordPress is more secure. It runs on PHP and needed the same patch. Isolated sites are simply patched one at a time, fast, with no vendor-wide shutdown.

What we are not claiming

Not that CivicPlus breached any commitment. Taking a shared platform offline as a precaution is defensible. It is also the cost of sharing one.

Check it yourself

Every number on this page links to its source. We would rather you verify than take our word.

What MPISoft GovSites adds on top of WordPress

WordPress is the foundation. This is the government layer we build, harden and run.

Government publishing modules

Bids and RFPs, agendas and minutes, public notices, Notify Me and a document library, inside the CMS. No portal, no per-posting fees. Live at srta.ca.gov/bids.

Security hardening

Cloudflare firewall and DDoS protection, two-factor login, daily off-site backups with quarterly restore drills, monthly patch cycle, annual penetration test.

Accessibility you can prove

WCAG 2.2 AA built in, tested by tooling and by screen reader. Every launch ships a VPAT 2.5 conformance report, the evidence an ADA Title II review asks for.

Patching without a release train

Critical fixes are standard package updates, applied per site within hours of release and verified on staging. You can log in and confirm the version yourself.

CI/CD and staging on GitLab

Every change runs through a pipeline: automated checks, a staging copy your staff can review, then production. The repository is in your name.

AI features with human review

Plain-language document summaries (8,300+ files at SRTA), suggested alt text, anomaly detection. A person reviews every output; your data never trains commercial models; every feature can be switched off.

We publish our prices. They don't.

CivicPlus offers a quote request; its prices surface later in council packets. Ours are here. Already on CivicPlus? Your content is yours and exports, so a switch costs less than a new build.

Switch & Migrate, small agency

$3,900

one-time, up to 300 pages and 1,000 documents

Content, documents, forms and subscriber lists moved over
301 redirects so nothing bookmarked breaks
Accessible theme in your brand, WCAG 2.2 AA
Staff training, 30-day launch target, 90-day warranty

Start with a free assessment

Switch & Migrate, mid-size

$7,500

one-time, 300 to 1,000 pages and up to 5,000 documents

Everything in the small-agency package
Document library with reviewed plain-language summaries
Department editor roles and approval workflow
Two recorded training sessions

Start with a free assessment

Host, secure and patch

$399 / month

flat, fixed for the term, cancel after 24 months

Isolated server in your cloud account, Cloudflare in front
Patching, backups, monitoring, named contact
Or $0 migration: $549 per month, 24-month minimum

Ask about the $0 migration

Add-on modules, fixed price each

Bid and RFP posting module$2,500

Agendas and minutes center$1,800

Public notices with auto-expiry$950

Notify Me email and text alerts$750

Multilingual layer, reviewed priority pages$1,900

Full PDF archive accessibility remediation$2,000

Flat prices cover the counts shown; larger inventories are quoted after the free assessment. Most agencies can buy under small-purchase rules; thresholds vary, so check yours. Prices are fixed for the term. No travel charged.

Three-year cost, public record versus published price

Sturgis, Michigan approved CivicPlus in 2024 at $23,000 setup, $4,424 in year one and $8,848 per year after.⁸ The MPISoft figures include the four government modules (bids, agendas, notices, Notify Me: $6,000), so each side covers a full government site. Different agencies and scopes; this shows the pricing structure, not a like-for-like bid.

CivicPlus, Sturgis MI (public record): $23,000 + $4,424 + $8,848 + $8,848 = $45,120
MPISoft small agency with modules: $3,900 + $6,000 + 36 × $399 = $24,264

Two government sites you can inspect right now

Both on WordPress, on their own servers, maintained by MPISoft, online on October 22, 2026 and again when we captured them on October 24. Open them and call the references.

The srta.ca.gov home page, scrolling from the headline Find transportation plans, meetings, bids, and public documents, through the popular tasks, the latest notices and the open bids and opportunities.

Bid Postings page on srta.ca.gov showing a Notify Me subscription bar, filters for status and category, and an open request for proposals, Bid No. S-00048, closing November 9, 2026.

Live captures of srta.ca.gov, home page and bid postings, desktop and phone, October 2026.

Shasta Regional Transportation Agency, California

A regional planning agency with a heavy public-records load. Selected MPISoft under Solicitation S-00044 on April 30, 2026; launched on WordPress on AWS with Cloudflare.

Live site: srta.ca.gov
Engagement: May 1, 2026 to June 30, 2031, $61,000 not-to-exceed over five years, hosting and support included
Migration: 8,300+ documents moved, each with its own landing page and an AI-drafted, staff-reviewed summary
Modules: Bid postings with Notify Me, meetings and agendas, reports and documents, staff directory, calendar
Reference: Laurent Beauregard, Assistant Transportation Planner, (530) 262-6190, srta@srta.ca.gov

Bid module live at srta.ca.gov/bids.

Visit Southlake Texas, City of Southlake

The City of Southlake's official tourism site, built November 2022 to May 2023 and maintained since. Winner of the Web Marketing Association's 2026 WebAward Government Standard of Excellence.

Live site: visitsouthlaketexas.com, plus southlakestarsandstripes.com and southlakehomefortheholidays.com
Engagement: Built November 2022 to May 2023; $13,575 build plus $499 per month hosting and support, continuous to today
Platform: WordPress on managed cloud hosting, owned by the City
Reference: Ryan Snyder, Marketing Manager, City of Southlake, (817) 748-8003, rsnyder@ci.southlake.tx.us

2026 WebAward, Government Standard of Excellence. Entry #37987, credited "MPISoft LLC on behalf of the City of Southlake, Texas." Verify at webaward.org.

mpisoft.com won the 2026 WebAward Computer: Software Standard of Excellence in the same competition.

The visitsouthlaketexas.com home page, scrolling from the Visit Southlake header and a Rediscover Family hero slide, through Welcome to Southlake, the Explore tiles for shopping and dining, sports and outdoors, activities and Southlake Town Square, the events list and Book your stay, to the footer with the city's address.

Live capture of visitsouthlaketexas.com, October 24, 2026.

Free 15-minute security and uptime review

Send your website address. Within two business days you get a short written review: your platform, whether it was affected on October 21, how patching works for you today, and a fixed Switch & Migrate quote. No obligation.

Prefer to talk? (714) 454-0832 or pedram@mpisoft.com reaches Pedram Hesam, PhD, PSP, who manages every GovSites engagement.

MPISoft LLC: Service-Disabled Veteran-Owned Small Business per SAM.gov (UEI F7YBMC1PF7Y3, CAGE 6QUL4), Colorado LLC, fourteen years of continuous operation. No state certification held or claimed.

Sources and notes

Show the 16 sources

CivicPlus Status, "Service Disruption - Municipal Websites Open," incident timeline October 21 to 22, 2026. status.civicplus.com/incidents/01M5FDWS856KV0XGS9CQF525JN
CivicPlus Status, incident data feed (open and resolved timestamps, UTC), read October 22, 2026 and re-read each time this page loads. status.civicplus.com/api/v2/incidents.json
Internet Archive snapshot of the CivicPlus status page, October 22, 2026, 16:08 UTC. web.archive.org/web/20261022160810/https://status.civicplus.com/
WTXL ABC 27, "Quincy city website offline after security issue impacts hosting provider," October 21, 2026. wtxl.com
CivicPlus Master Services Agreement, sections 1, 7, 9, 10, 11 and 27 to 30. civicplus.help/legal-center/docs/master-services-agreement
W3Techs, "Usage statistics and market share of WordPress," October 22, 2026: 39.6% of all websites, 58.3% of sites with a known CMS. w3techs.com
CivicPlus home page, "13K+ local government customers," viewed October 22, 2026. civicplus.com
Watershed Voice, "Sturgis selects CivicPlus for city website overhaul," November 26, 2024: $23,000 implementation, $4,424 year one, $8,848 per year thereafter. watershedvoice.com
Citizen Portal, "Council renews CivicPlus website contract for $10,903.91," Trenton, Michigan, September 2026. citizenportal.ai
Citizen Portal, "Selectmen approve 2027 CivicPlus website contract of $24,919.62," Litchfield, New Hampshire, September 2026. citizenportal.ai
PHP 8.4.27 security release, October 21, 2026, fixing CVE-2026-109618 and CVE-2026-109619. github.com/php/php-src/releases/tag/php-8.4.27
Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched, update now!", October 21, 2026. helpnetsecurity.com
CNBC, "Government websites in Europe and elsewhere go dark as software flaw sparks security scramble," October 21, 2026. cnbc.com
Web Marketing Association, 2026 WebAward winners: entry #37987 (Visit Southlake Texas) and entry #37993 (mpisoft.com). webaward.org
WordPress Foundation trademark policy. WordPress is a registered trademark of the WordPress Foundation; MPISoft GovSites is an independent service built on WordPress and is not affiliated with or endorsed by the WordPress Foundation or Automattic. wordpressfoundation.org/trademark-policy
CBC News, "Canadian government sites among those offline after flaw identified in widely used computer language," October 21, 2026. cbc.ca

Facts on this page were checked on October 22, 2026; the status feed and both reference sites were re-checked on October 24, 2026. Incident times come from the status page's data feed and are shown in your local time zone; durations for open incidents update on each page load. CivicPlus, CivicEngage and Municode are trademarks of CivicPlus, LLC, used here only to identify the products discussed. MPISoft has no affiliation with CivicPlus.