Canada pulled government websites offline over critical PHP flaws

On Wednesday, October 21, the PHP project shipped emergency fixes for two critical vulnerabilities – each rated 9.2 out of 10, both allowing an attacker to take over a web server without a username or password – and governments around the world, including Canada’s, pulled their own websites offline while patching rather than risk exposure.

Artificial Intelligence and Digital Innovation Minister Evan Solomon said some federal sites were “temporarily taken offline as a precaution to protect government systems and Canadians’ information.” CBC News observed the Canadian Centre for Cyber Security and Statistics Canada websites down for a period, and provincial sites for Newfoundland and Labrador and P.E.I. displayed precaution notices. Elections B.C.’s site was also down that day – the last day of advance voting before Saturday’s provincial election. France and the Netherlands took similar steps, while agencies in Europe, Australia, Japan and Britain urged operators to patch immediately.

The flaw itself is serious because of where PHP sits: it runs roughly 75% of websites whose programming language can be identified, according to W3Techs, and underpins WordPress, Drupal, Joomla and Magento. Alphabet-owned security firm Wiz discovered the vulnerabilities using artificial intelligence, reporting that the vulnerable code had been in place for more than a decade. The fixes are documented in php.net’s emergency releases as CVE-2026-109618 and CVE-2026-109619, addressed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with CISA urging immediate patching.

There was no breach behind the Canadian outages: officials later said there was no indication that Canadian data was compromised – the sites went dark on purpose. Wikipedia, Cloudflare and others also applied fixes the same day.

For anyone running a website on PHP: the PHP Foundation’s advice was blunt – “If you run PHP, it is imperative that you update now.” Operators on shared hosting should update to the fixed releases (8.3.36 or 8.4.27 for the current branches) or confirm their host has.

Sources: CBC News, Wiz research and DigitalOcean’s advisory.