Canadian government sites among those offline after flaw identified in widely used computer language

Developers behind the PHP programming language released a fix on Wednesday after a security vulnerability was brought to light. The PHP developers urged people to implement the fix as quickly as possible, and some governments took sites offline as a precautionary measure.

Developers behind the PHP programming language urging companies to implement a fix quickly

Abby Hughes · CBC News

· Posted: Oct 21, 2026 3:50 PM EDT | Last Updated: 13 minutes ago

Listen to this article

Estimated 3 minutes

The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.

Numerous websites, including Canadian government sites, went offline Wednesday in order to implement a fix after a vulnerability was found in PHP, a widely used programming language. 

PHP developers on Wednesday released urgent new fixes to vulnerabilities in their software, and encouraged website operators to implement the solution as soon as possible. 

"If you run PHP, it is imperative that you update now," the PHP Foundation said in a news release.

Artificial Intelligence Minister Evan Solomon said some federal government websites had been taken offline temporarily as a "precautionary measure," and urged organizations whose websites run on PHP to implement the security update.

"We are taking this situation extremely seriously," Solomon said in a post on social media. "The affected websites will be brought back online as soon as the fixes have been applied."

The websites for the Canadian Centre for Cyber Security and Statistics Canada website appeared to be down for a period of time on Wednesday when CBC News attempted to access them.

The Newfoundland and Labrador government site was offline on Wednesday following a newly disclosed cybersecurity vulnerability. Multiple Canadian government sites were down on Wednesday because of the vulnerability. (CBC)

The government sites for Newfoundland and Labrador and Prince Edward Island were also offline, displaying messages saying the shutdown was due to a global security incident. 

PHP is a language that dates back to the early 1990s and initially stood for "Personal Home Page." It underpins huge parts of the public-facing web and is baked into sites like WordPress, ​Drupal, Joomla and Magento.

• AI agents tried to hack Library and Archives Canada website, research firm says

When a visitor loads a page that uses PHP, a server running the language assembles the content and sends it to the browser. ⁠It is free, open source software, maintained by volunteers.

The flaw in PHP was discovered using artificial intelligence, Alphabet-owned cybersecurity company Wiz said in a blog post.

WATCH | How AI hacked the Australian government and almost got away with it:

How AI hacked the Australian government and almost got away with it | About That

September 30|

Duration

2:58

OpenAI says one of its models, while in testing, went rogue and hacked an official Australian government website in a security breach that went undetected for months. Andrew Chang explains what we know about the hack and why Australian authorities say the manner in which they learned about the incident was 'entirely inadequate.' Images provided by The Canadian Press, Reuters, Adobe Stock and Getty Images

The company said the vulnerable code had been present for more than a decade, and that they used multiple large language models to find the vulnerability and validate the patch for the problem while working with OpenAI on discovery and patching. They also co-ordinated with Automattic, AWS, Microsoft and others on the rollout of the patch, so they could give guidance to customers that cannot implement the fix immediately.

PHP runs roughly 75 of websites whose programming language can be identified, according to web technology tracker W3Techs.

Elsewhere around the world, cybersecurity agencies in Europe, Australia, Japan and Britain also urged PHP users to make the fix, while governments in France, the Netherlands and other European countries proactively took their websites offline to make the fix.

ABOUT THE AUTHOR

Abby Hughes is a writer with CBC News based in Toronto. Originally from Orillia, Ont., she studied journalism at Toronto Metropolitan University. She covers news from the worlds of business, entertainment, health, science and education, and her favourite stories focus on the real people in those areas — the customers, fans, patients, citizens and students. You can reach her with story ideas at abby.hughes@cbc.ca.