Ottawa takes some websites offline over PHP security flaw

The federal government temporarily took some of its websites offline Wednesday as a precaution against two critical security flaws in PHP, the programming language that runs a large share of the world’s websites, Artificial Intelligence Minister Evan Solomon said.

In a post on X on Oct. 21, Solomon said the sites were taken down “as a precaution to protect government systems and Canadians’ information,” following guidance from the Canadian Centre for Cyber Security, which is part of the Communications Security Establishment. “This is a global issue, and other governments and organizations are also taking protective measures,” he wrote, adding that organizations using PHP should apply the latest security updates as soon as possible.

“We take this situation extremely seriously,” Solomon said, according to The Canadian Press. “Thank you to the cybersecurity teams working to protect the services Canadians rely on.” He said affected federal websites will be restored once patches are applied.

The government has not said which websites were taken down. The Canadian Press reported it asked Treasury Board for the list and had not received a response. Officials have not said whether any personal information was exposed, and no breach of a federal website has been reported. Some federal online services may be unavailable until patches are in place.

PHP is a server-side language that builds web pages and connects them to databases. It underpins WordPress, as well as Drupal, Joomla and Magento.

The PHP project disclosed the two flaws on Oct. 21 in a security advisory on php.net, saying they “can allow unauthenticated remote code execution.” In plain terms, an attacker with no account on a site could send crafted web requests that let them run their own commands on the server.

The first flaw, tracked as CVE-2026-109618, involves how PHP handles running out of memory. PHP said out-of-memory handling can interrupt the language while internal request data is only partly set up, and the cleanup process can then treat that broken data as valid. The second, CVE-2026-109619, involves leftover data: PHP said internal state tied to one web request can survive after its memory has been freed, and a later request handled by the same worker process may use that stale state. The Cyber Centre classifies both as “use after free” vulnerabilities, nicknamed “php2shell.”

Both flaws are rated critical. PHP’s own advisories give each a score of 9.2 out of 10 under the CVSS 4.0 system, and the U.S. National Vulnerability Database lists each at 9.8 out of 10 under CVSS 3.1.

PHP said every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for Apache’s mod_php, where it said a demonstrated exploit lets an unauthenticated request trigger the attack before any of a site’s own code runs.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the Cyber Centre’s alert, every 8.5 release before 8.5.12, every 8.4 release before 8.4.27, every 8.3 release before 8.3.36 and every 8.2 release before 8.2.35 is affected. PHP 8.1 and older no longer get updates from the project. PHP said updating is the only complete solution.

On whether the flaws are being used in attacks, accounts differ. The Cyber Centre said in its alert that open-source reporting indicates proof-of-concept code is available, but that no active exploitation had been identified, adding that “can change quickly.” Reuters, in reporting carried by Global News, cited reports that hackers were already exploiting the flaws, and Cloudflare chief technology officer Dane Knecht said on X the company was “seeing early attacks emerging.”

The Cyber Centre is urging organizations to update affected PHP installations immediately, starting with internet-facing systems and applications that process untrusted input. Where a fix cannot be applied right away, it says organizations should consider isolating internet-facing applications from public networks. It also recommends checking logs for signs of compromise.

The website of the Finnish government was only partly available Wednesday, The Canadian Press reported, and Reuters reported agencies in the Netherlands also took sites offline. Britain’s National Cyber Security Centre told organizations to update and, if they cannot patch or apply temporary mitigations quickly, to consider taking systems offline.

The flaws were found with the help of artificial intelligence. OpenAI said in a statement that security firm Calif identified a critical flaw using one of its models through its Patch the Planet initiative, that cloud security firm Wiz independently discovered and reported both vulnerabilities, and that PHP’s maintainers led the fixes and release.

For small businesses and anyone who runs a website, the key step is updating PHP itself, not just the site’s software. Security plugin maker Wordfence warned that WordPress automatic updates will not apply this fix, and advised site owners to find out who is responsible for updating PHP on their server. Customers on shared or managed hosting should contact their host and ask whether their server runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor-patched equivalent.

Ottawa is also weighing a planned data centre for the Communications Security Establishment, while researchers flagged spyware delivered through online ads this month, and small organizations can get free help from the Cyber Clinics Canada network.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.