RESOURCE
Le 21 octobre 2026, le Centre pour la cybersécurité a indiqué travailler avec ses partenaires gouvernementaux et l'industrie sur des vulnérabilités critiques de PHP (alerte AL26-026) permettant à un acteur non authentifié d'exécuter des commandes sur les systèmes touchés, et a prévenu que certains sites Web pourraient être temporairement indisponibles pendant l'application des correctifs. Le ministre Evan Solomon a confirmé sur X que certains sites du gouvernement du Canada avaient été mis hors ligne sur l'avis du Centre.
Fabric Networks
Start with a conversation about your cryptographic posture.
The Communications Security Establishment issued a statement on October 21, 2026 on two critical vulnerabilities in PHP, the language behind a large share of the world's websites and many packaged products. Under certain conditions the flaws allow a malicious actor to run unauthorized commands without authentication. Security updates are available, the Cyber Centre published alert AL26-026 with technical details, and it said some websites may be temporarily unavailable while patches are applied. The same day, Minister of Artificial Intelligence and Digital Innovation Evan Solomon posted on X that some Government of Canada websites had been taken offline as a precaution, following Cyber Centre guidance, and that other governments were taking similar measures.
The Cyber Centre's advice is direct: identify every system running PHP across your infrastructure, prioritize the internet facing ones, apply the updates, and where patching is not immediately possible, isolate the affected applications from public networks until they are protected. It also asks organizations that suspect compromise to report it early.
This is not a quantum story, and we are not going to pretend it is. It is an inventory story. The organizations that moved fastest on October 21 were the ones that already knew which of their systems ran PHP and which of those faced the internet. The ones that struggled had to find out under pressure. You can't fix what you can't see. The same discipline, a current inventory of what is deployed and what it depends on, is what the post-quantum migration will demand of every Canadian operator between now and 2031, and it is what the Discovery Program builds first.