Cyber Centre Statement on Critical PHP Vulnerabilities: Some Federal Websites Taken Offline as a Precaution

The Communications Security Establishment issued a statement on October 21, 2026 on two critical vulnerabilities in PHP, the language behind a large share of the world's websites and many packaged products. Under certain conditions the flaws allow a malicious actor to run unauthorized commands without authentication. Security updates are available, the Cyber Centre published alert AL26-026 with technical details, and it said some websites may be temporarily unavailable while patches are applied. The same day, Minister of Artificial Intelligence and Digital Innovation Evan Solomon posted on X that some Government of Canada websites had been taken offline as a precaution, following Cyber Centre guidance, and that other governments were taking similar measures.

The Cyber Centre's advice is direct: identify every system running PHP across your infrastructure, prioritize the internet facing ones, apply the updates, and where patching is not immediately possible, isolate the affected applications from public networks until they are protected. It also asks organizations that suspect compromise to report it early.

Our take

This is not a quantum story, and we are not going to pretend it is. It is an inventory story. The organizations that moved fastest on October 21 were the ones that already knew which of their systems ran PHP and which of those faced the internet. The ones that struggled had to find out under pressure. You can't fix what you can't see. The same discipline, a current inventory of what is deployed and what it depends on, is what the post-quantum migration will demand of every Canadian operator between now and 2031, and it is what the Discovery Program builds first.