Canadian government sites among those offline after flaw identified in widely used computer language

Abby Hughes · CBC News

· Posted: Oct 21, 2026 3:50 PM EDT | Last Updated: 9 minutes ago

Numerous websites, including Canadian government sites, went offline Wednesday in order to implement a fix after a vulnerability was found in PHP, a widely used programming language. 

PHP developers on Wednesday released urgent new fixes to vulnerabilities in their software, and encouraged website operators to implement the solution as soon as possible. 

"If you run PHP, it is imperative that you update now," the PHP Foundation said in a news release.

Artificial Intelligence Minister Evan Solomon said some federal government websites had been taken offline temporarily as a "precautionary measure," and urged organizations whose websites run on PHP to implement the security update.

"We are taking this situation extremely seriously," Solomon said in a post on social media. "The affected websites will be brought back online as soon as the fixes have been applied."

The websites for the Canadian Centre for Cyber Security and Statistics Canada website appeared to be down for a period of time on Wednesday when CBC News attempted to access them.

The Newfoundland and Labrador government site was offline on Wednesday following a newly disclosed cybersecurity vulnerability. Multiple Canadian government sites were down on Wednesday because of the vulnerability. (CBC)

The government sites for Newfoundland and Labrador and Prince Edward Island were also offline, displaying messages saying the shutdown was due to a global security incident. 

PHP is a language that dates back to the early 1990s and initially stood for "Personal Home Page." It underpins huge parts of the public-facing web and is baked into sites like WordPress, ​Drupal, Joomla and Magento.

• AI agents tried to hack Library and Archives Canada website, research firm says

When a visitor loads a page that uses PHP, a server running the language assembles the content and sends it to the browser. ⁠It is free, open source software, maintained by volunteers.

The flaw in PHP was discovered using artificial intelligence, Alphabet-owned cybersecurity company Wiz said in a blog post.

WATCH | How AI hacked the Australian government and almost got away with it:

The company said the vulnerable code had been present for more than a decade, and that they used multiple large language models to find the vulnerability and validate the patch for the problem while working with OpenAI on discovery and patching. They also co-ordinated with Automattic, AWS, Microsoft and others on the rollout of the patch, so they could give guidance to customers that cannot implement the fix immediately.

PHP runs roughly 75 of websites whose programming language can be identified, according to web technology tracker W3Techs.

Elsewhere around the world, cybersecurity agencies in Europe, Australia, Japan and Britain also urged PHP users to make the fix, while governments in France, the Netherlands and other European countries proactively took their websites offline to make the fix.