Some Canadian government websites have been taken temporarily offline “as a precaution to protect government systems and Canadians’ information,” AI and digital innovation minister Evan Solomon said on Wednesday afternoon.
“This is in response to a vulnerability identified in PHP, software used by websites around the world,” Solomon wrote in a post on X. “This is a global issue, and other governments and organizations are also taking protective measures.”
The move follows guidance from the Canadian Centre for Cyber Security, Solomon said. PHP programming language developers said on Tuesday that they had found two critical security vulnerabilities and encouraged site managers to take their websites down or update them as soon as a fix was available. Denmark, Finland, and France have temporarily taken down some government websites, while organizations like Wikipedia, Internet Archive, and 4chan also took some pages offline.
The severe PHP programming language vulnerabilities affect a variety of websites and internet software, from content management systems like WordPress to e-commerce platforms like Adobe Magento. The weaknesses could potentially allow attackers to remotely execute commands on servers running PHP, granting attackers access to entire servers or databases. Roughly 70 percent of all websites run on PHP, according to online technology tracker W3techs.
RELATED: U of T’s Citizen Lab exposes “nightmare” spyware hack that requires no clicks from users
PHP has since published a security fix for the issues, but it is only available for up-to-date versions of the software. For non-website developers, cybersecurity experts have urged users to update passwords and ensure they are using two-factor authentication for any online accounts.
According to Engadget, another major security vulnerability was also discovered on Wednesday, involving TLS certificates—digital documents that help verify a website’s identity—with extremely weak encryption. This could impact everything from virtual private networks to IoT devices, where attackers could create credentials for many websites and apps. The issue is that the private keys are weak and could let attackers forge credentials for a range of websites and apps.
AI giant OpenAI has said security researchers at Calif used its large-language model GPT‑5.6 Sol to identify the PHP vulnerabilities.
Feature imaage courtesy Paul VanDerWerf on Flickr. Shared under CC BY 2.0.