Websites Worldwide Go Offline to Patch Decade-Old PHP Vulnerabilities Discovered by AI
Numerous websites, including Canadian government portals, were taken offline on October 21, 2026, to apply urgent security fixes for PHP vulnerabilities discovered by Alphabet-owned Wiz using artificial intelligence. The flaws had existed in the widely used programming language for more than a decade.
Numerous websites around the world, including several Canadian government portals, went offline on Wednesday, October 21, 2026, to implement urgent security fixes for vulnerabilities found in the PHP programming language.
The affected Canadian sites included those operated by the Canadian Centre for Cyber Security, Statistics Canada, and the provincial governments of Newfoundland and Labrador and Prince Edward Island. Artificial Intelligence Minister Evan Solomon stated that some federal government websites were taken offline as a precautionary measure and urged organizations running PHP to implement the security update immediately.
The PHP Foundation released the urgent new fixes for the software vulnerabilities and called on website operators to update without delay. The flaws were discovered by cybersecurity company Wiz, which is owned by Alphabet, using artificial intelligence and multiple large language models. According to web technology tracker W3Techs, PHP runs approximately 75 percent of websites whose programming language can be identified, making the vulnerabilities particularly widespread.
The vulnerable code in PHP had been present for more than a decade before being discovered. A possible exploit for one of the vulnerabilities was first theorized in 2024, but fixes were delayed due to resource issues and other priorities.
Major organizations moved quickly to address the issue on Wednesday. Wikipedia, Cloudflare, and Maple Health all implemented fixes for the PHP security vulnerabilities. However, smaller entities face longer vulnerability periods due to resource constraints, leaving small and medium-sized businesses with limited IT resources at increased risk during the transition.