Canada Takes Government Websites Offline After Critical PHP Vulnerabilities Discovered
The Government of Canada took several websites offline, including Statistics Canada and the Canadian Intellectual Property Office, after identifying two critical vulnerabilities in PHP on October 21, 2026. Global hacking attempts surged to millions following the disclosure, though officials stated no government systems were compromised.
On October 21, 2026, the Government of Canada identified two critical vulnerabilities affecting PHP, a programming language that underwrites roughly 70 per cent of the world’s websites. The discovery prompted immediate action across federal and provincial systems, as well as a global surge in exploitation attempts.
In response to guidance from the Canadian Centre for Cyber Security, several federal websites were taken offline or experienced service disruptions starting Wednesday, October 21, and continuing into Thursday, October 22. The website for the Canadian Intellectual Property Office was taken offline on Wednesday, while Statistics Canada's website remained down on Thursday morning. Artificial Intelligence Minister Evan Solomon stated that the websites went dark to protect government systems.
The FBI’s cyber division warned that the vulnerabilities could allow malicious actors to remotely execute code without authentication, potentially compromising sensitive data. PHP developers released urgent fixes on Wednesday for the flaws, which were uncovered using artificial intelligence.
Following the public announcement of the vulnerability, exploitation attempts escalated rapidly. Cloudflare reported that hacking attempts surged from thousands to millions within hours. In the 10 hours before the public announcement, there were thousands of attempts; within 45 minutes after the announcement, tens of thousands of attempts were recorded, reaching hundreds of thousands within two hours.
The response extended beyond Canada's federal government. The British Columbia government posted on social media on Wednesday that it had taken some webpages offline as a precaution. Governments in Europe, including Finland, also took websites offline on Wednesday. Globally, emergency shutdowns affected banking, airline, rail, tax, and government services in various countries, prompting companies and governments to urgently deploy security patches.
Microsoft CEO Satya Nadella commented on the incident at a company event in Cologne, Germany, on Thursday.
According to a statement issued by the Office of the Chief Information Officer of the Government of Canada on October 22, security updates are being applied to address the PHP vulnerabilities in government systems. As of that statement, there was no indication that any Government of Canada systems or information holdings had been compromised.