The Canadian government temporarily took some of its websites offline this week as a precautionary measure following the discovery of a serious security vulnerability affecting websites around the world, according to AI and digital innovation minister Evan Solomon.
Solomon said in a post on X that the move was taken “to protect government systems and Canadians’ information” in response to a vulnerability found in PHP, a programming language used to build a large share of the world’s websites. He said the decision followed guidance from the Canadian Centre for Cyber Security and noted that other governments and organizations were taking similar protective steps.
A Global Response
Developers of the PHP language said they had identified two critical security vulnerabilities and urged site managers to take their websites offline or update their software as soon as a fix became available. Denmark, Finland and France also took some government websites offline temporarily, while organizations including Wikipedia, the Internet Archive and 4chan removed some pages as well.
The vulnerabilities affect a wide range of websites and internet software, from content management systems such as WordPress to e-commerce platforms such as Adobe Magento. According to online technology tracker W3Techs, roughly 70 percent of all websites run on PHP. The flaws could potentially let attackers remotely execute commands on servers running the software, giving them access to entire servers or databases.
Fix Available, but Rollout Incomplete
PHP has since released a security fix for the vulnerabilities, though it is currently only available for up-to-date versions of the software. Cybersecurity experts have advised users who are not website developers to update their passwords and enable two-factor authentication on their online accounts as an added precaution.
A separate security issue was also identified the same day, involving TLS certificates — digital documents used to verify a website’s identity — that were found to have extremely weak encryption. According to Engadget, this flaw could affect systems ranging from virtual private networks to internet-connected devices, as weak private keys could allow attackers to forge credentials for numerous websites and applications.
AI company OpenAI said that security researchers using its large-language model, GPT-5.6 Sol, helped identify the PHP vulnerabilities.
This article references reporting from:
