Some Government of Canada websites went dark on Wednesday as a precaution against two critical security flaws in PHP, the programming language that runs a large share of the web. AI and Digital Innovation Minister Evan Solomon said the move followed guidance from the Canadian Centre for Cyber Security, The Canadian Press reports.

“This is a global issue, and other governments and organizations are also taking protective measures,” Solomon said. “We take this situation extremely seriously.” He said affected sites will come back once they’re patched. Treasury Board hadn’t said which sites were affected.

What’s wrong with PHP

PHP’s developers disclosed the two flaws, CVE-2026-109618 and CVE-2026-109619, on Tuesday. They can let an attacker run commands on a server remotely, potentially exposing whole servers and databases, BetaKit reports. About 70% of websites run on PHP, according to W3Techs, including sites built on WordPress and Magento. OpenAI said the bugs were found by security researchers using one of its AI models.

The Cyber Centre’s alert AL26-026 tells organizations to:

  • update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
  • put internet-facing systems first
  • check third-party products and appliances that bundle PHP
  • watch logs for signs of compromise

PHP 8.1 and older no longer get updates from the PHP project, so those sites need a vendor backport or an upgrade. U.S. cybersecurity agency CISA issued a similar warning.

Who else went offline

  • Abroad: Denmark, Finland and France took down some government sites, and Wikipedia, the Internet Archive and 4chan pulled some pages, according to BetaKit.
  • British Columbia took some provincial webpages offline as a precaution, The Canadian Press reported.
  • Montreal: the STM and SAQ websites were also down, CTV News reported.

Why it matters: For most Canadians, the risk isn’t your own computer. It’s the websites holding your data. Security experts advise updating passwords and turning on two-factor authentication on important accounts. If you run a website, even a small WordPress blog, check your host’s PHP version today. Unpatched PHP sites remain at risk.