On October 21, 2026, a wave of global website shutdowns occurred as operators moved to patch two critical vulnerabilities in the PHP programming language. The outages included major Canadian entities such as the Government of Canada, Montreal's STM, and Quebec's SAQ.
The 70 percent vulnerability in the web's foundation
PHP serves as the essential backbone for a massive portion of the modern internet, acting as the underlying code for a vast majority of digital interactions. According to the report, cybersecurity expert Ritesh Kotak emphasized that roughly 70 percent of all public-facing appplications and websites utilize PHP. using a building analogy, Kotak noted that these vulnerabilities could impact nearly everything a person does online,from signing into accounts to managing digital shopping carts.
Montreal's STM and Quebec's SAQ lead the precautionary shutdowns
In Canada, several high-profile organizations opted for service disruption to prevent potential data compromise. Montreal's transit authority, the STM, took its stm.info website offline just before noon on Wednesday, redirecting visitors to beta.stm.info to ensure commuters could still access service updates. Similarly, Quebec's liquor commission, the SAQ, shut down its digittal presence as a preventative measure.
Evan Solomon, Canada's minister of artificial intelligence and digital innovation, confirmed that some federal websites were also taken offline following guidance from the Canadian Centre for Cyber Security to protect citizens' information. Officials have characterized these takedowns as temporary and precautionary rather than a response to a known compromise.
How OpenAI and AI agents uncovered the August flaws
The discovery of these two critical vulnerabilities in August was driven by the very technology that now poses a threat to them. OpenAI reported that it led a coalition of researchers and security providers using artificial intelligence to identify the flaws. However, programmers at PHP have issued an urgent warning: just as AI helped uncover these bugs, it can also be used by malicious actors to aid in sophisticated attacks, creating a high-stakes race between defenders and hackers.
The missing count of affected Government of Canada sites
Despite the widespread nature of the shutdowns, several critical details regarding the actual impact of the vulnerabilities remain unverified. The Government of Canada has not disclosed the exact number of federal websites that were required to go offline to secure their systems. Furthermore, while the report notes that no specific data breach has been confirmed in Canada,it remains unclear if hackers successfully exploited the vulnerabilities in the window between their discovery in August and the October patching efforts .
From Finland's Land Survey to the EU's cybersecurity warnings
The threat is being managed on a global scale, with the EU Agency for Cybersecurity advising organizations to secure their sites immediately. The reach of the issue has forced diverse entities, such as the Helsinki Book Fair and Finland's National Land Survey, to go dark. The FBI's cyber division has also issued warnings, noting that the vulnerabilities significantly increase the risk of compromise for millions of servers and a wide range of global networks.
Comments 0