From: Communications Security Establishment Canada
Statement
October 21, 2026 – Ottawa, Ontario
The Canadian Centre for Cyber Security (Cyber Centre), a part of the Communications Security Establishment Canada, is working closely with government partners and industry in Canada to assess and respond to critical vulnerabilities identified in PHP Hypertext Preprocessor (PHP).
PHP is software widely used to run websites and online services and is also included in other products. Under certain conditions, these vulnerabilities could allow a malicious cyber actor to run unauthorized commands on affected systems without authentication. Security updates are now available to address these vulnerabilities.
The Cyber Centre has issued an alert on critical vulnerabilities affecting PHP, with technical details and recommended actions to help Canadian organizations assess their exposure and protect their systems. We are also sharing advice, guidance and threat information with our partners to support their response.
As a precaution, some websites may be temporarily unavailable while security patches are applied to reduce the risk of exploitation. Applying security patches is an important part of maintaining layered cyber defences as threats evolve.
We urge all organizations to promptly identify systems running PHP across their infrastructure, prioritizing internet-facing systems and apply available security updates. Organizations should also check for updates from their software providers and follow their recommended security guidance. Where immediate patching is not feasible, organizations should isolate affected internet-facing applications from public networks until they can be protected.
We will continue to monitor developments related to these PHP vulnerabilities and work closely with our partners in Canada and internationally to help organizations protect their systems.
We strongly encourage Canadian organizations that suspect they have been affected by malicious cyber activity to report it to the Cyber Centre. Early reporting helps us provide timely advice and guidance and identify broader cyber threat activity affecting Canadian organizations.
Contacts
For more information, please contact (media only):
CSE Media Relations
media@cse-cst.gc.ca
Stay connected
Follow Cyber Centre and CSE on X (formerly known as Twitter) and on LinkedIn.