1 (888) 897-3611 Book a call

Threat advisory · Multiple

PHP2Shell: why Canadian government websites went offline, and what to check on yours

Two critical PHP flaws disclosed Oct. 21, 2026 took federal sites and Elections BC offline as a precaution. If your website runs PHP, update it now.

By happier IT 5 min read

On October 21, 2026, PHP released fixes for two critical flaws, known as PHP2Shell, that could let attackers take over web servers without a password. Some Government of Canada websites and Elections BC went offline as a precaution while they patched. If your organization’s website runs on PHP, which includes most WordPress sites, confirm today that it has been updated.

What happened

PHP is the programming language that runs much of the web, including WordPress, Drupal, Joomla and Magento. On October 21, 2026, the PHP project released emergency updates for two flaws, CVE-2026-109618 and CVE-2026-109619 (a CVE is a public ID for a security flaw). Each is rated 9.2 out of 10 for severity, The Hacker News reported.

The Canadian Centre for Cyber Security published alert AL26-026 the same day. It says a successful attack “could allow an unauthenticated threat actor to execute arbitrary code,” meaning someone who has never logged in could run their own commands on the server. Websites facing the internet are at the highest risk.

The release was moved forward a day after details leaked on October 20, The Hacker News reported. Researchers at Calif and Wiz found the flaws in August using AI models, according to Global News.

Websites went offline around the world as organizations patched. In Canada:

  • Federal sites: AI and Digital Innovation Minister Evan Solomon said some Government of Canada websites were taken offline “as a precaution” on the advice of the Cyber Centre, BetaKit and Global News reported. The government did not say which sites, or how many.
  • Elections BC: its website went down on October 21 and was restored at 3:20 p.m. Pacific. Elections BC said it was a precaution and that none of its information systems were breached, CBC News reported.
  • Other provinces: Newfoundland and Labrador and Prince Edward Island also took some sites offline to apply fixes, according to the same CBC report.

The exploitation picture is changing fast. The Cyber Centre said on October 21 it had not yet seen active exploitation. Tenable reports that Amazon’s threat intelligence team saw an attempt on October 17, before the fixes, and now describes the flaws as “being broadly exploited in the wild.” No Canadian organization has reported a break-in from these flaws.

Who is affected

Any server running PHP that answers web requests, whatever the website itself does. The Cyber Centre lists the common set-ups as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The fixed versions are:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

PHP 8.1 and older get no fix from the PHP project, though some Linux distributions and hosts ship their own patched packages.

For most organizations, that means the company website, WordPress or e-commerce sites, client portals, and appliances with a PHP web page.

What to do now

If your website is managed by a host or a developer

  1. Ask today: “Which PHP version is our site on, and has it been patched for CVE-2026-109618 and CVE-2026-109619?” Get the answer in writing.
  2. If the site runs PHP 8.1 or older, ask for a patched vendor package or a plan to move to a supported version. Old versions get no fix from the PHP project.
  3. Don’t install “fix” plugins or paste code snippets from forums. Patchstack, a WordPress security firm, warns against both. Only the PHP update fixes the problem.

If you run your own servers

  1. Update PHP to a fixed version, or your distribution’s patched package, and restart the web server and PHP workers so the fix takes effect.
  2. Find every copy of PHP, including staging sites, containers and appliances that bundle it. The Cyber Centre specifically asks organizations to check third-party products.
  3. If you can’t patch right away, the Cyber Centre suggests taking internet-facing applications off public networks until you can. That is what the federal government and Elections BC did.
  4. Check the logs for repeated server errors, unusual uploads and unexpected new files. If you see signs of an attack, treat the server as compromised, change the passwords and keys it holds, and get incident response help.

What this means for organizations in BC and Alberta

A website is often the one system nobody owns: built by an agency years ago, hosted elsewhere, and left out of regular patch management. It belongs on the same update list as laptops and servers.

If a website that holds personal information is compromised, privacy law applies:

  • Federally (PIPEDA): organizations covered by the Personal Information Protection and Electronic Documents Act must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada, and notify affected people.
  • Alberta (PIPA): section 34.1 of the Personal Information Protection Act requires notifying Alberta’s Information and Privacy Commissioner without unreasonable delay when there is a real risk of significant harm.
  • British Columbia: the private-sector PIPA does not currently require breach reporting, but the Office of the Information and Privacy Commissioner for BC strongly recommends it.

How happier IT helps

Our vulnerability management service keeps an inventory of what you run, websites and appliances included, so we can answer “are we affected?” the same day a flaw like this lands. If you’re not sure where your website or servers stand, a free IT assessment is a calm place to start, for teams across British Columbia and Alberta.

Sources

More from the feed

Other incidents we've written up.

Want to know what this would look like for you?

A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.

Book a 30-minute call Get a free IT assessment

Or call 1 (888) 897-3611