The Canadian government’s chief information officer says there’s no sign a massive global website coding vulnerability has led to federal information being compromised.
In a statement on Thursday, the chief information officer said officials became aware of the issue impacting PHP coding, which underwrites roughly 70 per cent of the world’s websites, on Oct. 21.
“Under certain conditions, these vulnerabilities could allow a malicious cyber actor to run unauthorized commands on affected systems without authentication,” the statement said.
“Security updates are being applied to address these vulnerabilities. While these measures are being implemented, some government of Canada websites may be temporarily unavailable or experience service disruptions. In these cases, work is underway to restore access as quickly and securely as possible.”
“There is no indication at this time that any Government of Canada systems or information holdings have been compromised.”
Artificial Intelligence Minister Evan Solomon told a Senate committee on Thursday that they are taking the discovery of the global website coding vulnerability “very seriously.”
“We took some websites proactively offline because there are PHP software in there and as a precaution to protect against that,” Solomon said in his testimony to the committee after websites including those of the Canadian Intellectual Property Office and Statistics Canada were taken offline.
Some government websites may still be offline for an unknown amount of time amid a worldwide PHP coding vulnerability that has opened the door to millions of reported hack attempts.
Get daily National news
Get daily Canada news delivered to your inbox so you’ll never miss the day’s top stories.
Statistics Canada’s website was back online around noon on Thursday after being shut down for several hours while cyber security officials and government security teams work to update systems .
The website for the Canadian Intellectual Property Office, which handles trademark and copyright information, was still down Thursday, with a notice saying, “This service is temporarily offline while we carry out urgent maintenance.”
On Wednesday, Solomon had posted on social media that several government websites went dark to protect systems and Canadians’ information following guidance from the Canadian Centre for Cyber Security.
“This is a global issue, and other governments and organizations are also taking protective measures,” he said.
The British Columbia government posted Wednesday on social media that it had taken some of its webpages offline “as a precaution following a new global cybersecurity vulnerability.”
The B.C. government said teams were working to restore services as soon as possible.
PHP developers released urgent fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using AI, urging users to “update immediately.”
“Details of these flaws became public before fixes were ready, and attacks have since been reported,” said Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security speaking to Reuters.
“So companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”
As companies and governments deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firm Cloudflare NET.N.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on X late on Wednesday.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.”
The FBI’s cyber division said the vulnerability could allow malicious actors to remotely execute code in the programming language, potentially compromising sensitive data and networks.
The PHP Foundation, which includes developers who work on securing the programming language, said it has released fixes for the vulnerabilities, along with instructions on how to update systems.
Governments in Europe and elsewhere took websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.
The website of the Finnish government was only partly available Wednesday. A message to visitors said Finnish government websites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.
The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki showed how much public and corporate systems rely on the software, and how hard it is to fix such flaws quickly once they are made public.
“It was a long day and a long night, I know for all the IT and security folks … I’ve not seen anything like this in a long, long time,” Microsoft MSFT.O CEO Satya Nadella said at a company event in Cologne, Germany, on Thursday.
He said the episode underscored the importance of building digital systems that can be maintained securely.
– with files from The Canadian Press and Reuters
© 2026 Global News, a division of Corus Entertainment Inc.
