Canadian government websites go offline to patch critical PHP vulnerability
The flaw, present for over a decade, was discovered using artificial intelligence by cybersecurity researchers.
Numerous Canadian government websites went offline Wednesday to apply an urgent security fix after critical vulnerabilities were discovered in PHP, a programming language that underpins a vast portion of the internet. Artificial Intelligence Minister Evan Solomon said some federal government sites were taken down temporarily as a precautionary measure. Provincial sites for Newfoundland and Labrador, Prince Edward Island and Elections B.C. were also offline, displaying messages citing a global security incident. "If you run PHP, it is imperative that you update now," the PHP Foundation said in a news release.
"We are taking this situation extremely seriously," Solomon said in a post on social media. "The affected websites will be brought back online as soon as the fixes have been applied." The websites for the Canadian Centre for Cyber Security and Statistics Canada appeared to be down for a period of time on Wednesday. The vulnerability affects PHP, a free, open-source software maintained by volunteers that dates back to the early 1990s and is baked into platforms like WordPress, Drupal, Joomla and Magento.
PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs. The vulnerable code had been present for more than a decade, according to Alphabet-owned cybersecurity company Wiz. In a blog post, Wiz said it discovered the flaw using artificial intelligence, using multiple large language models to find the vulnerability and validate the patch while working with OpenAI. The company also co-ordinated with Automattic, AWS and Microsoft on the patch rollout. "When it comes to PHP in particular, that is foundational to the internet," said Ritesh Kotak, a Toronto-based cybersecurity and tech analyst. Because of that widespread use, he said many websites are vulnerable to hacks until the fix is implemented, making the scale of the situation "absolutely scary." Kotak said larger organizations with big IT teams will be able to implement the fix more quickly, but medium or small ones may be vulnerable longer or struggle due to limited resources.
The PHP Foundation said a possible exploit for one of the vulnerabilities was first "theorized" in 2024, but each solution it devised caused new problems. A lack of resources and other issues taking precedence led to the delay in fixing the problem, the foundation explained in an email. Kotak said while AI helped find and fix the vulnerabilities in this case, it can also be used by hackers to find weak points and exploit them. "With [AI], you could have thousands of hackers using the latest and greatest tools and knowledge that is out there going out and trying to get into systems and infiltrate databases," Kotak said. For that reason, he expects to see more cybersecurity incidents in the future. Elsewhere around the world, cybersecurity agencies in Europe, Australia, Japan and Britain also urged PHP users to apply the fix. Governments in France, the Netherlands and other European countries proactively took their websites offline to implement the patch. Other major sites like Wikipedia, Cloudflare and Maple Health also addressed the security vulnerabilities in PHP on Wednesday.
With files from The Canadian Press, CBC News and Radio-Canada