How two decades-old flaws in PHP, the language behind most of the web, knocked major sites offline in hours, and why Canadian businesses and their insurers now face a real-world test of cyber readiness.
The PHP2Shell vulnerabilities, two critical flaws in the programming language that runs most of the internet, went from public disclosure to active attack within hours on Wednesday, Oct. 21, 2026. The Canadian Centre for Cyber Security responded by adding its own advisory to a wave of international warnings, urging website administrators across the country to install updates without delay.
By the time many Canadians logged on, government agencies in Europe had pulled websites offline, the Wikimedia Foundation had taken down parts of Wikipedia, and Nintendo had suspended some services. Closer to home, a Quebec school service centre interrupted several of its websites while technicians worked on the problem.
This is a developing story. Details about attacks, affected organizations and confirmed breaches may change as more information becomes available.
Who Took Websites Offline as the PHP2Shell Attacks Started
The precautionary shutdowns spread quickly across both the public and private sectors. Organizations chose to go dark rather than leave exposed servers online while attackers probed for weaknesses.
- European governments: Agencies in the Netherlands, Finland and France took websites offline earlier in the day.
- Wikimedia Foundation: The non-profit that operates Wikipedia removed parts of its web presence.
- Nintendo: The gaming company pulled some of its services.
- Quebec: The Centre de services scolaire Marie-Victorin interrupted service on several of its websites while the issue was addressed.
As of the latest reports, no real-world organization had disclosed a major breach tied to the flaws. That may not last. Working exploit code is already circulating publicly, and the Netherlands’ national cyber agency has said it expects large-scale attacks soon.
How the PHP2Shell Flaws Let Attackers Seize a Server Without Logging In
The two weaknesses are tracked as CVE-2026-109618 and CVE-2026-109619. Each carries a severity rating of 9.2 out of 10, placing them firmly in the critical category.
What makes them so serious is that an attacker does not need a username or password. A successful exploit can hand over control of a web server to someone with no legitimate access at all. That is the kind of foothold criminals use to steal data, plant malware or move deeper into a company’s network.
Security firm watchTowr reported that its network of decoy servers, which are set up to attract and record hacking attempts, has logged attempts to exploit both flaws. Cloudflare’s chief technology officer, Dane Knecht, said early Wednesday that the company was seeing attacks emerge. He described Cloudflare’s emergency firewall rules as a “STOPGAP only”, signalling that network filtering is no substitute for patching the underlying software.
A Leak That Put Attackers and Defenders on the Same Clock
Software vulnerabilities are normally disclosed on a coordinated schedule, giving maintainers time to prepare fixes before details become public. That process broke down here. Information about the flaws leaked online a day before the planned disclosure date, forcing PHP’s developers to rush out their updates.
The fixes arrived at around 10 a.m. ET on Oct. 21. The practical consequence is that attackers and defenders learned about the bugs simultaneously, removing the usual head start that lets administrators patch before exploitation begins.
| PHP release branch | Patched version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| Versions older than 8.2 | No official fix |
The patched releases are available from PHP’s official website. Only the 8.2 through 8.5 branches received official fixes. Sites still running older versions have no simple update to apply, leaving their operators with harder choices about upgrades, workarounds or taking systems offline.
Why a Bug in PHP Reaches WordPress, Drupal and Magento Sites
PHP works behind the scenes every time someone loads a web page. It pulls information such as product listings, account details or login screens from a database, assembles the page and sends it to the visitor’s browser.
The language was created in 1993 by Danish-Canadian programmer Rasmus Lerdorf. It is free to use and maintained largely by volunteers. It also underpins some of the most widely used website platforms, including WordPress, Drupal and Magento, along with many of the control panels that hosting companies give their customers.
Web technology tracker W3Techs estimates PHP’s share at roughly 70% of websites whose server-side language it can identify. Because the flaws sit inside PHP itself, a website can be vulnerable even if its own code is well written and up to date. A small retailer’s online store can be exposed for exactly the same reason as a government portal.
AI Models Helped Surface Weaknesses Hidden for Decades
The flaws were identified by two security firms, Calif and Wiz, both of which worked with frontier artificial intelligence models in their research. Wiz said the weaknesses had been present in PHP’s code for decades.
OpenAI, whose model Calif used, described the discovery as “one of the most impactful security issues in recent memory”. The episode underlines a shift that security professionals have been watching closely: AI tools are increasingly capable of finding deep, long-overlooked bugs in foundational software.
That capability cuts both ways. The same class of tools that helped defenders find these flaws could, in principle, help attackers find others, which raises the stakes for how quickly volunteer-maintained projects can respond.
Ottawa’s Advisory and Allies Who Said Unplug
The Canadian Centre for Cyber Security published its advisory on Wednesday, calling on administrators to apply the updates. Several allied agencies took a firmer line.
Authorities in the United States, the United Kingdom, Australia and the European Union told organizations that if they could not patch right away, they should take affected systems offline. That guidance helps explain why so many high-profile sites went dark on the same day.
Canada Has Been Here Before With Log4j
Canadians have seen a flaw in widely shared software cause real disruption. When the Log4j vulnerability emerged in December 2021, Quebec took nearly 4,000 government websites offline and the Canada Revenue Agency suspended its online services.
That episode showed how a single weakness buried in common code can ripple through public services that millions of people rely on. The PHP2Shell response so far, with a Quebec school service centre among the first Canadian organizations to act publicly, suggests institutions have absorbed some of those lessons about moving quickly.
A Real-World Stress Test for Canada’s Soft Cyber Insurance Market
The timing is awkward for the insurance industry. Earlier this month, the Insurance Bureau of Canada (IBC) released its latest report on the Canadian cyber market, warning that shared technology and AI could produce losses affecting many businesses at once. Within weeks, a single flaw in widely used software exposed a large share of the web.
Pricing has been moving in buyers’ favour. Marsh says Canadian cyber insurance rates fell 5% in the first quarter of 2026 as new capacity increased competition among insurers. Some larger insurers have begun hinting that the rate cycle could turn.
Insurers that actively scan their clients’ systems are likely to be busy. When a similar pair of WordPress flaws, nicknamed WP2Shell, appeared in July, insurer Coalition said it alerted affected policyholders a day before it observed attacks starting.
Several coverage questions are likely to come up in the days ahead:
- Voluntary shutdowns: Businesses that switched off their own websites as a precaution may ask whether lost revenue is covered. The answer depends on policy wording and waiting periods, and explicit cover for self-imposed shutdowns is still rare. Beazley’s recent endorsement, for example, applies only when a business shuts down its own malfunctioning AI system.
- Hosting provider outages: Many small firms use shared hosting, so their fix depends on the provider. If the provider goes down, the resulting loss falls under contingent business interruption, which is not standard and often carries a sub-limit.
- Patching speed: Underwriters may ask how quickly clients applied the fix once it was available.
Coverage outcomes depend on individual policy terms. Businesses should confirm details with their broker or insurer rather than rely on general reporting.
Only 22% of Canadian Small Businesses Carry Any Cyber Cover
Many of the businesses most exposed to a flaw like PHP2Shell have no cyber insurance at all. A survey commissioned by the IBC found that 22% of Canadian small and medium-sized enterprises hold any form of cyber coverage, and just 12% have a standalone cyber policy.
Specialist insurer CFC estimates that 10% to 15% of Canadian companies buy standalone cyber cover, compared with 30% to 40% in the United States. That gap means a significant share of Canadian firms would absorb the cost of any breach, cleanup or downtime on their own.
Steps Canadian Website Owners Are Being Told to Take Now
For business owners who do not manage their own servers, the immediate task is less about technical work and more about getting clear answers from whoever does.
- Identify who runs PHP: Find out whether your web developer, agency or hosting company manages the PHP installation behind your site.
- Get written confirmation: Ask that party to confirm in writing that PHP has been updated to a patched version.
- Check older versions: If your site runs PHP older than 8.2, ask what plan is in place, since no official fix exists for those releases.
- Watch for insurer alerts: If you carry cyber insurance, check whether your insurer has sent a vulnerability notice.
- Look for signs of intrusion: Any server that sat unpatched while attacks were under way should be examined for evidence of a break-in.
- Report promptly: Flag anything suspicious to your insurer quickly, as delays can complicate claims.
Frequently Asked Questions
What is PHP2Shell?
It is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10, that can let an attacker take over a web server without logging in.
Which PHP versions fix the problem?
Patches were released on Oct. 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions older than 8.2 have no official fix.
Is my WordPress site affected even if WordPress is up to date?
Possibly. The flaws are in PHP itself, so a site can be exposed regardless of its own code until the underlying PHP installation is updated.
Have any organizations been breached?
No real organization had reported a major breach as of the latest reports, but exploit code is public and Dutch authorities expect large-scale attacks soon.
What did the Canadian Centre for Cyber Security recommend?
It published an advisory on Oct. 21 urging administrators to update. Agencies in the U.S., U.K., Australia and the EU also advised taking systems offline if immediate patching is not possible.
