The Government of Canada works diligently to defend its systems from cyber threats by enhancing cyber security management practices and identifying threats and vulnerabilities.
On October 21, 2026, the Government of Canada became aware of two critical vulnerabilities affecting PHP Hypertext Preprocessor (PHP), a software widely used to run websites and online services and other products. Under certain conditions, these vulnerabilities could allow a malicious cyber actor to run unauthorized commands on affected systems without authentication.
Security updates are being applied to address these vulnerabilities. While these measures are being implemented, some government of Canada websites may be temporarily unavailable or experience service disruptions. In these cases, work is underway to restore access as quickly and securely as possible.
There is no indication at this time that any Government of Canada systems or information holdings have been compromised.
