The Canadian government’s chief information officer says there is no indication there is a massive vulnerability in global website encryption that led to federal information being compromised.
In a statement issued Thursday, the chief information officer said officials became aware of the issue affecting PHP encryption, which underwrites nearly 70 percent of the world’s websites, on October 21.
“Under certain circumstances, these vulnerabilities could allow a malicious cyber actor to execute unauthorized commands on affected systems without authentication,” the statement said.
“Security updates are being implemented to address these vulnerabilities. While these measures are in place, some Government of Canada sites may be temporarily unavailable or experience service outages. In these cases, work is underway to restore access as quickly and safely as possible.”
“There is no indication at this time that any Canadian government systems or information holdings have been compromised.”
Artificial Intelligence Minister Evan Solomon told a Senate committee on Thursday that they take the discovery of the global website encryption vulnerability “very seriously.”
“We have proactively taken some websites down due to the presence of PHP software there and as a precaution to protect against that,” Solomon said in his testimony to the committee after shutting down websites including those of the Canadian Intellectual Property Office and Statistics Canada.
Some government websites may remain offline for an unknown period amid a global PHP encryption vulnerability that has opened the door to millions of reported hacking attempts.
Get breaking national news
Get Canada breaking news delivered to your inbox as it happens so you never miss a trending story.
Statistics Canada’s website came back online at noon Thursday after being shut down for several hours while cybersecurity officials and government security teams worked to update systems.
The website for the Canadian Intellectual Property Office, which handles trademark and copyright information, was still down Thursday, with a notice saying: “This service is temporarily offline while we perform urgent maintenance.”
On Wednesday, Solomon posted on social media that several government websites had stopped working to protect Canadians’ systems and information following directives from the Canadian Center for Cyber Security.
“This is a global issue, and governments and other organizations are also taking preventive measures,” he added.
On Wednesday, the British Columbia government posted on social media that it had taken some of its web pages offline “as a precaution following a new global cybersecurity vulnerability.”
The British Columbia government said teams are working to restore services as quickly as possible.
PHP developers released hotfixes on Wednesday for vulnerabilities that had been lurking in the software for years until they were discovered using artificial intelligence, urging users to “update immediately.”
“Details of these flaws became public before fixes were ready, and attacks have been reported ever since,” Madeleine Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, told Reuters.
“So companies are racing to modernize against attackers who can use AI to exploit them. That’s the whole race.”
As companies and governments deploy patches and suspend websites as a precaution, hacking attempts have soared into the millions, according to cloud services company Cloudflare NET.N.
“In the 10 hours before it was publicly announced, we saw across the network thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on X late Wednesday.
“That jumped to tens of thousands in 45 minutes after the announcement, hundreds of thousands within two hours, and now millions.”
The FBI’s Cyber Division said the vulnerability could allow malicious actors to remotely execute code in the programming language, which could put sensitive data and networks at risk.
The PHP Foundation, which includes developers working to secure the programming language, said it had issued fixes for the vulnerabilities, along with instructions on how to update systems.
Governments in Europe and elsewhere took down websites as a precaution on Wednesday while website operators scrambled to secure the systems running the software.
The Finnish government website was only partially available on Wednesday. A message to visitors said Finnish government websites were experiencing a temporary outage and were completely or partially unavailable while the issue was resolved.
Emergency shutdowns of banking, airlines, railways, tax and government services from Tokyo to Helsinki showed how dependent public and corporate systems are on the software, and how difficult it is to quickly fix such flaws once they are deployed.
“It’s been a long day and a long night, and I know that for everyone in IT and security… I haven’t seen anything like this in a very long time,” Microsoft CEO Satya Nadella MSFT.O said at a company event in Cologne, Germany, on Thursday.
He said that the incident emphasized the importance of building digital systems that can be safely maintained.
-With files from The Canadian Press and Reuters
&Copy 2026 Global News, a division of Corus Entertainment Inc.
