This story is developing and will be updated.
The Canadian Centre for Cyber Security has added its voice to a wave of international warnings over two critical flaws in PHP, the code behind most of the internet. Attackers have begun targeting the flaws within hours of them becoming public.
Government agencies in the Netherlands, Finland and France took websites offline earlier today. So did the Wikimedia Foundation, which runs Wikipedia, and Nintendo, which pulled some of its services. In Quebec, the Centre de services scolaire Marie-Victorin interrupted service on several of its websites while technicians dealt with the problem.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”, can let an attacker take control of a web server without logging in. Both are rated 9.2 out of 10 for severity.
PHP’s developers released fixes at around 10 a.m. ET on Oct. 21, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which are available from php.net. The release was rushed out after details leaked online a day earlier, ahead of the planned disclosure date. Attackers and defenders learned about the bugs at the same time.
PHP builds a web page each time someone visits it, pulling product listings, account details or login screens from a database and sending the result to the browser. Danish-Canadian programmer Rasmus Lerdorf created it in 1993. It is free, maintained largely by volunteers, and sits underneath WordPress, Drupal, Magento and many hosting control panels. Because the flaws are in PHP itself, a website can be exposed even if its own code is sound.
Security firm watchTowr says its network of decoy servers has recorded attempts to exploit both flaws. Cloudflare’s chief technology officer, Dane Knecht, said early on Wednesday that the company was seeing attacks emerge, and called its emergency firewall rules a “STOPGAP only”.
No real organization has reported a major breach yet. Exploit code is already circulating publicly, however, and the Dutch national cyber agency says it expects large-scale attacks soon.
The Canadian Centre for Cyber Security published an advisory on Wednesday urging administrators to update. Agencies in the US, UK, Australia and the European Union went further, telling organizations to take systems offline if they could not patch right away.
Read next: IBC flags AI and shared tech as new cyber risks as Canada’s market stabilizes
The bugs were found by security firms Calif and Wiz, both working with frontier AI models. OpenAI, whose model Calif used, called them “one of the most impactful security issues in recent memory”. Wiz said the weaknesses had been sitting in PHP’s code for decades.
Web technology tracker W3Techs puts PHP’s share at around 70% of websites whose server-side language it can identify. Only versions 8.2 to 8.5 have official fixes. Sites still running older releases have no simple update to install.
Canada has seen major problems like this. When the Log4j flaw emerged in December 2021, Quebec pulled nearly 4,000 government websites offline and the Canada Revenue Agency suspended its online services.
Earlier this month, the Insurance Bureau of Canada (IBC) published its latest report on the Canadian cyber market. It warned that shared technology and AI could produce losses that hit many businesses at once. Weeks later, a single flaw in widely shared software has exposed a large share of the web.
The market is soft. Marsh says Canadian cyber rates fell 5% in the first quarter of 2026 as new capacity sharpened competition. Some larger insurers have started to suggest the rate cycle may turn.
Insurers that scan their clients’ systems are likely to be busy this week. When a similar pair of WordPress flaws, dubbed WP2Shell, surfaced in July, Coalition said it warned affected policyholders a day before it saw attacks begin.
Brokers should expect questions about business interruption, especially from clients who switched off their own websites as a precaution. Whether a policy responds will depend on its wording and waiting period. Explicit cover for voluntary shutdowns remains rare. Beazley’s recent endorsement, for instance, applies only when a business shuts down its own malfunctioning AI system.
Many small businesses run their websites on shared hosting, so any fix depends on their provider. If the provider goes down, the client’s loss falls under contingent business interruption, which is not standard and often carries a sub-limit. Underwriters may also ask how quickly clients patched once a fix was available.
Many of the businesses most exposed have no cyber cover at all. An IBC-commissioned survey found 22% of Canadian SMEs carry any cyber insurance and 12% have a standalone policy. CFC estimates that 10% to 15% of Canadian companies buy standalone cyber cover, against 30% to 40% in the US.
Read next: SME cyber insurance uptake stalls in Canada and everywhere except the US
For clients, the first job is finding out who manages PHP on their website and getting written confirmation that it has been updated. They should also check whether their insurer has sent a vulnerability alert. With attacks under way, any server that was left unpatched should be checked for signs of a break-in, and anything suspicious reported to the insurer promptly.
Insurance Business will update this story as it develops. For more coverage, visit our cyber news section.
Read next: IBC urges businesses to confront cyber risk gap
For the insurers brokers rate highest for cyber, see Insurance Business Canada’s 5-Star Cyber 2026 report.
