The Canadian Centre for Cyber Security has issued a statement on critical vulnerabilities in PHP Hypertext Preprocessor (PHP), the scripting language that runs a large share of the world's websites and online services. The statement, dated October 21, 2026 and published from Ottawa, says the Cyber Centre is working with government partners and Canadian industry to assess and respond to the flaws.

According to the Cyber Centre, which is part of the Communications Security Establishment Canada, the vulnerabilities could, under certain conditions, allow a malicious actor to run unauthorized commands on affected systems without authentication. That last part matters. No credentials, no session, no MFA prompt to get past. Security updates are available to address the issues.

The statement does not list CVE identifiers, severity scores or affected version ranges. Those details are in a separate alert the Cyber Centre says it has issued, which contains technical details and recommended actions for Canadian organizations to assess their exposure. The full statement is available at the Cyber Centre's website. The Cyber Centre also says it is sharing advice, guidance and threat information with partners to support their response.

Who is affected is broad by design. PHP powers content management systems, e-commerce storefronts, customer portals, intranet tools and a long tail of internal applications that nobody has touched since the person who built them left. The Cyber Centre notes that PHP is also bundled inside other products, which means a fleet of appliances and packaged software may carry a vulnerable interpreter that never shows up in a server inventory labeled "PHP."

The Cyber Centre warns that some websites may be temporarily unavailable as a precaution while patches are applied. In plain terms: if a Canadian service you rely on goes dark for a few hours in the coming days, there is a reasonable chance it is being fixed, not breached. That is the good outcome.

The statement's core ask is short and unambiguous. The Cyber Centre urges all organizations to promptly identify systems running PHP across their infrastructure, prioritize internet-facing systems, and apply the available security updates. It also tells organizations to check for updates from their software providers, since a patched PHP release does nothing for a vendor product that ships its own embedded copy and needs its own fix.

For the IAM crowd, the phrase "without authentication" is the one to sit with. Identity controls are the front door. A pre-authentication remote command execution bug is someone walking in through the wall. Strong MFA, conditional access and tight session policies all still matter, but none of them get a vote when the request never reaches the login handler. What does help is the boring stuff: knowing where PHP is, patching it, and making sure the service accounts and secrets sitting on those hosts cannot be turned into a bridge to the identity provider, the directory or the cloud control plane.

The Cyber Centre frames patching as part of maintaining layered defenses as threats evolve, which is regulator language for "this is not the first time and it will not be the last." Organizations that already have an accurate software inventory and a tested emergency change process will find the next few days busy but manageable. Organizations that do not will find them educational.

So, what should an identity or security team actually do today? First, pull an inventory of every host running PHP, including vendor appliances and anything with a web admin console, and patch the internet-facing ones before the day ends. Second, audit what those web tiers can reach: rotate any database credentials, API keys, LDAP bind accounts and cloud access keys stored in config files on PHP servers, and confirm those identities are scoped to the minimum they need. Third, turn up web server and application log retention on affected hosts and look for unexpected process launches or outbound connections from the web tier. If all three are already done, congratulations, you are the organization everyone else will be copying next week.