On the morning of Wednesday, October 21, 2026, a critical security flaw in PHP was made public. By the end of the day, every site hosted by Elefen was protected by a permanent fix.
PHP powers nearly 70% of websites worldwide, including WordPress and WooCommerce. When a flaw of this scale is announced, every hour counts. Here is how our team and our partners responded, and what you need to know about your own site.
The PHP flaw at a glance
Two high-severity vulnerabilities were discovered in PHP, the language that runs most websites. They had gone unnoticed for years before being spotted with the help of artificial intelligence.
PHP’s developers released urgent fixes and asked all users to update immediately. The threat was very real: Cloudflare saw thousands of exploit attempts in the hours before the announcement, then millions afterwards.
Some organizations even took their services offline as a precaution, such as Japanese companies ANA and Nomura and Finland’s state IT provider, Valtori. Valtori expects that restoring services could take days or even weeks (source).
How big this is in Canada and Quebec
The Canadian Centre for Cyber Security published alert AL26-026 on October 21. The flaws, nicknamed “php2shell” (CVE-2026-109618 and CVE-2026-109619), allow remote code execution without authentication. They are rated 9.2 out of 10 (Clubic).
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions no longer receive official fixes. The Centre recommends patching immediately, starting with internet-facing systems (the Centre’s statement).
As a precaution, some Government of Canada websites were made temporarily unavailable while patches were applied (Treasury Board Secretariat). In Quebec, the SAQ, the STM and the SAAQ locked down their sites (in French), and several Newfoundland and Labrador government sites were also taken offline (in French). In the United States, CISA called for immediate patching.
Right after the announcement: temporary fixes in place
Our infrastructure partners deployed temporary fixes as soon as the flaw was made public. These measures blocked known attack attempts while the permanent fixes were being prepared.
This first line of defence is essential: attackers don’t wait. Exploit attempts surged in the hours after the announcement, and our servers were already protected.
The same day: permanent fixes
Permanent fixes were installed on our servers during the day on October 21. That is extremely fast for a flaw of this scale: elsewhere in the world, organizations are talking about days or even weeks.
This speed is no accident. It relies on constant monitoring of our servers and close collaboration with our partners. Given how serious the flaw was, acting fast wasn’t optional: it was an obligation.
Every client informed, hosted with us or not
All our clients were notified of the flaw and of any steps they needed to take. For the sites we host, we confirmed that protection was in place.
We went further: we also contacted clients whose sites we don’t host. Their server is managed by another provider, but their security matters to us. We wanted everyone to know what to check and who to call.
Your site isn’t hosted with us? Here’s what to do
If your WordPress or WooCommerce site is hosted elsewhere, a few simple steps reduce the risk:
- Ask your host whether the PHP fix has been installed on your server, and when.
- Check your site’s PHP version: a version that is no longer supported will not receive a fix.
- Update WordPress, your theme and your plugins.
- Make sure you have a recent backup stored off the server.
- If you use Cloudflare, enable the firewall (WAF) rules available for this flaw.
Not sure what to do? Our team can check for you.
Your site’s security is our priority
In less than 24 hours, our hosted clients were protected, and all our clients knew what to do. That’s the difference a hosting service managed by a local team that knows your sites makes.
Want secure WordPress hosting and a team that reacts fast when it matters? Contact Elefen to talk about it.
Sources
- AL26-026 – Critical vulnerabilities impacting PHP — Canadian Centre for Cyber Security, October 21, 2026
- Statement regarding critical vulnerabilities in PHP — Canadian Centre for Cyber Security, October 21, 2026
- Statement from the Office of the Chief Information Officer of the Government of Canada — Treasury Board Secretariat, October 22, 2026
- Faille informatique mondiale : la SAQ, la STM et la SAAQ verrouillent leurs sites — Radio-Canada (French)
- Faille de sécurité : plusieurs sites du gouvernement de T.-N.-L. hors ligne — Radio-Canada (French)
- Critical Vulnerabilities in PHP Require Immediate Patching — CISA, October 21, 2026
- Deux failles critiques menacent des millions de sites PHP — Clubic (French), October 21, 2026
- Millions of hacking attempts as companies, governments rush to patch PHP flaws — Ground News, October 22, 2026
