Most businesses do not choose the programming language behind their website or client portal. A vendor, developer or hosting provider does. That does not make the risk someone else’s problem.

Recent reporting on critical PHP vulnerabilities is a reminder that a functioning website is not proof that it is secure. A flaw can sit underneath a familiar online service for years, unnoticed, until it is found and exploited.

Why this matters

PHP runs parts of many websites and web applications. If an affected server is exposed, an attacker may be able to run unaut I'mhorized code or access information held by the service.

The practical impacts can be immediate:

• customer or employee information may be exposed;
• online services may be taken offline while a fix is applied;
• bookings, sales and client access may be interrupted; and
• the organization may need to investigate whether personal information was accessed or exposed.

A preventive shutdown is not proof of a breach. Neither is a live website proof that there has been no exposure.

A patch is essential, but it is not the whole response

The PHP project urged users to update immediately after the vulnerabilities were disclosed. The Canadian Centre for Cyber Security later identified an additional vulnerability, in uncommon conditions, that was not addressed by the initial fixes.

That distinction matters. Updating a website plugin does not necessarily update the PHP software running underneath it. And applying a patch does not answer the separate question: what happened before the patch was installed?

Your privacy obligations

For Alberta organizations subject to the Personal Information Protection Act, reasonable safeguards are a legal obligation. If a breach involving personal information in the organization’s custody or control creates a real risk of significant harm for affected individuals, the organization must notify Alberta’s Information and Privacy Commissioner without unreasonable delay.

It is therefore important to establish whether the organization could be vulnerable, and quickly enough to make sound technical, privacy and legal decisions.

Ask these questions today

Ask your IT team, managed-service provider or host for written confirmation of:

1. whether any website, portal or hosted service uses affected PHP software;
2. the installed PHP versions and the applicable patches;
3. whether all measures in the current advisory have been completed;
4. whether logs have been preserved and reviewed for suspicious activity; and
5. what exposure, if any, remains.

If suspicious activity is identified, preserve the relevant logs and obtain incident-response and legal advice promptly. The investigation may need to assess what information was accessible, whether it was acquired or misused, and whether notification obligations are triggered.

Technical dependencies are often invisible until they become urgent. Treat this one as a governance issue as well as an IT task: get a clear written answer, confirm the remediation, and preserve enough evidence to understand the risk.

Sources

• CBC About That, “PHP flaw: How AI just hacked an unhackable part of the internet”; companion reporting by Abby Hughes, CBC News, October 22, 2026.
• Reuters, “Government Websites Go Dark After AI-Discovered Flaw Sparks Security Scramble,” October 21, 2026.
• PHP project, “Security advisory: Critical remote code execution vulnerabilities, update now,” October 21, 2026.
• Canadian Centre for Cyber Security, “AL26-026 – Critical vulnerabilities impacting PHP – CVE-2026-109618 and CVE-2026-109619 – Update 1,” updated October 23, 2026.
• Alberta OIPC, “Advisory for Notifying Affected Individuals under PIPA”.
• Alberta OIPC, “Breach Notification Requirements”.