European government websites taken down, major sites like Wikipedia affected
This story is developing and will be updated.
Two critical flaws in PHP, the code behind around 70% of websites, have set off a global rush to patch servers. Canadian advisory firms whose websites, client portals or vendors depend on the software are caught up in it.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”. They can let an attacker take control of a web server without logging in, and both are rated 9.2 out of 10 for severity. PHP’s developers released fixes at around 10 a.m. ET on Oct. 21, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, available from php.net. The release was brought forward after details of the bugs leaked online the previous day.
The Canadian Centre for Cyber Security issued an advisory on Wednesday urging administrators to update. Counterparts in the US, UK, Australia and the European Union went further, telling organizations to take systems offline if they couldn’t patch right away.
Attackers have moved quickly. Security firm watchTowr says its network of decoy servers has recorded attempts to exploit both flaws, and web security firm Patchstack says it has confirmed several attacks, though it hasn’t published details. Neither flaw had been added to the US government’s list of known exploited vulnerabilities by Wednesday evening. Exploit code is circulating publicly.
Organizations around the world have taken websites offline while they waited for the fix. They included parts of Wikipedia, government portals in the Netherlands, Finland and France, and, in Quebec, the Centre de services scolaire Marie-Victorin.
What is PHP?
PHP builds a web page each time someone visits it, pulling information such as account details or login screens from a database and sending the result to the browser. Danish-Canadian programmer Rasmus Lerdorf created it in 1993. It sits underneath WordPress, Drupal and many hosting platforms. Because the flaws are in PHP itself, a website can be exposed even if its own code is sound.
Read next: CIRO reveals the extent of last summer’s data breach
Where advisors are exposed
Few advisors will ever touch PHP, but many of their websites run on it. WordPress, which runs on PHP, is a common choice for small-business websites, including advisory practices. Client login pages, document upload forms and booking tools attached to those sites could be open to attack if the server underneath hasn’t been updated.
The bigger risk may sit with vendors. Web hosts, CRM add-ons, portal providers and back-office tools often run PHP without saying so. Only versions 8.2 to 8.5 have official fixes, so a provider still on an older release has no simple update to install.
CIRO has already noticed vendor problems rising. In its compliance report for 2026, the regulator says it has seen more incident reports involving third-party service providers. Canadian firms have learned this the hard way before. In 2023, wealth tech provider InvestorCOM and several of its clients were caught up in a breach at a third-party software supplier, Fortra.
Canada has also been through a scramble like this one. When the Log4j flaw emerged in December 2021, Quebec pulled nearly 4,000 government websites offline and the Canada Revenue Agency suspended its online services.
The reporting clocks
For investment dealers, a successful attack starts a regulatory process quickly. Under CIRO’s mandatory reporting rule, IDPC Rule 3703, a dealer must report a cybersecurity incident to the regulator within three days of discovering it. A more detailed investigation report must follow within 30 days. The three-day report is meant to be a preliminary snapshot, so firms can’t wait for the full picture. The rule covers investment dealers. Firms registered only as mutual fund dealers follow CIRO’s separate rulebook, which the regulator is working to merge with the investment dealer rules.
Privacy law adds a second set of duties for every firm. Under the federal breach of security safeguards rules, a breach that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada, and affected individuals must be told, as soon as feasible. Firms must keep a record of every breach, including those that don’t meet the reporting threshold.
In Quebec, Law 25 requires firms to promptly notify the Commission d’accès à l’information and the people affected when an incident presents a risk of serious injury. Firms must also keep a register of every confidentiality incident.
CIRO knows the stakes better than most. The regulator confirmed in January that a phishing attack first disclosed in August 2025 had affected around 750,000 Canadian investors. It also faces a proposed class action over the breach.
Read next: Why CIRO is facing a proposed class action over their data breach now
What firms should do now
The first job is an inventory of every website, portal and vendor that touches client data. Firms should ask each provider in writing whether it runs PHP and whether it has moved to a fixed version. Those written answers will also help show regulators that the firm checked on its vendors.
Any server that was left unpatched on Wednesday should be checked for signs of a break-in, not just updated. Whatever the check finds, the firm should log it in its breach records. If client information was accessed, firms should start their incident response plan, bring in counsel and notify their cyber insurer promptly. For investment dealers, CIRO’s three-day clock starts at discovery, not at the end of the investigation.
Wealth Professional will update this story as it develops.
