What is PHP, and how did a flaw in its code lead several websites to go dark this week?

Flaw in PHP existed for years before it was found and a fix was created Abby Hughes · CBC News · Posted: Oct 22, 2026 PM EDT | Last Updated: 6 hours ago Play article Estimated 7 minutes The audio version of this article is generated by AI-based technology. We are working with our partners to continually review and improve the results. PHP is an open-source computer language that's widely used across the internet. (Dado Ruvic/Reuters) A vulnerability in a critical piece of the internet's infrastructure was exposed this week, sending website operators worldwide scrambling to implement a fix. The problem resided in part of the PHP coding language — a commonly used software that's "the backbone of the internet," according to Isaac Privett, a senior penetration tester at Toronto-based cybersecurity firm Packetlabs. And the vulnerability had been there for years, potentially allowing bad actors to access sites, make changes to them and harvest data. Canadian government sites among those offline after flaw identified in widely used computer language The issue prompted many to take their websites offline while they implemented a fix, causing some websites — including government ones in Canada — to go dark. Here's what you need to know about the PHP language, how it came to light and how serious the vulnerability is. PHP is an open-source computer language — meaning anyone can download and use it for free — that's widely used across the internet. The tech is managed -profit PHP Foundation, with a team of volunteer board members and a handful of developers.  When you visit a website, a lot of pieces of information, such as images, links and what colour a site should appear in, all need to be assembled and displayed correctly to end users, explains technology analyst Carmi Levy. That's the job PHP does, Levy says, pulling those elements together and bringing websites to life. "PHP is silently working in the background to make sure that websites make it from disjointed data sitting on a server somewhere to a live website that you can interact with on the browser, on the device that is sitting in front of you," said Levy, who's based in London, Ont. Wiz, one of the cybersecurity firms that helped identify the issue, estimates that about 70 per cent of websites are powered by PHP, while web technology tracker W3Techs puts the figure at 75 per cent. A programmer works with PHP code at RK Solutions software development company in Guernica, Spain, on Thursday. (Vincent West/Reuters) That widespread use makes the tech a "foundational" piece of technology for the internet to function, Levy said, and that's why a vulnerability with it can have potentially wide-reaching consequences.