The Weekly Brief — Issue 17

Government of Canada website outage notice during the PHP2Shell response, October 21, 2026. Credit: Government of Canada / Wikimedia Commons, public domain.

Canada spent part of last week responding to critical vulnerabilities in software that sits underneath a large share of the web. Ottawa took some federal websites offline as a precaution while security updates were installed.

What makes PHP2Shell especially worth understanding is how researchers got there. AI helped skilled security researchers turn difficult software weaknesses into working exploits faster — a sign that AI is changing the speed of cybersecurity research itself.

Plus: Toronto-based Celestica is riding surging demand for AI infrastructure, Québec has put artificial intelligence directly into a cabinet title, and Microsoft's new voluntary exit offer includes eligible employees in Canada.

Here is the week.

What happened

Critical vulnerabilities in PHP were independently uncovered through security research by Calif, OpenAI and Wiz. PHP is widely used to run websites and online services.

The two flaws, publicly disclosed October 21 and known collectively as PHP2Shell, can let an unauthenticated attacker execute code on an affected server. PHP released emergency security updates, and the Canadian Centre for Cyber Security urged organizations to patch immediately.

Ottawa took some federal websites offline as a precaution, including Statistics Canada's and the Canadian Intellectual Property Office's. Newfoundland and Labrador and Prince Edward Island also took provincial websites or services offline while assessing and patching systems.

In an October 22 Government of Canada statement, Ottawa said there was no indication federal systems or information holdings had been compromised.

Exploitation has since moved beyond theory. Cloudflare reported exploit attempts reaching into the millions after the flaws became public, while Amazon found an exploitation attempt dating to October 17, four days before public disclosure.

On October 24, a researcher recorded attackers successfully running commands on deliberately vulnerable honeypot servers — decoy systems used to observe attacks. That shows the flaws are being exploited in practice. It does not establish that Canadian government systems were compromised.

A third, more narrowly exploitable PHP vulnerability disclosed October 23 is not fixed by the October 21 releases. PHP has recommended an interim configuration change while a full fix is prepared.

Why it matters

Calif researcher Ryan Austin found multiple paths to remote code execution beginning August 1 while participating in OpenAI's Patch the Planet initiative. The PHP Foundation says OpenAI independently reported the same underlying problem on August 11. Wiz later independently reported related vulnerabilities and exploit paths.

OpenAI says Calif used GPT-5.6 Sol in the work. Wiz says its researchers also used advanced AI systems.

The PHP Foundation says the underlying problem had already surfaced during a 2024 security audit, but no concrete exploitation path had been established and work on a fix stalled. The 2026 research demonstrated practical paths to remote code execution.

That distinction matters.

AI did not replace security expertise. Calif says Austin deliberately focused on a target he already understood and used its vulnerability history to steer the work. As Calif puts it, no model can yet find every bug from a few basic prompts.

The important shift is not that AI invented a new kind of cyberattack. It is that AI can shorten the time between a hidden flaw, a working exploit and the need to respond.

Your move

If you run a website or manage one at work, confirm that your host or administrator has applied the October 21 PHP security updates.

Also ask whether they have reviewed PHP's October 23 guidance for the additional vulnerability and its recommended interim mitigation.

If you do not manage web infrastructure, there is no reason to start changing settings on your own devices.

Toronto-based Celestica reported US$5.83 billion in third-quarter revenue, up 83 per cent from a year earlier. Revenue from its Connectivity & Cloud Solutions segment reached US$4.87 billion, up 102 per cent.

The company raised its 2026 revenue outlook to US$21 billion and issued initial guidance of US$40 billion for 2027. Celestica says it is supporting hyperscalers and frontier AI labs through what the company calls an AI-infrastructure “supercycle.”

That US$40-billion figure is a forecast, not revenue the company has already earned.

Why it matters: Celestica shows another side of the AI boom: a major Canadian company selling networking and computing infrastructure into the global buildout.

Québec's new Parti Québécois government, sworn in October 21, named Anne Nguyen ministre déléguée à l’Intelligence artificielle et au Numérique — a cabinet role covering artificial intelligence and digital affairs.

The previous CAQ government's relevant portfolio was Cybersecurity and Digital. The new government now explicitly names artificial intelligence in Nguyen's title.

That does not mean Québec has automatically created a new AI law, budget or strategy.

Why it matters: Québec is one of Canada's major AI research and commercialization centres. Giving AI an identifiable minister creates a clearer point of political accountability. The next question is what authority, priorities and policies will sit underneath the role.

Microsoft has introduced a voluntary exit program for eligible employees in participating teams in Canada, India, the United Kingdom and the United States.

Microsoft told GeekWire that about 60,000 employees worldwide are eligible. The company's public announcement did not provide that number.

Eligible employees can leave with financial support and career-planning resources. Not every Microsoft organization is participating, and the company has not disclosed how many Canadian employees qualify. GeekWire reports that employees have until the first week of December to decide. Microsoft has not linked the program to its AI spending.

Why it matters: AI's effect on work won't always arrive labelled as “AI job losses.” Microsoft's program is another reason to watch workforce decisions alongside the AI spending cycle.

A website runs instructions on a server — a computer that processes requests and sends information back to you.

Remote code execution, or RCE, means a vulnerability may let someone make that server execute commands of their choosing from somewhere else on the internet.

Think of ordering from a restaurant menu versus getting into the kitchen and telling the staff what to do.

Depending on the system, that could mean stealing information, changing files or disrupting services.

An unauthenticated RCE is especially serious because an attacker may not need a legitimate account first.

A vulnerability is not the same thing as a successful attack. But once a practical exploit exists, the time available to patch matters.

If you have a business, organization, side project or personal website, find out who is responsible for keeping its software updated.

It may be you, your web host, an IT team or someone who built the site.

If nobody knows, that is useful to discover before the next urgent vulnerability arrives.

A calm, practical briefing on the AI developments that matter in Canada—delivered every Tuesday.

That's the week. See you next Tuesday.

— Padge T.

AI Brief Canada is an editorially independent publication published by Groundshift Advisory Inc. and written by Padge T.

Groundshift Advisory helps Canadian organizations adopt AI responsibly. Sponsored, affiliated, or commercially connected content will always be clearly disclosed.

Issue disclosure: Nothing in this issue is sponsored, affiliated, paid, or commercially connected.

AI use: AI tools supported research, source discovery, outlining and drafting for this issue. All material was reviewed, edited and fact-checked by Padge T. before publication. Read our AI Use Disclosure.

Not affiliated with the Government of Canada.

Corrections or feedback: We welcome corrections and reader feedback. Email [email protected] or review our Editorial Policy.