Carney’s Website Shutdown Needs a Public Outage Ledger

Taking vulnerable services offline may have been prudent. The accountability failure is that Canadians still do not have a department-by-department receipt for exposure, downtime, patch status, data risk and cost.

Ottawa’s latest digital-government test is not whether officials can issue a careful statement after a cyber scare. It is whether Carney’s government can publish the operational receipts after federal websites and services go dark.

Treasury Board’s Office of the Chief Information Officer said the Government of Canada became aware on October 21 of two critical vulnerabilities in PHP, software widely used to run websites, online services and other products. Under certain conditions, the statement said, the flaws could let a malicious actor run unauthorized commands on affected systems without authentication. That is not a routine maintenance note; it is a serious public-service risk.

The government also said security updates were being applied and that some federal websites could be temporarily unavailable or disrupted while fixes were implemented. It added that there was no indication at that time that Government of Canada systems or information holdings had been compromised. Good. But “no indication” is not the same as a public incident ledger.

The Canadian Centre for Cyber Security’s alert names the two flaws as CVE-2026-109618 and CVE-2026-109619. It says successful exploitation could allow unauthenticated arbitrary-code execution, that internet-facing PHP servers and applications are at heightened risk, and that organizations should identify affected systems and patch immediately. The October 23 update also flags another PHP remote-code-execution issue, CVE-2026-115560, with a narrower configuration risk. That update makes the public accounting more urgent, not less.

Mainstream reporting has already confirmed the visible public impact: some Canadian government websites were taken offline, with Statistics Canada among sites reported down, as governments and organizations raced to patch. If Canadians could see the outage, they deserve to see the ledger behind it.

That ledger should start with basics Ottawa has not put in one public place: which departments and agencies ran exposed PHP systems; which public services were unavailable; when each outage began and ended; whether any authentication, benefits, tax, immigration, health, procurement or statistics services were affected; which third-party products bundled vulnerable PHP; when each patch was completed; what logs were reviewed; whether any personal information was at risk; and what the response cost taxpayers.

This is not an argument against caution. Pulling an exposed system offline can be the responsible decision. But responsible government does not stop at a press line. After ArriveCAN, Phoenix and years of federal IT failure, Canadians are entitled to more than “trust us” from the same Ottawa machine asking them to move more of their lives online.

Carney’s government should publish the outage ledger now: exposure, downtime, data risk, patch status, vendor responsibility and cost. Cybersecurity requires secrecy about exploitable details. Accountability requires public receipts about decisions, impacts and performance.