This week, the Government of Canada took some of its own websites offline on purpose.
On Wednesday, the Canadian Centre for Cyber Security issued a critical alert for two vulnerabilities in PHP, the software behind an estimated 70% of the world's websites. Under certain conditions, an attacker could run commands on an affected server without logging in. Some federal sites went offline as a precaution (opens in a new tab) while patches were applied.
Here's the AI part. The flaws had been sitting in PHP's code for more than a decade. Researchers at Calif and OpenAI used frontier AI models to find them (opens in a new tab), and researchers at Wiz identified both flaws independently.
That cuts both ways. The tools that help defenders find old flaws also help attackers turn them into working attacks faster. The time between "a fix is available" and "someone is using this against you" is getting shorter.
For health organizations, the useful questions this week aren't really about AI.
Taking a site offline for a day is inconvenient. Ottawa decided that was a better trade than leaving it exposed. Every organization should know in advance who makes that call.
What this means for health organizations
Most health organizations rely on websites, portals and vendor-hosted systems they didn't build. When a critical alert lands, the response depends on knowing what those systems run on and who is responsible for checking.
Keep a simple inventory of public-facing systems and the vendors behind them, and agree ahead of time who can decide to take something offline.
