ICANN PHP Vulnerability Prompts Site Restorations and DNSSEC Automation Consultation

ICANN restored three websites on October 22, 2026, after applying patches for two critical PHP vulnerabilities disclosed the previous day. The organization took the sites offline on October 21 as a precaution following the release of CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS v4.0 score of 9.2.

ICANN PHP Vulnerability Response and Site Recovery

The affected properties included the GNSO website at gnso.icann.org, the New gTLD Program: 2026 Round site, and the New gTLD Program: 2012 Round site. Two other systems supporting the New gTLD Program, APS and TAMS, remained online because they do not rely on PHP. ICANN applied the PHP Foundation patch released on October 21, conducted testing, and returned the sites to service the next day without reported exploitation or data impact.

The vulnerabilities affect PHP versions from 5.4 onward. Industry estimates place PHP usage at roughly 70 percent of websites worldwide. In response to the disclosure, governments, Wikimedia, the Internet Archive, and multiple European organizations took precautionary measures. Cloudflare recorded millions of exploit attempts in the hours after the flaws became public. ICANN stated it observed no signs of compromise on its own infrastructure before or after the brief outage.

ICANN continues to monitor patching activity across its remaining PHP deployments and participates in broader industry efforts to track residual risk. The episode highlights the operational scale of PHP-dependent systems within critical domain infrastructure and the speed required for coordinated responses to high-severity library vulnerabilities.

DNSSEC DS Automation Consultation Details

Separately, ICANN opened a public comment period on October 12 and 13, 2026, seeking input on a Security and Stability Assessment of DNSSEC DS record automation prepared by Interisle Consulting Group. The consultation closes on November 23, 2026. The assessment examines risks associated with a proposed Fast-Track Registry Services Evaluation Process for automating delegation signer records that link child zones to parent trust chains.

The document references RFCs 7344, 8078, 9615, 9975, and 10026. It sets out seven hard requirements and seven disclosure items that registries would need to satisfy for safe implementation. The review follows the ICANN Board’s adoption of SSAC recommendation SAC126 in September 2025. ICANN will compile comments, publish a summary report around December 7, 2026, and address any necessary contract language changes in a subsequent proceeding. No registry approvals or automated deployments have been authorized at this stage.

Automation of DS records aims to reduce manual operational burdens that have slowed wider DNSSEC adoption. The current consultation focuses strictly on security and stability questions rather than on deployment timelines or specific registry implementations.

Market Context and Next Steps

The PHP incident and the DNSSEC consultation both touch core elements of domain name system reliability. ICANN’s handling of the vulnerabilities demonstrates the organization’s incident response procedures for widely used open-source components. The DNSSEC review represents an incremental step toward reducing friction in securing delegation data, provided the identified requirements can be met.

Stakeholders can submit feedback on the DNSSEC assessment through the ICANN public comment portal until November 23. Global PHP patching efforts remain ongoing, and ICANN will issue further updates if additional measures prove necessary for its infrastructure.