The Société de transport de Montréal (STM) shut down its website Wednesday amid a worldwide security breach affecting multiple websites. “The stm.info website was shut down as a precautionary measure shortly before noon on Oct. 21, in the wake of a security breach that is putting a large number of websites around the world at risk,” an STM spokesperson told CTV News. “This involves a critical vulnerability in the PHP framework, which is used by many websites.” The STM said it is now directing users to a new version of its website that is under development and is not affected by the security breach. “Although not all pages have yet been migrated to this new version of the STM website, this alternative still allows customers to check service status and plan their routes,” the STM said. The paratransit booking platform and the shared taxi booking site also remain operational. Customers are encouraged to use the Chrono and Transit apps to get travel information and to check network status via the STM’s X accounts or the “My Alerts” service. SAQ website offline The Société des alcools du Québec (SAQ) website was also down on Wednesday. “Sorry, the site is temporarily off-line. We apologize for any inconvenience that this may cause,” reads a message when visiting saq.com. “As a precautionary measure, we have shut down our website due to the situation unfolding worldwide. No security breaches have been detected in our systems,” a spokesperson told CTV News in an email. Minister of AI responds Minister of Artificial Intelligence and Digital Innovation Evan Solomon confirmed on social media that some Government of Canada websites have been temporarily taken offline as a precaution to protect government systems and Canadians’ information. “This is in response to a vulnerability identified in PHP, software used by websites around the world. This is a global issue, and other governments and organizations are also taking protective measures,” Solomon wrote. “We take this situation extremely seriously. Thank you to the cybersecurity teams working to protect the services Canadians rely on.” The Canadian Centre for Cyber Security issued an alert on Wednesday about the vulnerabilities affecting PHP technology and urged organizations to apply the appropriate updates immediately. “The PHP Security Team has released security updates addressing these vulnerabilities. Organizations should identify affected systems and apply the appropriate updates immediately,” the alert reads. “PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide.” With files from CTV News’ Joe Lofaro
