ICANN reopened three PHP sites while application systems kept running

ICANN Quarantined Three Websites. The Application Desk Kept Working

Why it matters

A PHP vulnerability shut the public doors of three ICANN sites. A tested patch reopened them on 22 October; the separate systems handling new-gTLD applications carried on through the interruption.

Daniel Kade24 October 2026 at 10:45 UTCReading Time 2 minLast update: 24 October 2026

Three public sites closed; the application counter kept working. Original conceptual illustration.

Summary

ICANN took its GNSO website and two New gTLD Program sites offline after a PHP vulnerability was disclosed, then restored all three after applying and testing a patch.
The 2026-round application systems stayed open. ICANN also kept the Applicant Guidebook reachable through its main website.

Three websites went into quarantine. The application desk kept taking calls. That is the useful split in ICANN's account of its October PHP response.

On 21 October, ICANN switched off the Generic Names Supporting Organization website and the New gTLD Program sites for the 2026 and 2012 rounds. All three ran on PHP, the software at the centre of a newly disclosed vulnerability. ICANN made the shutdown as a precaution. A day later, it said it had applied and tested the PHP Foundation's patch and put the three sites back online. The ICANN notice names the sites and the sequence.

For a 2026-round applicant, the distinction between a programme website and the application machinery is more than web architecture. ICANN said the Application Publication and Statistics site and the TLD Application Management System used different software and remained available. It also pointed readers to a copy of the Applicant Guidebook on ICANN.org. The public information route narrowed; the application route continued. ICANN reported no indication that its systems had been negatively affected.

The PHP project's security archive records the upstream vulnerabilities and fixed releases. ICANN's update supplies the operational claim: patch applied, patch tested, three sites restored. It omits the versions running on those sites and the categories of tests used before reopening. Those are the two details that would sharpen a later assessment of the recovery.

This is a small outage with a large institutional lesson. A site can carry the flag of a programme without carrying its transaction system. ICANN's own service boundary kept applicant operations moving while the public-facing pages were isolated. The patch reopened the doors; the separate application stack had kept the office open.