Summary

  • Three PHP-backed ICANN websites were temporarily disabled after PHP disclosed two critical remote-code-execution flaws.
  • The new-gTLD application and publication systems remained available because they did not run on PHP; the three sites returned after a tested patch.

ICANN’s response drew a bright line across its own web estate: three sites went dark, while the systems moving new generic top-level domain applications and publishing their results stayed online. The difference was the software underneath them.

The PHP project’s 21 October security advisory described two critical flaws that could permit remote code execution without authentication. One involved out-of-memory handling during request cleanup; the other involved stale request-owned state being used after its backing memory had been freed. The project listed fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

ICANN said it temporarily disabled the Generic Names Supporting Organization website and the websites for the 2026 and 2012 New gTLD Program rounds because they ran on PHP. It said there was no indication that any ICANN system had been negatively affected. The Application Publication and Statistics site (APS) and TLD Application Management System (TAMS) remained available because they were not based on PHP.

That distinction mattered to applicants. The 2026 round’s Applicant Guidebook remained accessible through ICANN.org while the round website was offline. On 22 October, ICANN reported that it had applied and tested the PHP Foundation patch, then restored all three sites.

This was a short outage with a visible containment boundary. The public-facing sites shared a vulnerable runtime; the application and publication systems did not. A temporary alternate route kept the program’s core reference document reachable. The sequence is operationally useful because it shows where a software dependency stopped: at a set of public websites, rather than across every service associated with the program.

ICANN’s notice does not name the PHP versions on those three sites. The published account is still enough to see the division of service: sites were isolated, the core application systems remained available, and restoration followed a tested patch.

Sources: ICANN’s response and restoration update; PHP project security advisory.