10/21/2026 | Press release | Distributed by Public on 10/21/2026 04:22
The Internet Corporation for Assigned Names and Numbers (ICANN) responded to a recently disclosed vulnerability in PHP affecting the underlying software that powers many websites.
There is no indication that any of ICANN's systems have been negatively affected. This includes the New gTLD Program Application Publication and Statistics (APS) website and the TLD Application Management System (TAMS), which are not based on PHP and remain available. In the interim, the Applicant Guidebook for the New gTLD Program: 2026 Round can be accessed via the ICANN.org homepage at https://itp.cdn.icann.org/en/files/new-generic-top-level-domain-gtld-program/new-gtld-program-2026-round-applicant-guidebook-current-en-07-10-2026-en.pdf.
Out of an abundance of caution, three ICANN administrative sites that run on PHP software have been temporarily disabled, including the Generic Names Supporting Organization (GNSO) website, (https://gnso.icann.org/en), the New gTLD Program: 2026 Round website (https://newgtldprogram.icann.org/en/application-rounds/round2, and New gTLD Program: 2012 Round website (https://newgtlds.icann.org/en).
Emergency patches from the PHP Foundation are expected soon, and will be implemented upon availability. The ICANN sites will be restored once the necessary security measures have been implemented.