Australian government websites have been taken offline following the discovery of two critical security vulnerabilities in PHP, a widely used programming language that supports millions of websites globally.
The Australian Signals Directorate (ASD) confirmed that several government websites, including its own cybersecurity portal, cyber.gov.au, experienced disruptions as organisations moved to protect their systems from potential attacks.
The vulnerabilities, discovered with the assistance of artificial intelligence (AI), have prompted urgent security warnings from cybersecurity agencies worldwide.
PHP is used extensively across the internet, supporting popular content management systems including WordPress, Drupal and Joomla. According to web technology tracker W3Techs, PHP powers approximately 75% of websites with an identifiable server-side programming language.
The vulnerabilities could allow attackers to remotely execute malicious code on affected servers, potentially gaining unauthorised access to systems and sensitive information.
Australia’s Cyber Security Centre issued a critical alert on 21 October, advising organisations to identify PHP installations within their environments, review official security guidance and apply patches as soon as possible.
The incident also affected government websites internationally, with agencies in several European countries temporarily suspending online services while security updates were implemented.
In Australia, the NSW Government confirmed that some of its websites had been temporarily taken offline as a precaution while Cyber Security NSW worked with departments and agencies to apply the necessary updates.
The NSW Government said no state government agencies had reported information breaches to Cyber Security NSW at the time of its 22 October announcement.
Security fixes have since been released, with website operators urged to install the latest updates and monitor their systems for suspicious activity.
The incident has also raised concerns about the growing role of AI in cybersecurity. While AI-assisted research helped identify the vulnerabilities, experts have warned that similar technology could accelerate attempts by cybercriminals to identify and exploit weaknesses.
For Australian businesses, the incident highlights the importance of understanding which technologies support their websites and applications, particularly where systems are managed by external hosting providers or technology partners.
Organisations using PHP have been advised to review their exposure, prioritise internet-facing systems and ensure vulnerable software is updated promptly.
