Australian Government cybersecurity website caught up in security breach tied to PHP programming

The Australian Government’s own cybersecurity website has been caught in a security flaw involving an internet programming language affecting 70 per cent of the internet that hackers can exploit.

The Australian Signals Directorate’s X page on Wednesday night announced “critical vulnerabilities” with PHP, a personal home page internet language designed during the early days of the worldwide web in 1993.

The security flaws affect versions of PHP5 onwards, with the Commonwealth’s cyber intelligence agency’s own cyber.gov.au website among those caught up.

“Patches are now available for two critical PHP vulnerabilities. If your organisation uses PHP, we recommend identifying affected systems, reviewing official PHP guidance and applying appropriate mitigations as soon as possible,” the ASD said.

The PHP Foundation, that develops personal home page language for websites, late on Wednesday night released updates for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

“These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now,” it said.

The NSW Government on Thursday morning took down some websites temporarily as a precaution with the Minister for Customer Service and Digital Government, Jihad Dib, confirming it was working with the Australian Cyber Security Centre and national cyber authorities to contain any risks with the PHP scripting language.

“As a precaution, some NSW Government websites have been temporarily taken down while work to apply patches and updates is completed,” he said.

More to come