PHP ‘critical vulnerabilities’ disrupt Australian cyber agency, Home Affairs Minister says he’s aware
Sites across the world have been disrupted by ‘critical vulnerabilities’ in the code that keeps them running, including Australia’s lead cyber security agency.
Australia’s lead cyber security agency is among government websites across the world disrupted by two “critical vulnerabilities” in background programming code that powers swathes of the web.
On Wednesday afternoon, the Australian Signals Directorate flagged issues “in PHP that may affect all versions from PHP 5 onwards”.
“Organisations and individuals should monitor PHP applications and prepare to update and apply patches,” it posted on social media.
Sign up to The Nightly's newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.The agency invited people to read the full alert on the Australian Cyber Security Centre’s website, but as of Thursday morning the site – which is powered by PHP – displayed an error notice.
A spokesperson for Home Affairs Minister Tony Burke told NewsWire authorities were “aware of disruptions”.
“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,” the spokesperson said.
“Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate and monitor and review PHP official guidance, and apply security patches as they become available.”
PHP powers up to 70 per cent of websites worldwide, including website builder WordPress.
In a statement, the PHP Foundation said “all PHP installations serving web requests” were at risk.
It warned hackers could commandeer internet servers if they exploited the vulnerabilities and urged all clients to update to a new version with fixes.
If updating was not possible, it advised organisations to take their systems offline.
AI uncovered threat
The vulnerabilities were uncovered by a collective led by OpenAI – the artificial intelligence firm whose rogue AI agent hacked a Medicare statistics portal earlier this year.
The company said AI found the issues.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said.
“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.
“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure.”
Cloud and AI cybersecurity firm Wiz – which partners with OpenAI – said the “underlying flaws had been present for decades” but showing “their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”.
“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” Wiz said.
More to come...
Originally published as PHP ‘critical vulnerabilities’ disrupt Australian cyber agency
