Major government websites in Australia impacted by AI-detected flaw

A number of government websites across the world, including some in Australia, have temporarily gone down after vulnerabilities in a widely used programming language used on millions of websites were uncovered.

Australia’s own cybersecurity agency was among the websites impacted after critical flaws were found within the PHP programming language, with the Australian Cyber Security Website being unavailable to users on the internet on Thursday.

The FBI’s cyber division warned the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications.

That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.

The Australian Signals Directorate (ASD) said it was aware of the flaw and that some government websites were impacted as organisations worked to find a fix.

“We are aware of an outage that may be affecting Government websites, including https://cyber.gov.au,” the ASD said on X on Wednesday.

“The Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.”

Previously, ASD posted another warning: “We are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards.

“Organisations and individuals should monitor PHP applications and prepare to update and apply patches.”

Nine.com.au was unable to access the full alert released by the ASD, as its website is currently down.

Home Affairs Minister Tony Burke confirmed work was being taken to ensure government websites were not exposed to any potential flaws.

“The National Office of Cyber Security is aware of disruptions to several Australian websites on the evening of 21 October, including some Australian government departments and agencies,” Burke told nine.com.au.

“On 21 October, a critical vulnerability alert was issued by the ACSC regarding vulnerabilities in PHP core, a widely-used web content scripting engine.

“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability.”

He added websites using PHP within their online platforms should follow the advice from the ASD.

NSW Minister for Customer Service and Digital Government Jihad Dib confirmed some NSW government websites were also impacted.

“We are following advice issued by the Australian Cyber Security Centre and working with national cyber authorities to contain any risks,” he said in a statement.

“As a precaution, some NSW government websites have been temporarily taken down while work to apply patches and updates is completed.”

It is not known exactly how many Australian government websites have been impacted, but the potential vulnerabilities in PHP could be critical to the world if they are exposed, a cybersecurity company warned.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.

“When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.”

“The potential impact is enormous,” Ismael Valenzuela – vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf – said, adding that PHP powers roughly 70 per cent of websites where the server-side programming language is known.

The exposed vulnerabilities, Valenzuela added, put a “significant portion of the internet’s business and commercial infrastructure at potential risk,” and while it doesn’t mean all websites are vulnerable, the flaws demand “immediate attention”.

The PHP Foundation, which includes developers who work on securing the programming language, said it had released fixes for the vulnerabilities, along with instructions on how to update systems.

Artificial intelligence agents helped uncover the vulnerabilities.

In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.

“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” the company said.

- Reported with Associated Press