A raft of Australian government websites were thrown into dysfunction and temporarily taken offline on Thursday as a precaution after security agencies issued a global alarm over a programming vulnerability affecting 70 per cent of the internet.
The nation’s peak intelligence and cybersecurity agency, the Australian Signals Directorate, was affected, while websites for other authorities including the Australian Taxation Office, the Health Department and the Australian Communications and Media Authority also appeared to be limited to varying degrees. These websites have since been restored.
Various other sites, including the Magistrates Court of Victoria and Coroner’s Court websites remain inactive. The main Save the Children site is also down, but a separate link to donate to support MP Helen Haines is active and accepting donations.
The vulnerability in the PHP programming language was detected by an OpenAI team conducting research, with governments and businesses across the world scrambling to take down their websites to protect from potential breaches as they wait for a patch for the security flaw to become available.
A spokesman for Cybersecurity Minister Tony Burke said the National Office of Cyber Security became aware of disruptions to government websites on Wednesday evening, and that a critical vulnerability alert was issued over the PHP vulnerability.
“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,” the spokesman said.
“Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate and monitor and review PHP official guidance, and apply security patches as they become available,” the spokesman said.
Several government websites in Europe and Asia also went offline as a precaution after a disclosure of two critical vulnerabilities in a widely used programming language sent website operators globally scrambling to protect their systems.
PHP is a programming language used to run websites and powers millions of sites that depend on popular application such as WordPress.
When a visitor loads a page, a server running PHP assembles the content and sends it to the browser.
Alphabet-owned cybersecurity company Wiz said in a report that it had discovered the vulnerabilities with the help of several artificial intelligence tools. It said it had collaborated with OpenAI and the cybersecurity firm Calif on the work. Wiz’s report estimated that the PHP vulnerability affected around 70 per cent of the internet and had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said.
Developers of the PHP programming language released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years.
“The potential impact is enormous,” said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, adding that PHP powers roughly 70 per cent of websites where the server-side programming language is known.
With reports that hackers were exploiting the flaws to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution. French government website were also placed into preventative maintenance.
The Dutch prime minister said he was closely monitoring the situation and Japanese Prime Minister Sanae Takaichi also urged website owners to use a new fix.
In a statement, the White House said it was made aware of the flaw on Friday.
“This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security.”
Don Smith, vice president of threat intelligence at the firm Sophos Cybersecurity, said “the immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running”.
“The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” Smith said.
Swinburne University associate professor Dimitrios Salampasis said “what makes this incident particularly significant is the role of artificial intelligence in identifying these vulnerabilities, highlighting how AI is accelerating both the discovery of security weaknesses and potentially their exploitation by cybercriminals”.
“This creates an increasingly challenging environment where organisations may have less time to respond before attackers strike,” Salampasis said.
AI agents have been blamed for a host of high-profile security incidents in recent months. The episodes have highlighted the vulnerabilities in AI security and raised questions over how the fast-growing technology can be developed safely as its usage becomes more widespread globally. But experts also pointed out that AI could also help with discovering cyber vulnerabilities, as it did in the PHP case.
“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” said Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organisations can’t immediately patch every affected system,” he added.
“The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem.”
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning .
You have reached your maximum number of saved items.
Remove items from your saved list to add more.
You've used all of your gift articles. 3 more will become available on the 1st of every month.
