Websites around the world, including in Australia, went offline on Wednesday as operators scrambled to address critical vulnerabilities in a widely used programming language.
Developers of the PHP programming language have now released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately".
With tech firms warning that some hackers were already exploiting the flaws, government agencies in Australia were among those across the world that took their sites offline as a precaution.
Industry and Innovation Minister Tim Ayres has said no Australian government websites had been breached and that the takedowns were a preventative measure.
"This is led by the Australian Signals Directorate on behalf of the Australian government and cybersecurity agencies around the world, working with, in this case, OpenAI to identify a weakness in these systems," he said in an interview with News24.
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
The Australian Signals Directorate, the peak intelligence body intercepting cybersecurity threats, said its website had been among domestic government sites affected by an issue with software that powers much of the internet.
The signals directorate confirmed the agency was not aware of active exploitation of the vulnerabilities, but the alert status remained at critical.
At one stage on Thursday morning, the Parliament of Australia site was down, with a message saying it was because intermittent maintenance was being carried out.
Along with government agencies around the world, online encyclopedia Wikipedia said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.
Amazon's security chief also said its security team detected an attempt to exploit the vulnerabilities against one of its decoy "honeypot" systems several days before the vulnerability was publicly disclosed.
The United Nations National Security Agency told organisations to patch immediately or pull vulnerable systems offline.
While a fix for the issue has now been released — and artificial intelligence tools are able to reverse engineer the bug with little effort — experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.
PHP — a language that dates back to the early 1990s and initially stood for Personal Home Page — runs about 70 per cent of the world's websites, web security researcher and consultant Troy Hunt told SBS News.
"So it's a massive portion of the internet," said Hunt, who's also the creator and CEO of Have I Been Pwned — a free website that tracks and indexes online data breaches.
"PHP has been around for a very long time. It's free, it's open source, it's very easy to get started, it's where many people start their web development journeys.
"So it's a very easily accessible, very popular language. And unfortunately, what that means is that if there is a vulnerability, the scope of it is extremely broad.
"PHP sits behind things like WordPress and Drupal. They're massive content management systems. So these are services that many other platforms are then built on, possibly without even knowing the underlying technology.
"There are certainly a lot of sort of mom and pop sort of shops which are built on WordPress because it's a turnkey solution for non-technical people.
"The flaws that have been identified are called remote code execution flaws, which means that an attacker could run their own arbitrary code on the web server.
"Now that means anything from access to the personal data that might be stored there through to being able to modify the content or redirect people to other locations."
However, only sites that run PHP on their own servers are exposed to the vulnerability.
Many large platforms are built on other programming languages or use operators that could install the fix quickly and were able to stay online.
In a blog post late on Wednesday, Amazon security chief CJ Moses said the tech giant's security team detected an attempt to exploit the vulnerabilities against one of its decoy "honeypot" systems on 17 October, four days before public disclosure.
The attempt on the system came from an anonymous internet address, suggesting the activity was conducted by a threat actor, Moses said, adding it was unclear how the actor learned of the flaws while they were under embargo.
Cloud services firm Cloudflare saw millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday.
"In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," Prince said.
Cybersecurity agencies around the world have urged PHP users to update immediately or take websites offline until patches can be applied.
According to cybersecurity companies, the PHP flaw was discovered using artificial intelligence, adding that they subsequently coordinated with one another, the PHP team and OpenAI to better understand the issue.
Wiz, one of the security firms that found the flaws, said in a blog post that the flaws rank "among the most severe vulnerabilities discovered in PHP, and arguably in software history".
The Alphabet-owned cybersecurity company said it discovered the vulnerability with the help of Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.
The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz's post said.
The answer is unclear — it depends, and some sites will come back online after testing is completed.
Home Affairs Minister Tony Burke said some government websites have been taken down as a precaution while work is being conducted to test vulnerabilities.
"Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate," he added.
The signals directorate said: "Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available."
NSW Minister for Customer Service and Digital Government Jihad Dib confirmed some NSW government websites were also impacted.
"We are following advice issued by the Australian Cyber Security Centre and working with national cyber authorities to contain any risks," he said in a statement.
"As a precaution, some NSW government websites have been temporarily taken down while work to apply patches and updates is completed."
Websites are being urged to implement fixes. It could take some time, as PHP is so widely used.
Shaanan Cohney, senior lecturer in the faculty of Engineering and IT at the University of Melbourne, said the recent events "may in previous years have been just another story about another widespread software vulnerability that was responsibly remediated".
"However, today’s incident illustrates how AI is shifting the norms and the defences that once protected us, even when software vulnerabilities were found," he added.
"AI now makes it far too easy for attackers to find a flaw even when only its existence has been announced and not the details.
"Previously, the window between the announcement of a potential vulnerability and the time it took for a security researcher or hacker to find the specific vulnerability was long enough that one could responsibly put out an announcement.
"AI has changed things, and this means that now the world has to rethink how we handle the disclosure process of vulnerabilities."
Lukasz Olejnik, a visiting senior research fellow at King's College London, told the Reuters news agency that AI-assisted hacking campaigns could wreak havoc on unpatched servers.
"The scale is huge, and with AI, exploitation may happen instantly," he said.
Ayres said the attack highlighted that there was "a constant battle on the cybersecurity front and Australian government agencies and Australian private sector firms are constantly engaged in toughening up their cybersecurity".
"Some of your viewers will know that occasionally they get an alert from their company to update their system; that is often because new patches are being installed on their systems to deal with vulnerabilities that have either been identified by the Australian Signals Directorate or private sector cybersecurity operators and artificial intelligence."
While Ayres said the recent incident "demonstrate[s] how important it is to have that under-the-bonnet cooperation with the artificial intelligence frontier models", fellow Labor MP Ed Husic said the incident reinforced the need for stronger regulation to mitigate artificial intelligence risks.
Although the PHP vulnerability was detected by AI systems, Husic said AI companies had a poor track record of responsible management of their systems.
"I also want to make clear, it can't be the case that companies identify these vulnerabilities because they've been doing stuff that they haven't been permitted to do, and they dress it up as a favour," the former industry minister was quoted by the ABC as saying.
He added that, while he wasn't suggesting the PHP vulnerability was caused by any tech company wrongdoing, it was important to "get the balance right" on AI regulation.
It was recently revealed that an OpenAI agent had gained unauthorised access to a Medicare portal in June, but the Australian government wasn't informed until September.
Belinda Barnet, a senior lecturer in media at Swinburne University of Technology, said: "OpenAI, whose own agents discovered the flaw, describe this in effusive terms as one of the most 'impactful security issues in recent memory'."
"Perhaps they are right, but they are not the good guys here. Let's not forget that its agents also hacked into Medicare and the NSW Department of Climate Change, Energy and Water in June ."
In July, Prime Minister Anthony Albanese announced the establishment of an Office of AI to coordinate with government agencies to design and legislate the new standards for artificial intelligence.
With additional reporting by Naveen Razik and the Reuters, Australian Associated Press and Agence France-Presse news agencies.
