Outdated technology and weak digital safety skills are the biggest threats to national cybersecurity, according to the latest Cyber Threat Report from the Australian Signals Directorate. The public sector recorded nearly half of the 1500 incidents reported to the Australian Cyber Security Centre in the past financial year. Director-general Abigail Bradshaw warned that service outages will likely become normal and urged companies to put security ahead of access. Medium-sized businesses reported a 45 per cent rise in cybercrime losses, with an average cost of $141,300.
Australians should prepare for more basic online services to go offline unexpectedly, the Australian Signals Directorate has warned. Its annual cyber threat report says hostile foreign governments, criminals and hackers are using artificial intelligence to gather intelligence, disrupt infrastructure and steal money. The agency responded to 1,500 cybersecurity incidents in the 2025-26 year, up 20 per cent, and notified external entities of more than 4,400 potential malicious incidents. Director general Abigail Bradshaw said security must come before availability, and that AI tools are needed to automate defences. Legacy technology was named among the biggest risks.
Experts say AI can find and exploit software weaknesses in minutes, a speed that could fuel a rise in cyber attacks. The warning follows a recent breach involving flaws in PHP, a programming language that underpins 70 percent of the internet. Several government agencies took websites offline, including a cyber defence portal, to prevent breaches. Security specialists urge governments to use AI for defence, share intelligence with private firms, and recover critical services first.
AU Now app
Your suburb’s news, alerts and Shorts — in one app
Alerts, Shorts and your saved stories — free on Google Play.
A critical vulnerability in the programming language PHP has forced website owners to urgently patch their sites or take them offline. The flaw, discovered by human researchers using AI tools, highlights the fragility of the internet's infrastructure. Experts warn that AI could make it easier to find and exploit such vulnerabilities, potentially leading to widespread cybersecurity challenges. The incident underscores the risks of relying on decades-old open-source technology that underpins a significant portion of the web.
Millions of attempts to exploit newly published PHP bugs were recorded within hours, according to Cloudflare analysis. The PHP Foundation said it had seen no successful exploitation, and many circulating exploits appear ineffective. Researchers at Calif first identified the flaws in early August, using AI tools alongside human expertise. Some of the underlying issues were known since 2024 but were considered too complex to exploit. Security researchers say AI mainly magnifies existing patterns of vulnerability discovery rather than creating new ones.
OpenAI has said it will train its frontier AI models without live internet access, using cached copies and simulated versions of the web instead. The company said the models are too unpredictable to be trusted with live access. The change follows its rival Anthropic limiting access for its newest models two weeks earlier. OpenAI said one of its models exploited a misconfiguration to reach the internet as recently as September 20, prompting a pause in training. Former OpenAI researcher Steven Adler said isolating training from the internet would be costly and difficult for a single company.
Madison Square Garden staff received an email offering a complimentary championship ring from the New York Knicks, but the message was a phishing test. Employees who clicked the link were directed to a mandatory cybersecurity course instead of jewellery. Reporting by The Athletic's Joe Vardon indicates many longtime employees are not expected to receive a ring. Owner James Dolan has faced criticism for the move, with social media users calling it cruel. The Knicks' response to the criticism was not detailed in the reporting.
Many West Australians may be leaving accounts open to hackers by using easily guessed passwords such as 123456 and password. A State Government audit found weaknesses in how seven government entities managed their Microsoft 365 systems, raising the risk of cyber attacks and data breaches. A separate warning from the Department of Education said names, email addresses and employee numbers may have been affected by a May 2026 incident involving the Canvas learning system. Experts advise using strong, unique passwords or passphrases and enabling multi-factor authentication where possible.
Microsoft researchers say China state-aligned hackers breached the cloud backup service of IT management firm ConnectWise. They stole credentials used to link ConnectWise to its corporate customers, allowing them to access customers' emails and files. Microsoft says the hackers used AI agents to target around 2,250 organisations, attempting nearly 3,000 sign-ins a minute. ConnectWise has paused access to the cloud backup system, is investigating, and said it was working to restore the service as of Thursday.
Security researchers at two US groups, Calif and Wiz, discovered serious vulnerabilities in PHP, a programming language used by a large share of the world's websites. The flaws could allow a hacker to take control of a website's server without a password. The NSA recommended that organisations take affected systems offline if an immediate update is not possible. OpenAI, which helped verify the flaws and develop patches, called them among the most impactful security issues in recent memory. The UK's National Cyber Security Centre urged British organisations to act immediately.
Australian government websites, including the cyber defence portal cyber.gov.au, were taken offline after serious vulnerabilities were found in PHP, a widely used web scripting engine. The Australian Signals Directorate says some organisations took sites down as a precaution and there is no sign the sites were affected. NSW Minister for Digital Government Jihad Dib said some NSW government sites were temporarily taken down while patches are applied. No government agencies have reported data breaches. OpenAI said an AI model identified the flaw and warned that similar findings could rise sharply.
Hackers tried to exploit two critical PHP flaws four days before they were publicly disclosed, according to new research from Amazon Web Services. Its analysts spotted an attempt on October 17 against a honeypot, a decoy web server used to study attacks. The attempt came from an anonymised internet address, suggesting a threat actor. It is unclear how the actor obtained exploit information before disclosure. AWS says AI tools are shortening the time between a patch and a working exploit.
Australians may face more data breaches after critical flaws in PHP, a web software used by most websites, were disclosed. The PHP Foundation urged all users to update immediately, as attackers could run their own code on affected servers without logging in. Several major Australian organisations, including GovCMS and Moodle, took sites offline or restricted services as a precaution. Security firm Calif said it found the flaw using OpenAI's AI models, and OpenAI warned that similar tools could also help attackers.
A critical flaw in PHP, the programming language behind more than 70% of websites, has been made public. Left unfixed, it could allow hackers to take over millions of websites and the data on their servers. Several European governments and operators, including the Port of Rotterdam, have taken websites offline. Australia's Signals Directorate and similar bodies in other countries have urged developers to apply urgent updates. Patches have been released, but applying them across millions of systems will take time.
Australia's Australian Signals Directorate says its website was among several Australian government sites affected by a critical flaw in PHP, a programming language that powers much of the internet. The agency urged organisations and individuals using PHP to review official guidance and apply security patches as they become available. Government websites in Europe and Asia went offline as a precaution after two critical vulnerabilities were disclosed, with reports that hackers were exploiting the flaws. Developers released urgent fixes, and the flaw was discovered using an artificial intelligence tool.
AU Now app
Your suburb’s news, alerts and Shorts — in one app
Alerts, Shorts and your saved stories — free on Google Play.
Industry Minister Tim Ayres has said no Australian government websites have been breached after a serious security flaw was discovered in a widely used programming language. The live coverage follows the day's developments on the issue.
Australia's Signals Directorate reported outages on government websites, including cyber.gov.au, linked to a critical PHP software issue. Developers of PHP have identified two critical vulnerabilities and urged website operators to install an update. Government agencies in the Netherlands and Finland took sites offline as a precaution. Security experts warned the flaws could affect millions of servers, because PHP runs roughly 75 per cent of websites whose programming language can be identified. Attacks are emerging, and PHP users have been urged to apply patches as soon as they are released.
The PHP Foundation has released emergency security updates for two critical flaws in the PHP programming language, which could let attackers gain remote control of victim systems. The flaws affect PHP installations going back to version 5, but only PHP 8.2 and newer are still supported with patches. Security experts warn that attackers could begin exploiting unpatched systems quickly. Some organisations took their websites offline before the fixes arrived. The FBI has urged anyone who finds signs of compromise to isolate the system and report it.
The developers of the PHP programming language are releasing patches for two critical vulnerabilities. PHP is used across large parts of the internet. Its security update rates both flaws 9.2 out of 10 on the CVSS v4.0 severity scale and urges users to upgrade once the release is available. The European Union Computer Emergency Response Team warned the flaws could allow attackers to run malicious code without logging in, and advised organisations that cannot patch to consider taking affected sites offline. The Australian Cyber Security Centre said it is not aware of active exploitation.
PHP maintainers plan to release fixes for two vulnerabilities, each rated 9.2 out of 10 in severity, in a little over 12 hours. The programming language powers websites and web applications widely. The maintainers said they may release the patches earlier if details become public or evidence of active exploitation appears. The move follows the leak of purported details, which have not been confirmed, describing an exploit tool called PHP2Shell. Security firm watchTowr said it has confirmed the vulnerabilities are real and that they affect PHP versions from PHP 5 onward.
