Experts say AI can find and exploit software weaknesses in minutes, a speed that could fuel a rise in cyber attacks. The warning follows a recent breach involving flaws in PHP, a programming language that underpins 70 percent of the internet. Several government agencies took websites offline, including a cyber defence portal, to prevent breaches. Security specialists urge governments to use AI for defence, share intelligence with private firms, and recover critical services first.
A critical vulnerability in the programming language PHP has forced website owners to urgently patch their sites or take them offline. The flaw, discovered by human researchers using AI tools, highlights the fragility of the internet's infrastructure. Experts warn that AI could make it easier to find and exploit such vulnerabilities, potentially leading to widespread cybersecurity challenges. The incident underscores the risks of relying on decades-old open-source technology that underpins a significant portion of the web.
Millions of attempts to exploit newly published PHP bugs were recorded within hours, according to Cloudflare analysis. The PHP Foundation said it had seen no successful exploitation, and many circulating exploits appear ineffective. Researchers at Calif first identified the flaws in early August, using AI tools alongside human expertise. Some of the underlying issues were known since 2024 but were considered too complex to exploit. Security researchers say AI mainly magnifies existing patterns of vulnerability discovery rather than creating new ones.
AU Now app
Your suburb’s news, alerts and Shorts — in one app
Alerts, Shorts and your saved stories — free on Google Play.
Security researchers at two US groups, Calif and Wiz, discovered serious vulnerabilities in PHP, a programming language used by a large share of the world's websites. The flaws could allow a hacker to take control of a website's server without a password. The NSA recommended that organisations take affected systems offline if an immediate update is not possible. OpenAI, which helped verify the flaws and develop patches, called them among the most impactful security issues in recent memory. The UK's National Cyber Security Centre urged British organisations to act immediately.
Hacking attempts have risen to millions after two critical vulnerabilities in PHP, a widely used programming language, were made public. Cloud services firm Cloudflare said attempts jumped from thousands before the announcement to millions shortly after. Global agencies, including Australia's Australian Signals Directorate, have urged websites to patch their code urgently. Developers have released fixes and told users to update immediately. Some governments have taken websites offline as a precaution, and several Asian governments have ordered cyber security inspections.
A critical flaw in PHP, a programming language used by about 70 per cent of the world's websites, has disrupted Australian government and corporate networks. The Australian Signals Directorate, the nation's lead cyber defence agency, was among those affected on Wednesday. The flaw was first uncovered by an OpenAI tool, and threat actors are believed to be exploiting it worldwide. Patches are now available for two PHP vulnerabilities. Industry and Innovation Minister Tim Ayres said no Australian Government websites had been breached. Opposition Leader Angus Taylor called for access to frontier AI models for cyber defence.
Australian government websites, including the cyber defence portal cyber.gov.au, were taken offline after serious vulnerabilities were found in PHP, a widely used web scripting engine. The Australian Signals Directorate says some organisations took sites down as a precaution and there is no sign the sites were affected. NSW Minister for Digital Government Jihad Dib said some NSW government sites were temporarily taken down while patches are applied. No government agencies have reported data breaches. OpenAI said an AI model identified the flaw and warned that similar findings could rise sharply.
Hackers tried to exploit two critical PHP flaws four days before they were publicly disclosed, according to new research from Amazon Web Services. Its analysts spotted an attempt on October 17 against a honeypot, a decoy web server used to study attacks. The attempt came from an anonymised internet address, suggesting a threat actor. It is unclear how the actor obtained exploit information before disclosure. AWS says AI tools are shortening the time between a patch and a working exploit.
The NSW Government has temporarily taken down several official websites over a critical global security flaw in the PHP scripting language. Cyber Security NSW is working with state departments and agencies to apply updates and security patches. Minister for Customer Service and Digital Government Jihad Dib said no NSW Government agencies had reported information breaches to Cyber Security NSW so far. The Australian Cyber Security Centre has issued a Critical Alert over two severe PHP vulnerabilities that could let unauthenticated attackers run malicious code on web servers.
Australians may face more data breaches after critical flaws in PHP, a web software used by most websites, were disclosed. The PHP Foundation urged all users to update immediately, as attackers could run their own code on affected servers without logging in. Several major Australian organisations, including GovCMS and Moodle, took sites offline or restricted services as a precaution. Security firm Calif said it found the flaw using OpenAI's AI models, and OpenAI warned that similar tools could also help attackers.
A critical flaw in PHP, the programming language behind more than 70% of websites, has been made public. Left unfixed, it could allow hackers to take over millions of websites and the data on their servers. Several European governments and operators, including the Port of Rotterdam, have taken websites offline. Australia's Signals Directorate and similar bodies in other countries have urged developers to apply urgent updates. Patches have been released, but applying them across millions of systems will take time.
Australia's Australian Signals Directorate says its website was among several Australian government sites affected by a critical flaw in PHP, a programming language that powers much of the internet. The agency urged organisations and individuals using PHP to review official guidance and apply security patches as they become available. Government websites in Europe and Asia went offline as a precaution after two critical vulnerabilities were disclosed, with reports that hackers were exploiting the flaws. Developers released urgent fixes, and the flaw was discovered using an artificial intelligence tool.
The US National Security Agency has warned that two critical flaws in PHP, a widely used web programming language, need urgent attention. The PHP Foundation has issued patches. The agency advised that websites that cannot be patched immediately should be taken offline until they can be. The flaws were found using AI tools from OpenAI and Google's Wiz, and researchers reported them before any known attacks. Website operators are urged to update to the current PHP version, 8.5.12.
Australia's Signals Directorate reported outages on government websites, including cyber.gov.au, linked to a critical PHP software issue. Developers of PHP have identified two critical vulnerabilities and urged website operators to install an update. Government agencies in the Netherlands and Finland took sites offline as a precaution. Security experts warned the flaws could affect millions of servers, because PHP runs roughly 75 per cent of websites whose programming language can be identified. Attacks are emerging, and PHP users have been urged to apply patches as soon as they are released.
The PHP Foundation has released emergency security updates for two critical flaws in the PHP programming language, which could let attackers gain remote control of victim systems. The flaws affect PHP installations going back to version 5, but only PHP 8.2 and newer are still supported with patches. Security experts warn that attackers could begin exploiting unpatched systems quickly. Some organisations took their websites offline before the fixes arrived. The FBI has urged anyone who finds signs of compromise to isolate the system and report it.
AU Now app
Your suburb’s news, alerts and Shorts — in one app
Alerts, Shorts and your saved stories — free on Google Play.
The developers of the PHP programming language are releasing patches for two critical vulnerabilities. PHP is used across large parts of the internet. Its security update rates both flaws 9.2 out of 10 on the CVSS v4.0 severity scale and urges users to upgrade once the release is available. The European Union Computer Emergency Response Team warned the flaws could allow attackers to run malicious code without logging in, and advised organisations that cannot patch to consider taking affected sites offline. The Australian Cyber Security Centre said it is not aware of active exploitation.
PHP maintainers plan to release fixes for two vulnerabilities, each rated 9.2 out of 10 in severity, in a little over 12 hours. The programming language powers websites and web applications widely. The maintainers said they may release the patches earlier if details become public or evidence of active exploitation appears. The move follows the leak of purported details, which have not been confirmed, describing an exploit tool called PHP2Shell. Security firm watchTowr said it has confirmed the vulnerabilities are real and that they affect PHP versions from PHP 5 onward.
