Security researchers at two US groups, Calif and Wiz, discovered serious vulnerabilities in PHP, a programming language used by a large share of the world's websites. The flaws could allow a hacker to take control of a website's server without a password. The NSA recommended that organisations take affected systems offline if an immediate update is not possible. OpenAI, which helped verify the flaws and develop patches, called them among the most impactful security issues in recent memory. The UK's National Cyber Security Centre urged British organisations to act immediately.
Australian government websites, including the cyber defence portal cyber.gov.au, were taken offline after serious vulnerabilities were found in PHP, a widely used web scripting engine. The Australian Signals Directorate says some organisations took sites down as a precaution and there is no sign the sites were affected. NSW Minister for Digital Government Jihad Dib said some NSW government sites were temporarily taken down while patches are applied. No government agencies have reported data breaches. OpenAI said an AI model identified the flaw and warned that similar findings could rise sharply.
Hackers tried to exploit two critical PHP flaws four days before they were publicly disclosed, according to new research from Amazon Web Services. Its analysts spotted an attempt on October 17 against a honeypot, a decoy web server used to study attacks. The attempt came from an anonymised internet address, suggesting a threat actor. It is unclear how the actor obtained exploit information before disclosure. AWS says AI tools are shortening the time between a patch and a working exploit.
AU Now app
Your suburb’s news, alerts and Shorts — in one app
Alerts, Shorts and your saved stories — free on Google Play.
The NSW Government has temporarily taken down several official websites over a critical global security flaw in the PHP scripting language. Cyber Security NSW is working with state departments and agencies to apply updates and security patches. Minister for Customer Service and Digital Government Jihad Dib said no NSW Government agencies had reported information breaches to Cyber Security NSW so far. The Australian Cyber Security Centre has issued a Critical Alert over two severe PHP vulnerabilities that could let unauthenticated attackers run malicious code on web servers.
Industry Minister Tim Ayres has said no Australian government websites have been breached after a serious security flaw was discovered in a widely used programming language. The live coverage follows the day's developments on the issue.
The US National Security Agency has warned that two critical flaws in PHP, a widely used web programming language, need urgent attention. The PHP Foundation has issued patches. The agency advised that websites that cannot be patched immediately should be taken offline until they can be. The flaws were found using AI tools from OpenAI and Google's Wiz, and researchers reported them before any known attacks. Website operators are urged to update to the current PHP version, 8.5.12.
Australia's Signals Directorate reported outages on government websites, including cyber.gov.au, linked to a critical PHP software issue. Developers of PHP have identified two critical vulnerabilities and urged website operators to install an update. Government agencies in the Netherlands and Finland took sites offline as a precaution. Security experts warned the flaws could affect millions of servers, because PHP runs roughly 75 per cent of websites whose programming language can be identified. Attacks are emerging, and PHP users have been urged to apply patches as soon as they are released.
