In short:
Australian website operators are choosing to take their services offline or to limit access after researchers using AI discovered critical infrastructure flaws.
asserted
researchers → choose → flaws
PHP is a common programming language powering seven in 10 websites, including popular platforms such as Wordpress and Wikipedia.
asserted
PHP → power → Wordpress
Security fixes have been released and experts are urging operators to patch affected services immediately.
asserted
experts → release → services
Australians should expect an increase in future data breaches as a result of critical software flaws that have forced major government websites, education platforms and web hosts to go offline.
asserted
that → expect → websites
The AI-assisted discovery of a vulnerability in a crucial piece of web architecture used by most websites, known as PHP, has set off a global scramble to patch millions of devices as major tech companies warn that bad actors have begun seizing on it.
asserted
actors → assist → it
The flaws, dubbed "PHP2shell", have been present for more than a decade, but are so serious that cybersecurity experts have urged widespread action to avoid major breaches.
"You have to patch it very, very quickly, or the suggestion is to take it offline," Australian web security expert Troy Hunt told ABC News Breakfast.
asserted
Hunt → dub → Breakfast
There is not much an individual can do about a server they do not control, so the practical advice is the same hygiene that always pays off:
- Use unique passwords or even better, use passkeys and a password manager so a breach at one site doesn't unlock your other accounts
- Keep an eye on card statements over the coming weeks
- Be extra wary of unexpected prompts to log in or download something, even on sites you trust
What happened?
Yesterday, the organisation behind PHP issued a security alert about the discovery of two "critical" vulnerabilities.
asserted
organisation → be → vulnerabilities
PHP is used in the back end of an estimated seven in 10 websites and applications, including Wordpress and Wikipedia.
asserted
PHP → use → Wordpress
These vulnerabilities would allow attackers to run their own code on affected servers without logging in, a major cybersecurity flaw that would allow unauthorised control to do anything from extracting user data to implanting other malware.
asserted
control → allow → malware
PHP works on the server behind a website, producing content for a visitor's browser.
asserted
PHP → work → browser
The flaws can let attackers run their own code on affected servers without logging in, according to PHP's security advisory.
uncertain
attackers → let → advisory
The risk varies with the way a server is set up, but PHP's developers urged all users serving web pages to update immediately.
asserted
developers → vary → pages
The PHP Foundation, a non-profit organisation maintaining and developing the PHP ecosystem, released a fix early this morning and urged all operators to update immediately.
asserted
Foundation → maintain → operators
Amazon Web Services, a subsidiary of the US tech giant offering cloud computing platforms, said it had already seen evidence of attempts to exploit the vulnerability as early as October 17.
asserted
it → offer → October
"The targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," it said in a blog post.
uncertain
it → suggest → post
Major organisations go dark
Australia's own cybersecurity agency, the Australian Signals Directorate, put out a rare critical alert about the flaw directed at everyone from government and critical infrastructure to individuals and families.
asserted
agency → go → individuals
Major Australian organisations took drastic steps to avoid falling victim until they were able to ensure that they had patched their own devices.
asserted
they → take → devices
GovCMS, which hosts many major Australian government websites, blocked direct access to its servers while keeping cached copies of public pages available.
Moodle, an Australian education technology company whose software powers hundreds of thousands of university and schools' online learning platforms, also took its website offline as a precaution, before beginning to restore them after applying security fixes.
asserted
software → host → fixes
Australian hosting provider VentraIP restricted some of its file uploads on customer hosting, warning that forms accepting attachments could fail.
uncertain
forms → restrict → attachments
Even smaller website operators such as those running Australian forum for customising computer hardware went down as a precaution.
Mr Hunt said there was little Australians needed to do, but the worst-case scenario was a breach of websites holding their personal information.
asserted
scenario → run → information
"We just need to expect that we may have some elevated instances of the data breaches that we're already seeing every day," he said.
uncertain
he → need → that
AI helped discover 'critical' flaw
US-based security firm Calif said it had identified a critical flaw using OpenAI's AI models as part of a cybersecurity program it was running.
asserted
it → help → program
While the bug appears to have been present in versions of PHP released as far back as 2012, Calif said it took existing research that theorised about a possible attack vector and used AI to confirm the existence of a legitimate vulnerability.
asserted
that → appear → vulnerability
The PHP Foundation said a developer had found the first signs of the underlying problem behind one of the flaws in 2024, but its work repeatedly stalled amid difficult technical choices and limited resources.
asserted
work → say → choices
AI helped assess reports, the foundation said, while humans remained responsible for decisions and fixes.
asserted
humans → help → decisions
"A person makes every call and works on every patch," it said.
asserted
it → make → patch
OpenAI warned that the same capabilities helping defenders find vulnerabilities could help attackers rapidly develop tools to exploit them.
uncertain
attackers → warn → them
The Aporia
