# Critical PHP flaw forces Australian websites offline

> AI discovery of decade-old vulnerabilities in software powering seven in ten websites triggers emergency patching across government, education and hosting services.
- Title: Critical PHP flaw forces Australian websites offline · Abc
- Summary: AI discovery of decade-old vulnerabilities in software powering seven in ten websites triggers emergency patching across government, education and hosting…
- Keywords: php, cybersecurity, data breach, artificial intelligence, australia, government websites, vulnerability, software security, news, politics, Critical, flaw
- Source: Abc — https://abc.net.au/news/2026-10-22/data-breach-warning-after-ai-uncovers-critical-php-flaw/107295516
- Published: 2026-10-22T00:48:22+00:00
- Read time: 2 min
- Topics: php, cybersecurity, data breach, artificial intelligence, australia, government websites, vulnerability, software security, news, politics
## Critical flaw in PHP discovered
The organisation behind PHP issued a security alert yesterday about two critical vulnerabilities. PHP powers an estimated seven in ten websites and applications, including Wordpress and Wikipedia.
## How the flaw works
The vulnerabilities allow attackers to run their own code on affected servers without logging in. This gives unauthorised control to extract user data or implant malware on websites.
## Flaw hidden for over a decade
The flaws, dubbed PHP2shell, have been present for more than a decade. A developer found the first signs of the underlying problem in two thousand twenty-four, but work repeatedly stalled.
## AI helped uncover the vulnerability
US-based security firm Calif identified the critical flaw using OpenAI's AI models. It took existing research about a possible attack vector and used AI to confirm a legitimate vulnerability exists.
## Exploitation already underway
Amazon Web Services saw evidence of attempts to exploit the vulnerability as early as October seventeen. An anonymized IP address targeted a honeypot, suggesting a threat actor was involved.
## Major Australian sites go offline
GovCMS, which hosts many major Australian government websites, blocked direct access to servers. Moodle, an Australian education technology company, took its website offline as a precaution before restoring it after applying fixes.
## Expert warns of elevated breaches
Australian web security expert Troy Hunt told ABC News Breakfast: "You have to patch it very, very quickly, or the suggestion is to take it offline." He expects elevated data breaches ahead.

> You have to patch it very, very quickly, or the suggestion is to take it offline.
## What Australians should do now
Use unique passwords or passkeys with a password manager. Monitor card statements over coming weeks. Be wary of unexpected login prompts or download requests, even on trusted sites.
## Security fixes released, patching urgent
The PHP Foundation released a fix early this morning and urged all operators to update immediately. The Australian Signals Directorate issued a rare critical alert to government, infrastructure, and individuals.
## Key takeaway

A critical flaw in PHP, used by seven in ten websites, discovered with AI assistance has forced major Australian government and education platforms offline and prompted urgent patching to prevent data breaches.