Several major Australian government websites, including those of the Australian Cyber Security Centre and the Australian Bureau of Statistics, went offline after security researchers uncovered critical vulnerabilities using AI tools.
The Australian outages began on Wednesday night and continued into Thursday morning as organisations worldwide responded to critical vulnerabilities discovered in PHP.
PHP is a scripting language used to develop websites and applications and powers up to 70 per cent of websites worldwide.
Researchers used technology from OpenAI as part of their investigation into the flaws.
The Australian Signals Directorate, the peak intelligence body for intercepting cybersecurity threats, confirmed the website was one of the departments affected.
It said it was not aware of active exploitation of the vulnerabilities at the time, but the alert status remained at critical.
'Organisations and individuals should monitor PHP applications and prepare to update and apply patches,' the agency said.
The Parliament of Australia website was among those down earlier on Thursday, with a message stating it was because intermittent maintenance was being carried out.
Some of Australia's major government websites, including the cyber defence agency and the Australian Bureau of Statistics, were taken offline after security flaws were identified (stock)
The Australian Signals Directorate, the peak intelligence body for intercepting cybersecurity threats (pictured) confirmed several government websites were among those affected
The Parliament website, along with the ABS and Australian Cyber Security Centre, are now back online.
'ASD’s ACSC understands that all PHP versions from PHP 5 onwards may be affected,' a notice on cyber.gov.au read.
'ASD’s ACSC is currently not aware of active exploitation related to these vulnerabilities.'
Home Affairs Minister Tony Burke's office confirmed the websites of several government departments and agencies had been affected.
'Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,' a spokesperson said.
'Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate.'
Cybersecurity experts have described the issue as a wake-up call for governments and businesses worldwide.
'This is a serious flaw in software that can underpin millions of websites and has the potential to expose sensitive information and allow hackers to take control of vulnerable systems,' Swinburne Business School's Dimitrios Salampasis told news.com.au.
The Australian parliament website was among the government sites that were down earlier on Thursday
Australian Information Security Association director Scarlett McDermott warned it will have major implications for cybersecurity.
'Vulnerabilities that might once have remained undiscovered for years can now be identified much more quickly, and attackers can potentially exploit them just as quickly,' she told The Australian.
'If you don’t know what software you’re running, you can’t know whether you’re vulnerable. And if you can’t identify affected systems quickly, you can’t patch them quickly enough.'
PHP developers have since released urgent new fixes for two critical vulnerabilities that had been lurking in their software for years.
'These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP,' a PHP Foundation blog post read.
'If you run PHP, it is imperative that you update now.'
Government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.
Dutch Prime Minister Rob Jetten was closely monitoring the situation while Japanese Prime Minister Sanae Takaichi urged website owners to use a new fix.
