Several prominent Australian government websites, including the Australian Cyber Security Centre and the Australian Bureau of Statistics, were taken offline after security researchers used artificial intelligence tools to identify critical vulnerabilities.
The outages began late Wednesday and continued into Thursday morning, as organisations around the world moved to respond to serious security weaknesses found in PHP.
PHP is a widely used scripting language for building websites and applications, supporting as many as 70 per cent of websites globally.
As part of their investigation, researchers used technology developed by OpenAI to examine the flaws.
The Australian Signals Directorate, the nation’s leading intelligence agency for intercepting cyber threats, confirmed that its website was among those affected.
The agency said it had no knowledge of the vulnerabilities being actively exploited at that stage, although the threat alert remained at a critical level.
“Organisations and individuals should monitor PHP applications and prepare to update and apply patches,” the agency advised.
The Australian Parliament website was also unavailable earlier on Thursday. Visitors were shown a notice saying intermittent maintenance was under way.
Several major Australian government websites, including the national cyber defence agency and the Australian Bureau of Statistics, were taken offline after security vulnerabilities were identified (stock)
The Australian Signals Directorate, the country’s peak agency for intercepting cyber threats (pictured), confirmed that several government websites had been affected
The Parliament website, the ABS and the Australian Cyber Security Centre have since returned online.
A notice published on cyber.gov.au warned that every PHP release from PHP 5 onwards could be vulnerable.
“ASD’s ACSC is currently not aware of active exploitation related to these vulnerabilities,” the notice said.
The office of Home Affairs Minister Tony Burke confirmed that websites operated by multiple government departments and agencies had been impacted.
CHECK THIS OUT: Texas Mom Charged With Manslaughter After Allegedly Driving 82 MPH in Crash That Killed Two College Graduates
“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,” a spokesperson said.
“Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate.”
Cybersecurity specialists have characterised the incident as a warning for governments and businesses that rely on widely deployed software.
“This is a serious flaw in software that can underpin millions of websites and has the potential to expose sensitive information and allow hackers to take control of vulnerable systems,” Swinburne Business School’s Dimitrios Salampasis told news.com.au.
The Australian Parliament website was among the government sites that became unavailable earlier on Thursday
Scarlett McDermott, director of the Australian Information Security Association, warned that the vulnerability could have significant consequences for cybersecurity.
‘Vulnerabilities that might once have remained undiscovered for years can now be identified much more quickly, and attackers can potentially exploit them just as quickly,’ she told The Australian.
‘If you don’t know what software you’re running, you can’t know whether you’re vulnerable. And if you can’t identify affected systems quickly, you can’t patch them quickly enough.’
PHP developers have since released urgent new fixes for two critical vulnerabilities that had been lurking in their software for years.
‘These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP,’ a PHP Foundation blog post read.
‘If you run PHP, it is imperative that you update now.’
Government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.
Dutch Prime Minister Rob Jetten was closely monitoring the situation while Japanese Prime Minister Sanae Takaichi urged website owners to use a new fix.