Skip to content
Sign in
↑Part of: OpenAI and Wiz find PHP vulnerabilities as foundation issues patches
Technology · Global

PHP vulnerabilities affect Australian Signals Directorate website

The Australian Signals Directorate said its cyber.gov.au website was among Australian government sites affected by a PHP software issue. Wiz estimated the vulnerability affected around 70 per cent of the internet, while OpenAI announced a separate Australian AI taskforce and cyber defence credits.

AI-assisted synthesis · Based on 5 outlets' reporting · Article text read from 2 of 5 outletsHow it's made

View timeline · 10 entries
5 outlets2 regionsLatest reporting 5 min readNo new reporting in 4 days
Coverage: MixedL 0 · C 2 · R 2 · 1 unrated
Updat3 graphic: Australia
Updat3 graphic · Map data: Natural Earth Natural Earth (public domain)

What happened

Key facts

  • The Australian Signals Directorate said its website, cyber.gov.au, was among Australian government sites affected by an issue with PHP software.
  • Several government websites in Europe and Asia went offline as a precaution after two critical vulnerabilities in PHP were disclosed.
  • Wiz said it discovered the vulnerabilities with help from artificial intelligence tools.
  • Wiz estimated the vulnerability affected around 70 per cent of the internet and had gone undetected for more than a decade.
  • Wiz said AI tools helped identify a fix, and that one researcher completed work in a week that previously could have taken a team months.

The brief

The Australian Signals Directorate said its cyber.gov.au website was among Australian government sites affected by a PHP software issue, as two critical PHP vulnerabilities were disclosed. The agency said on social media that an outage might be affecting government websites.

The Australian newspaper’s headline described government websites as having gone dark, while ABC’s headline said Australian sites were among those exposed to a critical flaw. The Sydney Morning Herald reported that several government websites in Europe and Asia went offline as a precaution after the vulnerabilities were disclosed.

Its account identifies the Australian Signals Directorate’s site as affected and places the incident within a broader disruption to government websites. The headlines from The Australian and ABC also connect Australian government sites with the software flaw, but do not provide further detail about the outage or its causes.

Wiz estimated that the vulnerability affected around 70 per cent of the internet and had remained undetected for more than a decade. The Sydney Morning Herald reported that Wiz found the vulnerabilities with help from artificial intelligence tools and worked with OpenAI and Calif. Wiz also said AI tools helped identify a fix.

According to the report, one researcher completed in a week work that might previously have taken a team months. The scale estimate and account of the discovery come from Wiz, as reported by the Sydney Morning Herald.

The paper also quoted Ismael Valenzuela, vice president of labs, threat research and intelligence at Arctic Wolf, saying PHP powers roughly 70 per cent of websites where the server-side programming language is known. That measure concerns websites using a known server-side language; Wiz’s estimate refers to the internet, so the two figures describe different scopes.

OpenAI separately announced an Australian taskforce focused on AI-related threats, according to the Epoch Times. The company named three experts to lead it and committed $14 million, also expressed as US$10 million, in cyber defence credits for Australia.

OpenAI said the taskforce would have “full independence” over its findings and recommendations and would deliver a report by Dec. 31, 2026, with recommendations intended to inform its approach and support Australian government work on AI safety and cybersecurity. The Sydney Morning Herald reported that the White House said it had been made aware of the PHP flaw on Friday.

The report does not give a calendar date for that notification. The agency’s statement and the precautionary shutdowns elsewhere indicate that the immediate concern was the possible effect of the disclosed vulnerabilities on government websites, while Wiz’s account presents AI-assisted research as part of how researchers identified the issue and a fix.

The reporting does not establish how many websites were affected in total, which specific sites outside Australia went offline, or whether the flaw was exploited.

The Australian taskforce and funding announcement provide a separate account of OpenAI’s cybersecurity activity in Australia; the sources do not say that the taskforce or credits were created in response to the PHP vulnerabilities.

Why it matters

  • Australian government website users faced service disruption: the Australian Signals Directorate identified cyber.gov.au among affected sites, and the Sydney Morning Herald reported precautionary shutdowns at government websites in Europe and Asia.
  • Wiz’s estimate puts the potential reach at around 70 per cent of the internet, with the vulnerability reportedly undetected for more than a decade; that scale makes the security issue relevant beyond Australia.
  • OpenAI’s $14 million (US$10 million) in cyber defence credits and its three-expert taskforce are documented commitments to Australian cybersecurity, although the sources do not link them to the PHP flaw.
  • Wiz’s account that AI-assisted research helped find the vulnerabilities and a fix highlights a concrete mechanism for accelerating security research: one researcher’s week of work was compared with work that could previously have taken a team months.

What to watch next

  • Whether the Australian Signals Directorate provides further information about the effect of the PHP issue on cyber.gov.au.
  • Whether Wiz or the Australian Signals Directorate reports further details about the fix and the affected government websites.
  • Whether the three experts named by OpenAI deliver the taskforce report by Dec. 31, 2026.
  • How OpenAI’s $14 million (US$10 million) in cyber defence credits are used in Australia.

How it's being covered

Coverage analysisShow details
5 source articles · 5 unique outlets
Outlet political mix: Mixed· 2 Center · 2 Right · 1 unrated
Where the outlets are based: Asia 80% · US/Canada 20%
Outlet political mix
Mixed
Left
Center
Right
0 outlets
2 outlets
2 outlets
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
5 unique outletsDominant coverage: Asia
Coverage imbalance
  • Coverage is currently concentrated among outlets based in Asia (4 of 5 geographically-identified sources).
How we measure coverage

How outlets' accounts compare

2 framing differences · 2 uncorroborated claims · 2 information gaps
The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 2 reports whose article text Updat3 read; 3 other outlets were checked by headline only.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • The Sydney Morning Herald focuses on the Australian Signals Directorate’s website, precautionary outages at government sites in Europe and Asia, and Wiz’s account of AI-assisted vulnerability research.
  • The Epoch Times focuses on OpenAI’s Australian AI taskforce and cyber defence credits, rather than the PHP vulnerabilities.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • Wiz estimated that the vulnerability affected around 70 per cent of the internet and had gone undetected for more than a decade.
  • OpenAI said the taskforce would have “full independence” over its findings and recommendations.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The sources do not identify the specific PHP versions affected, describe the technical details of the vulnerabilities, or name the government websites that went offline in Europe and Asia.
  • The sources do not establish whether attackers exploited the vulnerabilities or give a total count of affected websites.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Rasmus Lerdorf created the tools that became PHP.
    Background · compiled and fact-checked by Updat3
  2. PHP made its first public release.
    Background · compiled and fact-checked by Updat3
  3. PHP released version 3, which established the language’s modern form.
    Background · compiled and fact-checked by Updat3
  4. PHP released version 5 with the Zend Engine 2 and a revised object-oriented programming model.
    Background · compiled and fact-checked by Updat3
  5. The Australian Cyber Security Centre was formed in 2014 to bring together government cyber-security functions and expertise.
    Background · from our historical context
  6. In 2018 it became part of the Australian Signals Directorate, the intelligence agency responsible for signals intelligence and cyber security.
    Background · from our historical context
  7. Researchers disclosed CVE-2019-11043, a PHP-FPM vulnerability that could allow remote code execution in certain configurations.
    Background · compiled and fact-checked by Updat3
  8. PHP 8.0, released in November 2020, was one stage in that development; it was not the beginning of the language’s security work.
    Background · from our historical context
  9. The PHP Foundation was announced to fund PHP development and support its maintainers.
    Background · compiled and fact-checked by Updat3
  10. PHP maintainers issued fixes for CVE-2024-4577, a critical argument-injection flaw affecting PHP in CGI mode on Windows.
    Background · compiled and fact-checked by Updat3

How we got here

PHP’s reach helps explain why a defect in the language can have consequences well beyond individual applications. Created by Rasmus Lerdorf in 1994 and released publicly in 1995, PHP became a widely used server-side language: it processes requests and generates content on web servers, often as part of content-management systems and other web applications.

Its long presence across the internet means that organisations may run different PHP versions, sometimes alongside software written many years earlier. A flaw in shared language components can therefore put a broad range of sites at risk, although the actual exposure of any one site depends on its configuration, software version and how it uses the affected functionality.

Related developments1 story

Original sources

5 articles from 5 outlets

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.