Businesses across Australia have taken their websites offline as a precaution against critical security flaws in PHP, the coding language used in about 70 per cent of websites worldwide. Patches are now available, but some sites remained down as of Thursday morning.
Websites across Queensland, Victoria and South Australia were among those affected. The Australian Signals Directorate labelled the vulnerabilities as "critical" and urged organisations to identify where PHP was used in their systems and monitor for "potentially malicious activity."
The flaws were revealed by OpenAI and a coalition of technology researchers, who described the issues as "one of the most impactful security issues in recent memory." PHP powers WordPress and is integral to popular e-commerce platforms such as Magento.
HANMAC, a registered training organisation in Townsville, Queensland, said it had temporarily taken its site offline in response to the ASD alert and was "working with our web host to get everything back online as soon as possible." ByteOn, an IT and tech support provider in Mount Martha, Victoria, issued a similar message. Eckermanns, an Adelaide conveyancing firm, said "fast-moving security threats like this don't always allow for much warning, and keeping our data safe is our top priority"; the firm later confirmed its website was back online after applying the new PHP patches.
Several government-run websites, including those of the Australian Bureau of Statistics, the Department of Treasury and Australian Parliament House, also went dark in response to the threats. Those official sites have since returned to normal operation.
Anya Pinch, managing lawyer at Lawpath, said small businesses should ask their web hosts or developers whether they had taken steps to address the threat and should consider enacting a data breach policy. "Small businesses don't have a security team on call, so the time to plan is before something goes wrong, not after," she said.
Analysis
Why This Matters
- PHP underpins a large share of the world's websites, including WordPress and major e-commerce platforms, so a critical flaw in the language exposes far more than the Australian sites that went dark.
- Small businesses rarely have a security team on call, making fast-moving threats dependent on web hosts and advance planning.
- A critical advisory from the Australian Signals Directorate signals the potential for malicious activity while patches are being rolled out.
Background
PHP is an open-source scripting language used to build and run a substantial portion of the web, including the WordPress publishing platform used by millions of sites. When a critical vulnerability is announced, administrators must locate where they rely on the affected software and apply patches, a process that can take time. In this case, the Australian Signals Directorate issued a critical advisory, prompting many organisations to take sites offline while they assessed their exposure.
Key Perspectives
Website operators and businesses: Several organisations moved quickly to take sites offline, prioritising data safety over availability. HANMAC said it was working with its web host to restore service, while Eckermanns resumed operations after applying the patches, illustrating the trade-off between caution and business continuity.
Security authorities: The Australian Signals Directorate described the vulnerabilities as critical and urged organisations to identify where PHP was used and monitor for potentially malicious activity.
Legal advisers: Anya Pinch of Lawpath said small businesses should confirm with their web hosts or developers that the threat has been addressed and should have a data breach policy in place. As she put it, the time to plan is before something goes wrong.
Critics/Skeptics: The episode highlights the limits of precaution. Sites that remain offline lose business, while sites that return before their patches are verified could still be exposed. Not all business websites taken down had returned as of Thursday morning, and the effectiveness of the fixes will become clear only as more sites resume normal operation.
What to Watch
- Whether the remaining business websites return to normal after the PHP patches are applied.
- Whether the Australian Signals Directorate or other agencies report malicious activity linked to the vulnerabilities.
- Whether OpenAI and the research coalition release further detail on the scope of the flaw.
