PHP Flaws Knock ASD and ABS Websites Offline: What Happened Overnight

Australia woke up on Thursday to find some of its most important government websites offline. The Australian Signals Directorate, the nation’s top cyber security agency, reported outages affecting its own site, and the Australian Bureau of Statistics was briefly unreachable too. The cause was the PHP vulnerability we warned about yesterday, now known as PHP2Shell, and the scramble to protect government websites offline became a worldwide story. Here is what happened overnight, why attacks have already begun, and what website owners should do now.

What Happened Overnight in Australia

The Australian Signals Directorate said on Wednesday night that it was aware of an outage that may be affecting government websites, including cyber.gov.au, as ABC News reported. By Thursday morning, sites including the Australian Bureau of Statistics and Jobs and Skills Australia were also unavailable before coming back online.

A spokesperson for Home Affairs Minister Tony Burke said some websites were temporarily unavailable as work was done to reduce the risk. GovCMS, the platform that hosts many federal government websites, blocked direct access to its servers while keeping cached copies of public pages available. Even smaller Australian websites, such as an online forum for computer hardware enthusiasts, went offline as a precaution.

A rare critical alert

The Australian Cyber Security Centre’s critical alert urged everyone from government and critical infrastructure operators to individuals running websites to act immediately. Critical alerts like this are uncommon and signal that a threat needs urgent attention.

A Global Scramble, Not Just Australia

Australia was far from alone. Government websites in Europe and Asia went offline, and Wikipedia was among the major sites affected. According to web tracker W3Techs, PHP powers around three-quarters of websites with an identifiable programming language, giving these vulnerabilities an enormous potential reach.

Attacks Started Before the Fix

This is the most worrying development since yesterday. Amazon Web Services said it had seen evidence of attempts to exploit the flaw as early as 17 October, days before the public warning. Security firms including watchTowr now report active exploitation attempts against both flaws, while Amazon and others say attacks are happening at scale.

That changes the advice. Yesterday, the priority was preparing to update. Any website that has not yet installed the update should now be considered at genuine risk.

The Fixed PHP Versions

The PHP project released fixes on 21 October in these versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

The PHP project says updating is the only complete fix. PHP 8.1 and older receive no official update, though some Linux distributions and long-term support vendors offer patched packages. Servers using a setup called mod_php face the greatest danger, as Help Net Security explained.

How AI Found a Decade-Old Flaw

The vulnerabilities were found by security firm Wiz, OpenAI’s Codex Security team and research group Calif, with AI tools helping turn a long-hidden weakness into a working attack. The underlying code had been in PHP for more than a decade, and the PHP Foundation says early signs of the problem were flagged in a 2024 audit. It has since added staff and tooling to catch similar issues sooner.

The discovery also comes as the Australian Government reviews its cyber security after separate reports that AI agents run by OpenAI accessed data on several government websites. Together, the two stories show how AI is reshaping both cyber attack and defence.

What Website Owners Should Do Now

If you run a website, follow these steps today:

• Confirm your PHP version. In WordPress, go to Tools, then Site Health, then Info, and check the Server section.
• Make sure it is a fixed version. If it is older than the versions listed above, contact your host urgently.
• Move off unsupported PHP. If your site runs PHP 8.1 or older, upgrade to a supported release.
• Check for signs of compromise. Look for unfamiliar admin accounts, new files or unusual traffic.
• Follow official advice. The Australian Cyber Security Centre publishes updates as the situation develops.

Our previous guide on the two critical PHP vulnerabilities provides more context, while our guide to securing your WordPress site explains broader protection measures.

A Wake-Up Call for the Whole Web

PHP2Shell has shown how a single flaw in widely used software can knock major websites offline within hours. With attacks already under way, waiting is no longer an option. If you run a website, confirm today that it is running a fixed PHP version, and ask your host for proof if you are unsure.

Frequently Asked Questions

Is my personal data at risk?

Not directly from visiting websites. The risk is to website servers. If an organisation’s site was compromised, it may later notify affected users.

Why did government sites go offline?

Agencies took sites offline or restricted access as a precaution while they applied fixes and checked for attacks.

Is the fix available?

Yes. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws.

Who found the flaws?

Wiz, OpenAI’s Codex Security team and Calif, working with the PHP security team.