Australian government websites including that of the country’s own cyber defence agency and the ABS were among hundreds around the world shut down overnight after critical security flaws were found in PHP, a programming language that runs more than two thirds of the internet.

PHP sits underneath popular web design platforms and applications, so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services.

This story is developing. For updates download our new app

Sites pulled offline for urgent security updates ranged from official government portals and local councils, to gaming and commerce platforms, to popular internet forums like Something Awful and notorious message board 4chan.

Wiz, one of the security firms that found the issues, estimated that PHP runs about 70 per cent of the world’s websites and said the flaws rank “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

“It’s definitely a wake-up call for governments and businesses worldwide,” said Dimitrios Salampasis, Associate Professor of Emerging Technologies and Fintech at Swinburne Business School.

“This is a serious flaw in software that can underpin millions of websites and has the potential to expose sensitive information and allow hackers to take control of vulnerable systems.”

The US National Security Agency (NSA) has advised all organisations using PHP to either patch immediately or pull systems offline.

“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said in a statement.

“If an immediate update is not feasible, it is recommend that organisations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.”

The US Federal Bureau of Investigation (FBI) Cyber Division urged all organisations using PHP to update immediately and take an inventory of “where PHP runs in your environment, prioritising internet-facing systems and vendor products that bundle PHP”.

“Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files,” the FBI said.

“Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.”

The Australian Signals Directorate (ASD) said, “We are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards. Organisations and individuals should monitor PHP applications and prepare to update and apply patches.”

The ASD’s post included a link to “read the full alert” on the agency’s own cyber.gov.au website — but the website had been taken offline.

“We are aware of an outage that may be affecting Government websites, including https://cyber.gov.au,” the ASD said in a follow up post.

“Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.”

Home Affairs Minister Tony Burke has been contacted for comment.

Attackers could use the security flaws to take over web servers without needing a password.

Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.

The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year’s record total.

PHP volunteers released a fix on Wednesday.

“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the language, said in a blog post.

Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP’s code.

Google-owned Wiz said it found them independently weeks later with help from AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol.

OpenAI said on X that it considered the bug “one of the most impactful vulnerabilities in recent memory”, adding that it “marks a new phase, where AI can find security bugs with internet-scale impact”.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” the firm wrote.

“As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.”

Ethan Mollick, a professor at the University of Pennsylvania’s Wharton School who studies AI, said that companies he talks to are struggling to keep up with the pace of patches needed to shield from AI-driven cyberattacks.

“Now consumers are going to have the same experience of getting everything updated often and fast,” he wrote on X.

Prof Salampasis said the incident highlighted the danger of ubiquitous “digital interfaces and digital easiness”, from internet-of-things (IoT) devices to QR-code menu ordering websites.

“All of this happened because we wanted [the convenience],” he said.

“Real-time in digital means there is always the potential for something to go wrong, especially now in times of AI when many of these things can go rogue. The [attack] surface is becoming so big at the moment. There is a massive generation of data on a second or millisecond basis. Everything and anything from businesses to individuals, we’re all potentially hackable.”

The flaws had been reported privately to PHP’s developers and kept confidential while a fix was prepared.

Details leaked online on Tuesday, a day before the planned release of the fix, prompting the rush to take sites offline.

Incredibly, Calif itself contributed to the chaos in a major blunder.

“As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video,” the PHP Foundation said.

“It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities.

“Copies of the deleted video started circulating on social media soon after.

“The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.”

In France, local government websites, including one for Paris police, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, the interior ministry said.

In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cybersecurity centre went offline as a precaution, according to Dutch public broadcaster NOS.

Belgium’s foreign ministry temporarily took its websites offline as a precaution, it said on X, although the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.

Parts of online encyclopedia Wikipedia were inaccessible on Wednesday.

The Wikimedia Foundation, which runs Wikipedia, said it was addressing the security vulnerabilities and had “taken down a number of other systems as a precautionary measure until they can be safely patched”.

Japanese Prime Minister Sanae Takaichi issued an “urgent request for everyone to take action tonight”.

“Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight at 11 PM on October 21 (Japan time) as soon as possible,” she wrote on X.

“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.”

The Australian Bureau of Statistics (ABS) website was also down with a message that it was “currently undergoing maintenance” and would be back online on Thursday.

It wasn’t immediately clear whether the Australian government was given advanced warning. The ASD’s alert suggested it was only “aware of media reporting”.

OpenAI said it had “worked, in collaboration with our partners, to engage with multiple parts of the US government, including the White House’s Super Intelligence Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners to support that effort” to patch critical systems.

The AI firm previously came under fire from Prime Minister Anthony Albanese for a months-long delay in notifying Australian authorities of a Medicare data breach by a rogue OpenAI agent that occurred in June.

More to come

 — with AFP