Australia’s cybersecurity site among those hit by ‘critical’ software flaw

Two critical vulnerabilities in PHP, a widely-used programming language, have been discovered, prompting website operators to implement a fix as soon as possible. Australian government websites, including the Australian Signals Directorate's cyber.gov.au, are among those affected. It is believed hackers have been exploiting this vulnerability, leading government agencies in the Netherlands, Finland, France, and the United States to take their sites offline as a precaution.

PHP forms a significant portion of the internet, powering platforms like WordPress, Drupal, Joomla, and Magento, along with shared hosting services and control panels. Cybersecurity companies like Huntress have noted that attacks are emerging, and they are updating their firewall rules as a temporary measure. Meanwhile, the Dutch cybersecurity agency itself went offline as a precaution, and Danish municipal IT company Kombit shut down several services, including the national school communication platform, due to the vulnerabilities.

Security experts warn that attackers could potentially compromise millions of servers by scanning the internet for vulnerable PHP versions, as it is estimated that PHP runs roughly 75% of identifiable websites worldwide. It is crucial for organizations and individuals using PHP to monitor and review official guidance, applying security patches as they become available to mitigate the risks associated with this critical issue.