Several Australian government websites, including the Australian Cyber Security Centre (ACSC), have been affected following the discovery of two critical security vulnerabilities in the widely used PHP programming language, prompting authorities to issue urgent warnings and recommend immediate security updates.

The Australian Signals Directorate (ASD) said the vulnerabilities affected websites and systems using PHP, with some government agencies temporarily taking services offline as a precaution until security patches could be applied.

The ASD's Australian Cyber Security Centre issued a critical alert urging organisations and individuals to identify PHP systems in their environments, monitor official guidance and install available security updates as soon as possible.

Critical vulnerabilities create global cyber security concerns

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were identified as critical flaws that could allow attackers to remotely execute malicious code on vulnerable servers without authentication. Security agencies warned that successful exploitation could potentially enable attackers to access sensitive data or take control of affected systems.

The PHP Foundation released security updates to address the vulnerabilities, while cyber security agencies around the world advised organisations to prioritise internet-facing systems and apply patches immediately.

PHP is one of the world's most widely used web programming languages and forms the foundation of many websites and online services, including platforms such as WordPress, Drupal and Joomla. The widespread use of PHP has increased concerns over the potential impact of the vulnerabilities.

Australian agencies take precautionary measures

The ASD said its own cyber security website was among the affected government services. Officials stressed that organisations should prepare their systems for updates and take protective measures while security fixes are being implemented.

Australian media reported that websites belonging to several government bodies, including the Australian Taxation Office, the Department of Health and the Australian Communications and Media Authority, experienced restrictions or disruptions following the security alert.

A spokesperson for Australia's National Cyber Security Office said authorities were aware of disruptions affecting various websites, including government services, and were working to reduce potential risks.

The New South Wales Government also confirmed that some government websites were temporarily taken offline while agencies applied security updates, adding that no information breaches had been reported at that stage.

Global response to PHP security threat

The PHP vulnerability has triggered a wider international cyber security response, with several countries and organisations advising users to update systems or temporarily disable vulnerable services until patches are installed.

Cyber security experts warned that because PHP is used across a large portion of the internet, unpatched systems could become attractive targets for attackers seeking to exploit the weaknesses.

Türkiye's Presidency Cyber Security Directorate also launched a nationwide security scan and issued urgent notifications to relevant institutions following the emergence of the PHP vulnerabilities.

Authorities continue to monitor the situation, urging organisations operating PHP-based websites and applications to complete security updates without delay.(ILKHA)