Critical PHP Flaws Hit Government Sites, Including Australia's Cyber Security Website

Developers of PHP, a programming language that underpins large parts of the internet, have identified two critical vulnerabilities and are urging website operators to update as soon as fixes are available. The Australian Signals Directorate said cyber.gov.au was among the Australian government websites affected. European government departments and sites such as Wikipedia are also known to be affected.

Hackers are believed to be exploiting the flaws. Cloudflare's chief technology officer, Dane Knecht, said early attacks were emerging and that the company was updating its firewall rules, but he stressed this was only a stopgap and that users should patch as soon as PHP releases the update. Government agencies in the Netherlands and Finland took sites offline as a precaution, and the Dutch cybersecurity agency went offline itself. Agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied.

The reach of PHP is what makes this serious for smaller organisations. Security firm Huntress noted that PHP quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and plenty of software that does not advertise it uses PHP. The ASD advises anyone using PHP to monitor official PHP guidance and apply security patches as they become available.