What Happened
On the night of 21 October, the Australian Signals Directorate said it was aware of an outage that may be affecting government websites, including its own, cyber.gov.au.
The next morning, sites like the Australian Bureau of Statistics and Jobs and Skills Australia were also unavailable for a while.
A spokesperson for the Minister for Cyber Security said some websites were temporarily unavailable “as work is undertaken to mitigate risks arising from this vulnerability.”
And it wasn’t just Australia. Government services in the Netherlands, Finland, Denmark and France were also taken offline as a precaution.
They weren’t hacked offline. Many were taken offline on purpose, to stay safe while they updated.
The Foundation Under Most of the Internet
Most websites are built on top of something called PHP.
According to W3Techs, PHP runs around 75% of websites whose programming language can be identified. WordPress sites, online shops, government pages. WordPress alone, which runs on PHP, powers about 43% of all websites.
Think of PHP as the foundation under most of the houses on the internet. You don’t see it. You just live on top of it.
Two Cracks in the Foundation
Researchers found two cracks in that foundation. They’re now known as PHP2Shell.
Here’s the simple version. When PHP ran out of memory in the middle of handling a request, it could be interrupted halfway through, or leave old information behind that should have been cleaned up.
In other words, when a website got overloaded, PHP could leave a door open.
And the next request could walk right through it, and run its own code on that server.
No password needed.
- 🚨The PHP team rated both flaws 9.2 out of 10 for severity.
- 🔓They can allow “unauthenticated remote code execution”. That means a stranger running commands on a server without ever logging in.
- 📅Researchers say every PHP version from the last decade is affected by at least one of them, going back to PHP 5.4.
Their official names are CVE-2026-109618 and CVE-2026-109619, in case your IT person asks.
So How Do You Find a Door Like That?
Security researchers, the good hackers, read code looking for weak spots. It’s slow, careful work.
Now AI is joining in. It can read huge amounts of code, try idea after idea, and never get tired.
That’s exactly what happened here. The security company Calif said it found the bugs in August using a large language model. Wiz, another security company, said it used its own AI research tool together with frontier AI models from Google and OpenAI.
Wiz put it this way: frontier AI models “substantially reduced that barrier, turning a longstanding flaw into an exploit.”
That’s what “AI that acts” means.
You don’t ask it a question. You give it a job.
The Part Most People Never See
When the good hackers find a flaw, they don’t post it. It’s called coordinated disclosure.
- 🤫They tell the developers in private.
- 🛠️The developers build the fix in secret.
- 📆They agree on a date.
- 📣And on that day, the fix and the news go out together, so everyone can update before attackers catch up.
This time, the secret leaked on social media before the date. On 20 October, a post named both flaws and said they’d be revealed two days later.
And the race started early. That same evening, PHP posted an advance warning and moved its release forward to 21 October, saying it reserved the right to release earlier if details became public.
Security companies like Cloudflare say attackers are already trying it. Australia’s Cyber Security Centre said it wasn’t aware of active exploitation, but still gave the alert its highest rating: critical.
So What Does This Mean for Us?
You don’t need to understand memory corruption to do your part.
If you have a website, a blog or a small business on WordPress, send this to whoever looks after it, and ask one question: are we updated?
- ✅The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- ⚠️PHP 8.1 and older no longer get official updates from the PHP project. If your site runs on one of those, it’s time for a bigger conversation with your web host.
- ☁️If someone else hosts your site, ask your hosting company whether they have already applied the update.
And for everyone else: when your phone or laptop asks to update, say yes.
That little button is the end of a race you never saw.
AI is helping find the cracks faster. Our updates can be fast too.
💜
Sources
Everything above comes from these. Start with the official ones.
php.net
The official advisory from the PHP team, with the fixed versions and partial mitigations.
cyber.gov.au
Australia’s Cyber Security Centre alert on the PHP vulnerabilities and what organisations should do.
ia.acs.org.au
How AI helped find the flaws, and which government sites went down.
cybergirllab.com
It’s Cyber Security Action Month. Eight small actions, starting with updates.