Australian cyber agency urges urgent action after AI uncovers flaws across the web

The Australian Signals Directorate's Australian Cyber Security Centre has issued an urgent advisory warning businesses to update their web servers after researchers used artificial intelligence to find two severe security flaws in PHP. The programming language runs underneath roughly 70 per cent of all websites worldwide, including popular platforms such as WordPress, Drupal, Magento and Joomla.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and informally named PHP2Shell, allow an attacker to run malicious code on a web server without logging in or needing a password. The weakness sits within PHP itself rather than in the code written by website designers. If triggered, it can let an intruder take control of a server, plant backdoors, or read sensitive customer records and digital keys directly from server memory.

Uncovered by automated code reviews

The vulnerabilities went unnoticed by human developers for more than a decade. They were uncovered after researchers at security firm Calif and OpenAI applied automated reasoning tools, including GPT-5.6 Sol, to audit open-source foundations under an initiative called Patch the Planet. Cloud security company Wiz also identified the issues independently.

While software maintainers planned a coordinated fix, details leaked early, forcing the PHP project to release emergency patches for versions 8.2, 8.3, 8.4 and 8.5. In response, government departments in Finland and the Netherlands took public websites offline while technicians applied fixes, and cloud providers reported early scanning attempts against unpatched systems.

In Australia, authorities confirmed that public-sector sites were among those exposed. The Australian Signals Directorate advised technical teams to identify every instance of the language across their servers and apply official updates immediately.

What this means for Australian businesses

Many small and medium companies do not realise they rely on PHP. If your business runs an online shop on WooCommerce or Magento, publishes content through WordPress, or uses a customer portal built on common web frameworks, your systems are likely affected.

Business owners should take three concrete steps:

• Contact your web developer or hosting provider immediately to confirm that your server runs a patched release, specifically PHP version 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
• Check for unsupported legacy versions, because sites still running PHP 7 or 8.1 will not receive automatic fixes and need a manual platform upgrade.
• Request an inspection of server logs for unexpected memory errors or unusual script activity over the past week, and cycle stored database passwords and API tokens once the patch is applied.