Several Australian government websites have experienced outages or been taken down for maintenance overnight, after artificial intelligence helped uncover two critical vulnerabilities in the open source PHP programming language used widely across the internet.

Website operators around the world have been urged to apply newly released security patches to fix the issues, which allegedly went undiscovered for more than a decade.

Australia's cybersecurity agency the Australian Signals Directorate (ASD) announced on Wednesday night that it was "aware of an outage that may be affecting government websites", including its own.

Australian government websites including the Australian Bureau of Statistics and Jobs and Skills Australia were unavailable when Information Age attempted to access them on Thursday morning, but were brought back online soon after.

A spokesperson for the Minister for Cybersecurity, Tony Burke, told media that some government websites were temporarily unavailable "as work is undertaken to mitigate risks arising from this vulnerability".

In issuing a "critical" alert, ASD's Australian Cyber Security Centre (ACSC) said it was " not aware of active exploitation related to these vulnerabilities".

But the centre recommended organisations identify PHP in their environments, review the latest PHP guidance, apply available security updates "and other appropriate mitigations", and "monitor PHP applications and related systems for suspicious activity".

Government websites in Europe have also been affected by the vulnerabilities – as well as other popular websites such as Wikipedia and the Internet Archive.

AI helps find 'longstanding flaw'

The PHP vulnerabilities were discovered with assistance from generative AI systems, cybersecurity companies Calif and the Alphabet-owned Wiz said.

Calif said in a blog post that it had discovered the bugs in August using a large language model (LLM), while Wiz said it had also found the issues using its AI vulnerability research tool Wiz Atlas, Google's Gemini 4 Argon, and OpenAI's GPT-5.6 Sol.

"The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," Wiz researchers said in a blog post.

"Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."

Calif and Wiz said they coordinated with OpenAI and the team behind PHP on the vulnerabilities.

The issues they discovered would allow hackers to remotely execute code on affected website servers, or to read sensitive process memory, they said.

"That memory may contain passwords, authentication tokens, API [application programming interface] keys and certificates belonging to other requests or the server itself," Wiz said.

"... Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4.

"Attackers can exploit them remotely, in some cases fairly easily."


Chart: Wiz 'PHP2Shell' blog post

'A wake-up call for Australian organisations'

The AI-assisted discovery of two critical PHP vulnerabilities is "a wake-up call for Australian organisations, as AI accelerates the discovery and exploitation of cybersecurity weaknesses", the Australian Information Security Association (AISA) said.

"That has enormous implications for cybersecurity," AISA board director Scarlett McDermott said.

"Vulnerabilities that might once have remained undiscovered for years can now be identified much more quickly, and attackers can potentially exploit them just as quickly.

"If you don't know what software you're running, you can't know whether you're vulnerable.

"And if you can't identify affected systems quickly, you can't patch them quickly enough."

Details of the PHP vulnerabilities were reportedly leaked on social media earlier this week, forcing security researchers to publish their findings earlier than planned.

This highlighted the importance of responsible disclosure practices, McDermott said.

"As AI makes vulnerability research faster and more accessible, maintaining trust and cooperation across the cybersecurity community will be critical," she said.

"We need researchers to keep finding these weaknesses, and we need the processes that allow them to be fixed safely."

PHP is estimated to be used on around 70 per cent of the world's websites and web applications.

Gunnar Hellekson, a vice president and general manager at IBM-owned open source software company Red Hat, said "much of the critical software running the world is also the least visible".

"Stable production code 'that just works' is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery," he said.

"The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business."

The announcement of critical PHP vulnerabilities comes as the Australian government reviews its cybersecurity posture after AI agents run by OpenAI accessed both public and non-public data in several Australian government websites.