Arabic version: ثغرة في PHP تدفع إلى استجابة أمنية للمواقع الأسترالية

According to ABC News, Australians should expect an increase in data breaches after researchers using artificial intelligence helped uncover critical vulnerabilities in PHP, a widely used web programming language. The flaws, dubbed “PHP2shell”, have triggered a global push to patch affected devices, with major technology companies warning that attackers have begun attempting to exploit them.

PHP powers the back end of an estimated seven in 10 websites and applications, including WordPress and Wikipedia. The vulnerabilities could allow attackers to run their own code on affected servers without logging in, potentially enabling unauthorised control, extraction of user data or the installation of malware. PHP developers urged operators serving web pages to update immediately, while the PHP Foundation released security fixes.

Australian organisations took precautionary action while checking and patching services. GovCMS blocked direct access to its servers while keeping cached public pages available. Moodle took its website offline before beginning restoration after applying fixes, and hosting provider VentraIP restricted some customer file uploads, warning that attachment forms could fail. The Australian Signals Directorate issued a critical alert directed at government, critical infrastructure, individuals and families.

Australian web security expert Troy Hunt said operators should patch systems quickly or consider taking them offline. For individuals, the practical advice is to use unique passwords or passkeys and a password manager, monitor card statements and be wary of unexpected requests to log in or download files. US-based security firm Calif said it identified a critical flaw through a program using OpenAI models, while the PHP Foundation said people remained responsible for decisions and patches.