The website of Australia’s own cyber security agency, cyber.gov.au, was among several Australian government websites that went offline or were pulled while emergency fixes for two critical PHP flaws were applied, and a number of NSW government sites were taken down as a precaution. No breach linked to the flaws has been reported.
The flaws, nicknamed PHP2Shell, are in PHP, the programming language behind much of the web; PHP released fixes on 21 October, Tech Business News reported, and full details were made public at 1am AEDT on Thursday 22 October, according to the Australian Cyber Security Centre’s alert.
How the Outages Unfolded
The Australian Signals Directorate (ASD) announced on Wednesday night, 21 October, that it was “aware of an outage that may be affecting government websites”, its own among them, Information Age reported. In a post on X that mentioned a “critical” PHP issue, the agency said cyber.gov.au and other Australian government websites had reported outages, according to ABC News.
When Information Age tried the Australian Bureau of Statistics and Jobs and Skills Australia websites on Thursday morning, 22 October, neither was available, although both were brought back online soon after. At one stage that same morning the Parliament of Australia site was down too, showing a message that said intermittent maintenance was being carried out, SBS News reported.
“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,” a spokesperson for Home Affairs Minister Tony Burke said, according to ABC News.
NSW Pulls Sites as a Precaution
NSW Minister for Customer Service and Digital Government Jihad Dib confirmed that some NSW government websites had also been affected, SBS News reported. In a statement, he said: “As a precaution, some NSW government websites have been temporarily taken down while work to apply patches and updates is completed.”
“We are following advice issued by the Australian Cyber Security Centre and working with national cyber authorities to contain any risks,” Mr Dib said, according to SBS News.
On 22 October the NSW Government said no state government agency had reported an information breach to Cyber Security NSW in connection with the incident, Tech Business News reported.
No Breach Reported
Industry and Innovation Minister Tim Ayres said no Australian government websites had been breached and that the takedowns were a preventative measure, SBS News reported.
“This is led by the Australian Signals Directorate on behalf of the Australian government and cybersecurity agencies around the world, working with, in this case, OpenAI to identify a weakness in these systems,” Mr Ayres said in an interview with News24, as reported by SBS News. He added that there was “a constant battle on the cybersecurity front and Australian government agencies and Australian private sector firms are constantly engaged in toughening up their cybersecurity”.
ASD’s Australian Cyber Security Centre has issued a critical alert, and in it the centre says it is “not aware of successful active exploitation within Australia” related to the vulnerabilities. The alert was last reviewed on 22 October.
“Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available,” the ASD said in its post on X, ABC News reported.
Why the Fix Reached So Far
PHP runs about 75 per cent of websites whose programming language can be identified, according to W3Techs figures cited by ABC News. That share is why the patching touched so many sites at once. A different kind of wide disruption hit sites around the world during the Cloudflare outage of November 2025.
Troy Hunt told SBS News: “So it’s a very easily accessible, very popular language. And unfortunately, what that means is that if there is a vulnerability, the scope of it is extremely broad.”
Australia was not the only country to act. Government agencies in the Netherlands and Finland took sites offline ahead of the fix as a precaution, and France’s Interior Ministry temporarily took local government administrative websites offline, ABC News reported.
Where Things Stood on Friday
As of 5pm AEDT on Friday 23 October, cyber.gov.au and the other federal and NSW sites named here were loading normally. The cyber.gov.au home page was carrying the centre’s “Critical vulnerabilities in PHP” alert.
More cyber security and internet coverage is in our Technology section.
Sources: ABC News, “Australian government sites among those exposed to ‘critical’ PHP software flaw”, 22 October 2026 (https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812); SBS News, “Why are so many websites down and when will they return?”, 22 October 2026 (https://www.sbs.com.au/news/article/php-vulnerability-internet-websites-shutdown-cybersecurity-online-security/sm2gedcoc); Information Age, “Govt sites go down after AI finds ‘critical’ PHP vulnerabilities”, 22 October 2026 (https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html); Tech Business News, “Australian Government Websites Taken Offline as PHP2Shell Flaws Expose Much of the Web”, 22 October 2026 (https://www.techbusinessnews.com.au/news/australian-government-websites-taken-offline-as-php2shell-flaws-expose-much-of-the-web/); Australian Signals Directorate’s ACSC, “Critical vulnerabilities in PHP”, 21 October 2026 (https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php)
Photo: Victorgrigas, CC BY-SA 3.0, via Wikimedia Commons.
Illustrative: rows of web servers in a data centre, photographed in July 2012. This photograph does not show any Australian government system.
