The NSW Government is responding to two critical security vulnerabilities affecting the widely used PHP scripting language, with some government websites temporarily taken offline while updates are applied.
Cyber Security NSW is working with departments and agencies to identify potentially affected systems and install security patches. As of 22 October, no NSW Government agency had reported an information breach linked to the vulnerabilities.
Critical PHP Vulnerabilities Identified
The Australian Cyber Security Centre has issued a critical alert covering two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
PHP is commonly used to power websites and web applications. The vulnerabilities can potentially allow an unauthenticated attacker to execute code on affected servers.
Emergency security updates have been released for supported PHP versions, with administrators advised to patch affected systems as soon as possible.
Some NSW Websites Temporarily Offline
As a precaution, some NSW Government websites have been temporarily taken offline while security updates and checks are completed.
The government said the measure is intended to reduce exposure while affected systems are patched and reviewed.
Cyber Security NSW is also working with national cyber authorities as the incident affects organisations internationally.
Businesses and Councils Urged to Patch Systems
The Australian Cyber Security Centre has advised organisations using PHP to identify affected systems, apply available security updates and monitor web applications for suspicious activity.
NSW businesses, councils and other organisations using PHP-based websites or applications are also being encouraged to follow the same guidance.
The NSW Government says affected services will be restored as remediation work is completed.
Be the first to comment