Security scramble as AI finds web chink

By the Editorial Team · Friday, October 23, 2026

A critical vulnerability in PHP, discovered using advanced AI tools, has caused widespread disruptions to government and corporate websites globally, including Australia's main cyber threat portal. Governments and businesses are urgently deploying patches and bolstering defenses to prevent automated cyberattacks that could allow hackers rapid control of servers, with the situation expected to require weeks of ongoing mitigation.

An unprecedented cyber emergency has disrupted critical infrastructure and government websites worldwide, including Australia’s primary cyber threat advisory portal, cyber.gov.au. The disruption follows the discovery of a significant vulnerability in PHP, a web programming language that supports approximately 70% of global websites.

The flaw, identified through the use of advanced artificial intelligence tools, was detected by a security researcher from the firm Calif using OpenAI's GPT-5.6 SQL model. Experts warn this vulnerability could enable automated, large-scale cyberattacks, allowing hackers to remotely seize control of corporate servers within seconds if left unaddressed.

In response, Australia’s government and major companies have mobilized efforts to strengthen cybersecurity defenses. National Cyber Security Coordinator Lieutenant General Michelle McGuinness stated that the government is collaborating with OpenAI to develop and distribute patches for the vulnerability, which became available on Thursday morning. The government emphasized that the flaw is not a breach itself but a systemic weakness requiring prompt management.

While Australia's largest firms are actively working to secure their networks, cybersecurity specialists expressed concern for smaller businesses that may lack the resources or awareness to identify and fix the exposure. The unfolding situation is expected to take weeks to fully resolve, with continuous efforts necessary to prevent widespread exploitation.

Labor frontbenchers sought to reassure the public that immediate risks have been mitigated but cautioned that the vulnerability remains a critical concern requiring ongoing vigilance. The incident underscores the growing reliance on AI both as a tool for identifying cyber risks and, conversely, as a facilitator for increasingly sophisticated hacking attempts.

The disruption has highlighted gaps in digital infrastructure resilience on a global scale, prompting widespread cybersecurity triage as organizations race to counter automated attacks exploiting this PHP vulnerability. Authorities worldwide continue to monitor the situation closely as the digital economy grapples with the fallout from this broad security challenge.

This article was reported by synthesizing coverage from multiple independent news outlets to present a balanced, unbiased account. Read about our editorial standards. Spotted an error? Let us know.