Businesses across Australia have taken their websites offline as a precautionary measure, after the discovery of critical security flaws affecting PHP, the coding language powering a huge portion of the open internet.
Patches intended to fix those vulnerabilities are now available, but not all business websites taken down in response to the threats have returned as of Thursday morning.
Related Article Block Placeholder Article ID: 346094
Overnight, OpenAI said it and a coalition of technology researchers had discovered “one of the most impactful security issues in recent memory” in the coding language, which is used in 70% of websites worldwide.
PHP powers WordPress, the widely-used website publishing platform, and is integral to popular e-commerce platforms like Magento.
The Australian Signals Directorate (ASD) labelled the vulnerabilities as “critical”, urging organisations to identify where PHP was used in their websites and monitor for “potentially malicious activity”.
Smarter business news. Straight to your inbox.
For startup founders, small businesses and leaders. Build sharper instincts and better strategy by learning from Australia’s smartest business minds. Sign up for free.
By continuing, you agree to our Terms & Conditions and Privacy Policy.
Business websites went dark in response, as administrators raced to address potential security weaknesses.
HANMAC, a registered training organisation based in Townsville, Queensland, said it has temporarily taken its site offline in response to the ASD alert.
The organisation was “working with our web host to get everything back online as soon as possible,” it said on Thursday morning.
“Thank you for your patience, and we apologise for any inconvenience.”
ByteOn, an IT and tech support provider based in Mount Martha, Victoria, shared a similar message to social media this morning.
So too did Adelaide-based conveyancing firm Eckermanns, which last night told social media followers, “fast-moving security threats like this don’t always allow for much warning, and keeping our data safe is our top priority”.
But that business later confirmed its website was back online, after its team put the new PHP patches into effect.
Steps for small businesses to take
Related Article Block Placeholder Article ID: 346005
In a statement, Anya Pinch, managing lawyer at Lawpath, said small businesses should ask their web hosts or developers if they had taken steps to address the threat.
Small businesses should also consider enacting a data breach policy, which governs how organisations should respond to cyber threats and whether they need to disclose breaches to authorities, she said.
“Small businesses don’t have a security team on call, so the time to plan is before something goes wrong, not after,” said Pinch.
Lawpath said businesses can freely access its data breach policy template as a starting point.
Several government-run websites, including websites for the Australian Bureau of Statistics, Department of Treasury, and Australian Parliament House also went dark in response to the threats.
Those official sites have since returned to normal operation.