By Farid Farid and Lucinda Garbutt-Young

Australia’s cybersecurity agency and other government websites have been affected by a critical programming language flaw as part of a global fault that hackers could exploit. 

The Australian Signals Directorate, the peak intelligence body intercepting cybersecurity threats, said its website had been among domestic government sites affected by an issue with software that powers much of the internet.

“We are aware of an outage that may be affecting government websites, including https://cyber.gov.au,” the agency said in a statement.

Government websites in Europe and Asia went offline and US departments were also scrambling to protect networks as a precaution after a disclosure of two critical vulnerabilities in a widely used programming language called PHP.

We are aware of an outage that may be affecting Government websites, including https://t.co/gWWfTByucZ.

Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.

— Australian Signals Directorate (@ASDGovAu) October 21, 2026

The signals directorate confirmed the agency was not aware of active exploitation of the vulnerabilities, but the alert status remained at critical.

“Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.”

The signal directorate’s full statement was unable to be accessed for several hours when the link was clicked, instead showing an error message. It came back online later on Wednesday morning.

A spokesperson for Home Affairs Minister Tony Burke confirmed the websites of several government departments and agencies had been affected.

“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,” the spokesperson said.

“Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate.”

At one stage on Thursday morning, the Parliament of Australia site was down, with a message saying it was because intermittent maintenance was being carried out.

The Department of Defence, along with the Parliamentary Services team, have been contacted for comment.

PHP is a programming language used to run websites and powers millions of sites that depend on popular application such as WordPress.

When a visitor loads a page, a ​server running PHP assembles the content and sends it to the browser.

The flaw in PHP was discovered using an artificial intelligence tool.

Developers of the PHP programming ‌language released urgent new fixes on Wednesday to vulnerabilities that had quietly been lurking in their software for years.

With reports that hackers were exploiting the flaws to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.

The Dutch prime minister said he was closely monitoring the situation and Japanese Prime Minister Sanae Takaichi also urged website owners to use a new fix.

News all day, every day at CityNewsQBN.com.au.