Australia's cyber security agency is urging organisations that run PHP-based websites to check their systems and apply available updates after two critical vulnerabilities were disclosed.
In an alert reviewed on 22 October, the Australian Signals Directorate's Australian Cyber Security Centre said operators should identify where PHP is used, review the latest guidance, install security updates and monitor related systems for suspicious activity.
The PHP project says its releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address two flaws that could allow remote code execution without authentication. It says PHP installations serving web requests are in scope and recommends updating immediately. Operators using older or vendor-maintained versions should check their provider's advice about supported updates or backported fixes.
This is a warning about a software vulnerability, not evidence that any particular Cairns business or website has been breached. Website owners who do not manage their server directly should contact their hosting provider or technical administrator to confirm whether an update is needed.
Image: AI-generated editorial illustration of website security maintenance. It is not a photograph of an affected site, attack or breach.
