• • 인터넷 전반에 영향을 미치는 PHP의 치명적 보안 취약점이 두 건 발견됐습니다. PHP는 웹사이트 구축에 널리 사용되는 프로그래밍 언어입니다.
  • 보안기업 Wiz는 이 취약점으로 인터넷의 약 70%가 영향을 받을 수 있다고 추정했습니다. 다만, 정확한 규모는 검증되지 않았습니다.
  • 한국을 비롯해, 각국 정부와 주요 기관도 긴급 대응에 나선 상태입니다.
  • 이번 문제는 10년 넘게 발견되지 않았던 취약점을 AI가 탐지한 것이라고 밝혀져 더욱 주목 받고 있습니다.

Dr Dimitrios Salampasis is Associate Dean of Growth and Program Innovation in the School of Business, Law and Entrepreneurship at Swinburne University of Technology

"The global incident is a stark reminder of how a single vulnerability in widely used software can have far-reaching consequences for essential online services.

The discovery of two critical security flaws, potentially allowing cybercriminals to take control of vulnerable web servers without a password, prompted precautionary shutdowns of government websites across several countries, including Australia.

Importantly, taking websites offline does not necessarily mean they have been hacked; it can be a responsible measure to protect systems while security updates are applied.

What makes this incident particularly significant is the role of artificial intelligence in identifying these vulnerabilities, highlighting how AI is accelerating both the discovery of security weaknesses and potentially their exploitation by cybercriminals. This creates an increasingly challenging environment where organisations may have less time to respond before attackers strike.

We should be questioning whether governments and businesses have sufficient visibility of their technology.

Organisations should have the ability to rapidly patch vulnerabilities, and the resilience to maintain essential services during a cyber crisis.

In my view, we need to move beyond the assumption that every cyberattack can be prevented; it's about anticipating threats, responding quickly and ensuring that the services Australians rely on remain secure, trusted and available.

The more digital our society becomes, the more we must recognise that cybersecurity is not just a technology challenge, but a fundamental issue of national resilience, economic security and public trust.”

Conflict of interest statement: "No conflicts."
Dimitrios is contactable on 0426 158 512  or at dsalampasis@swin.edu.au 

--

Dr Shaanan Cohney is a Senior Lecturer in the Faculty of Engineering and IT at the University of Melbourne

"The disclosure of two vulnerabilities in PHP, one of the programming engines that powers much of the internet, may in previous years have been just another story about another widespread software vulnerability that was responsibly remediated. However, today’s incident illustrates how AI is shifting the norms and the defences that once protected us, even when software vulnerabilities were found.

The PHP project, in a way consistent with prior norms of responsible disclosure, announced in advance that they would be disclosing major vulnerabilities today. System administrators were prepared for the simultaneous release of both the details of the vulnerabilities and a patch and a way for them to protect their systems at the same time.

However, AI now makes it far too easy for attackers to find a flaw even when only its existence has been announced and not the details. Previously, the window between the announcement of a potential vulnerability and the time it took for a security researcher or hacker to find the specific vulnerability was long enough that one could responsibly put out an announcement.

AI has changed things, and this means that now the world has to rethink how we handle the disclosure process of vulnerabilities. Is it enough to put out an announcement? Is our old process of announcing an upcoming patch still the right way to go, or should we move to shorter timelines such that even the discovery of the vulnerability by AI can’t give attackers the upper hand?"

Conflict of interest statement: "No conflicts"
Shaanan is contactable on +1 215 301 9363 on WhatsApp, Signal, or iMessage and is available during US daytime hours, or via cohneys@unimelb.edu.au 

--

Dr Belinda Barnet is a Senior Lecturer in Media at Swinburne University of Technology.

"OpenAI, whose own agents discovered the flaw, describe this in effusive terms as one of the most 'impactful security issues in recent memory'. Perhaps they are right, but they are not the good guys here. Let’s not forget that its agents also hacked into Medicare and the NSW Department of Climate Change, Energy & Water in June.

Yes, it was a member of OpenAI’s 'Patch the Planet' project who found the vulnerability.

OpenAI describes it in effusive terms as one of the most 'impactful security issues in recent memory'. But OpenAI are not the good guys here. It’s like a massive weapons manufacturer offering us safer helmets. We need to look at legislative change so our critical infrastructure can’t be hacked into by rogue AI agents like it was in June."
 

Conflict of interest statement: No declaration received.
Belinda is contactable on +61 403 833 455 or at bbarnet@swin.edu.au

--

Dr Sigi Goode is a Professor of Information Systems from the Research School of Management at the Australian National University

"The bigger concern is the websites that are NOT down today. Users should be wary of these, as they are clear targets."

Conflict of interest statement: "No conflicts of interest (though I used to program in PHP a lot about 20 years ago and was used to bug announcements)."
Sigi is contactable at sigi.goode@anu.edu.au

--

Dr Rahat Masood is a Senior Lecturer in Cyber Security at The University of New South Wales

"This incident highlights one of the biggest challenges in cybersecurity today: our reliance on third-party software and technologies. Most websites do not operate independently. They rely on multiple software components, plugins, libraries and third-party services, many of which organisations may not have full visibility or control over. Even if an organisation has patched its own website, it does not necessarily mean the website is secure. If any third-party software or component it relies on remains vulnerable, attackers may still find a way to exploit that weakness. This creates a significant challenge because the security of an organisation often depends on the security practices of its software vendors and service providers.

Another concern is that cybercriminals are likely to take advantage of the publicity surrounding this vulnerability. Once a security flaw becomes publicly known, attackers may actively scan the internet to identify websites running vulnerable versions of the affected software. Organisations that are slow to respond could become easy targets. This incident is a reminder that cybersecurity is not just about securing our own systems. Organisations need to maintain visibility over all software they use, including third-party components, regularly assess vulnerabilities, and ensure that security updates are applied across their entire digital infrastructure."
 

Conflict of interest statement: "No financial or non-financial conflicts of interest to declare."
Rahat is contactable at rahat.masood@unsw.edu.au

--

Professor David Parry is a researcher in Computer Science at Murdoch University and a Fellow at the Australasian Institute of Digital Health

"This is a big deal!

PHP was one of the first server-side web languages. It's 'open source', which means it's free to use, works with many other tools and is developed and improved by the community. This makes it attractive, and It's very widely used in huge numbers of government and commercial websites. Governments and schools/universities in particular often preferred it because it's not dependent on one supplier and is easy to use. One of the things it does is allow webpages to 'talk' to databases on servers, which is vital for things like shopping, filling in online forms, etc. It's also the basis for a lot of website builder applications like WordPress.
 
This news is important because;

• It's reasonable to call PHP one of the building bricks of the internet.
• It's used in a lot of places, so there will need to be a lot of maintenance to fix the vulnerabilities; there will be disruption as this is done, and as PHP is quite old in internet terms, it will be in unexpected places, and the original authors might have left. Site owners might not even know they are using it. This is why governments have announced it - a commercial product would normally involve the seller contacting the customer list, but here there isn't one.
• The vulnerability appears to have been discovered by AI - this is one of the first announcements of its type.

We have no idea whether it has been exploited, which could be worrying. A major attack against PHP websites could steal/affect a lot of vital data, so this needs patching, but of course you need to know you are using it.

Just as if there was a safety recall on a particular type of brick or fastening, a lot of building owners are potentially affected, but finding out if you are depends on good records and sharing information. The response from government reflects this.
I think there will need to be a lot of auditing and record-keeping going forward, and I think there will need to be an updating of policies about this in companies, government and schools, etc.
"

Conflict of interest statement: No declaration received.
David is contactable on +61 450 711 537 or at david.parry@murdoch.edu.au

--

Mark Pesce is an Honorary Associate in Digital Cultures at the University of Sydney

"We're very likely going to see more vulnerabilities this severe. This one is going to reveal who maintains their infrastructure well - and who doesn't."

Conflict of interest statement: No declaration received.
Mark is contactable on +61 418 653 187 or at mpesce@gmail.com

--

Dr Erica Mealy is a Senior Lecturer in Computer Science at the University of the Sunshine Coast

"I am honestly surprised it took AI this long to leverage these well-known and well-documented software vulnerabilities. This vulnerability in PHP has been known for over 20 years. Many cybersecurity-savvy organisations removed the use of PHP from web-available systems many years ago. The FBI, NSA and NIST in the USA all recommend against 'memory-unsafe languages'. But there has long existed a disconnect between what the cybersecurity community knows and what web developers know and practice. Web developers often have stronger backgrounds in design than cybersecurity. Part of the promise and curse of PHP is that it is relatively low barrier to entry – it enabled the non-technically trained the ability to rapidly build and deploy their own systems online.

PHP represented a perfect storm: it is much more commonly available in web-facing repositories, so AI has a large amount of PHP it could learn from; PHP’s vulnerabilities and their exploits have been well documented for over 20 years; and the interconnectedness of the internet by its very nature means that more data, more pages, and more paydays are available for those that exploit it. It was only a matter of time – these are the concerns the IT/cybersecurity industry has about AI’s rapid introduction – and an AI agent that replaced a fired IT worker probably isn’t going to tell you not to use other AI Agents."

Conflict of interest statement: "Nothing to declare"
Erica is contactable Tuesday before 11 & from 12 – 1 after 4pm AEST, Friday any time, Saturday anytime, Sunday until midday, on +61 7 5459 4484 or at emealy@usc.edu.au

--

Professor Asha Rao is Associate Dean of Mathematical Sciences at RMIT University

"With the increased deployment of AI, whether to test systems or attack them, risk management of information systems just becomes more critical. As the news indicates, the vulnerability in PHP was probably decades old, though only discovered now. So what does that mean for companies trying to secure their data and systems? 

Firstly, Companies need an information security policy that is aware of all systems. And then, having a critical incident response plan, who is alerted, and how is response going to be coordinated and escalated. It is possible that more such vulnerabilities will come to light, and while being proactive is often best, in many cases like this, being reactive may be the only option. And if that is the case, reacting fast will be the best protection. "

Conflict of interest statement: "None."
Asha is mostly available today (Thursday 22 Oct) and tomorrow (23 Oct), and is contactable on +61 422 959 218 or at asha.rao@rmit.edu.au

--

Professor Richard Buckland is a researcher in cybercrime, cyberwar, and cyberterrorism in the School of Computer Science and Engineering at the University of New South Wales

"The biggest cyber security emergency in a decade. Again.

Security researchers using AI discovered some critical security flaws that affect most of the world’s web servers. Threatening companies and web users.

Why is this serious?  

• Attackers can take over websites on these servers.  
• They can spy on and steal data sent to those servers, including log-in and account credentials.
• They can impersonate and control legitimate websites and services on familiar and trusted addresses.
• They can potentially infect visitors to trusted sites with malware.
• They can cause reputation damage to companies or individuals by changing the content on their websites.
• They can shut down websites of online businesses.
• They can use a company's web servers as jumping-off points for further attacks into the company's systems.

Did the security researchers use AI?   
Yes

Software affected?
PHP

What is PHP?
PHP is a language used by many developers to write programs that drive websites. That means this vulnerability affects a huge number of programs that run on the internet. It’s like finding a virus that can attack all mammals, rather than just one species.

The fix?
The only safe fix is to update the version of PHP used by web servers to one of the patched versions PHP have released over the past few days. Unfortunately, it can be hard for less cyber-mature firms to update all their critical web servers quickly, and monitoring has revealed attackers already know how to attack the weakness and are trying.

For firms that haven’t updated already, the only safe option may be to go offline until patching has been completed.  

Timing?
The PHP developers have known about this vulnerability for a long time. Two years ago they started to worry about it seriously. Apparently, they initially didn’t think it was urgent as they couldn’t see how an attacker could make use of the weakness. PHP have released safe patched versions of the software over the last few days, and has made a public announcement today. Old versions have not had patches released for them, however. Some companies that received the patch early accidentally went public before today, so attackers have had advance warning.

What should the public do?

Don’t believe everything you read on websites over the next few days or longer. It may be possible for malicious attackers to change wording on sites you trust. Wait for government announcements, but in the meantime you can probably trust that cyber-mature organisations such as banks and telcos have done their patching already. For other websites, perhaps avoid logging into or visiting them for a few days. Time to go outside and smell the spring flowers and moths, perhaps?

What should firms do?

Patch ASAP! Consider going offline to protect yourself and your customers in the meantime if you haven’t patched comprehensively and tested already.

Lessons to be learned?

Audit your security maturity and check that you can react quickly to emergencies. Make sure your critical software has been designed and built for security, not just for speed and cost of development. Reconsider using PHP - it was not designed for security when it was developed and became popular over a decade ago. Make sure your internal security capability is sufficient to deal with emergencies. If you write your own software, make sure your developers are security mature throughout the entire development process; don’t just leave it as a theme to be checked at the end.

For boards?
Ask hard questions if your firm has been affected by this.  If your firm uses PHP for critical services, it might be a red flag about your security maturity. Ask hard questions if your firm was not patched by today. Do you have enough capability to deal with cyber risks? Ask hard questions about how your firm will be dealing with the increased risk of compromise now that AI is being used by attackers."

Conflict of interest statement: No declaration received.
Richard is contactable at richardb@unsw.edu.au

--

Dr Nishan Mills is a Senior Lecturer in AI and Analytics at La Trobe University

"This morning, websites around the world were taken offline, disrupting access to online services. This followed the discovery of critical vulnerabilities in PHP, a programming language that powers much of the web, and required urgent security patches.

The underlying flaws had existed for over a decade. Researchers at Wiz, who reported the vulnerabilities, describe them as among the most severe ever discovered in PHP. Exploiting them meant navigating complex chains of steps, right at the edge of what security researchers could traditionally achieve. AI fundamentally changed this equation, helping researchers turn these longstanding flaws into working exploits capable of compromising vulnerable servers.

This gives us a glimpse of a broader shift in cybersecurity in the age of AI. We are already seeing frameworks such as REA that allow AI agents to use tools to reverse engineer software at a fundamental level. We have also seen reports of AI agents coordinating in unexpected ways and compromising systems at organisations such as Hugging Face.

Together, these developments point to an uncomfortable truth: much of our software security has benefited from the quiet assumption that deep flaws would stay undiscovered, and that even if found, they would be too difficult to exploit in practice. AI is eroding that protection.

We cannot afford to be complacent about how we build, maintain and secure the software we all depend on."

Conflict of interest statement: "No conflicts"
Nishan is contactable on +61 452 424 175 or at N.Mills@latrobe.edu.au

--

Professor Paul Haskell-Dowland is a researcher in Cyber Security Practice at Edith Cowan University

"PHP is a programming language used by a large proportion of the world’s websites (with estimates of up to 75% of sites using it). The team behind PHP announced a critical vulnerability on the 20th October, which was then followed by a patch (a software remedy) for the vulnerability the following day.

The vulnerability allows an attacker to target a website and, if vulnerable, gain potential remote access to the system and files (through a technique referred to as Unauthenticated Remote Code Execution. Should a website be successfully targeted, an adversary could potentially change how the website functions, extract data, deploy malicious software targeting the website’s users or shut down the site completely. If the website is located inside a company’s network, the computer(s) running the site could potentially be used as a stepping stone into the rest of the network.

The seriousness of the vulnerability has required a rapid response from the PHP team, and some governments are recommending disabling websites until the vulnerability is fixed by website administrators.

There is relatively little individuals can do other than to stay alert for potential site or data misuse (e.g. phishing) – most end users will not be aware of the use of PHP (or vulnerability of) the website they are accessing."

Conflict of interest statement: "none"
Paul is currently in China, so email is the best contact, but response may be slower than usual and tv/radio may be difficult. He is back in Australia on Saturday night, with availability from then.
Paul is contactable at p.haskelldowland@ecu.edu.au

--

Dr Rumpa Dasgupta is a Lecturer in Cybersecurity in the Department of Computer Science & IT at La Trobe University

"Researchers have recently discovered a critical vulnerability in PHP, a programming language widely used by websites and popular platforms such as WordPress, Joomla, Drupal and Wikipedia’s MediaWiki. According to the researchers, this vulnerability could allow an unauthenticated attacker to remotely execute malicious code on a vulnerable server. In simple terms, an attacker could potentially exploit an affected website without even having a valid username or password, making this a serious security risk.

After the vulnerability was identified, some affected organisations took the sensible precaution of temporarily taking their websites offline. This gives security teams time to apply the necessary patches, check for any suspicious activity and make sure their systems are safe before bringing them back online.

The positive side is that security researchers identified and disclosed the vulnerability so that action could be taken. However, we cannot simply assume that attackers had never discovered or exploited it before. That is why organisations should not only patch their systems but also review their logs for any signs of previous compromise.

This incident is another reminder that cybersecurity is an ongoing process. Even widely used and well-established technologies can have vulnerabilities that remain undiscovered for years. Thorough security testing before deployment is important, but security does not stop there. Continuous monitoring, regular vulnerability assessments and timely security updates are equally important to identify and address potential risks before they can be exploited."
 

Conflict of interest statement: "None."
Rumpa is contactable at r.dasgupta@latrobe.edu.au

--

Dr Shalinka Jayatilleke is a Senior Lecturer in AI and Analytics in the Business School at La Trobe University

“This incident highlights how a weakness in shared software can disrupt services across many organisations. Taking a website offline can be a precaution to protect users while security updates are applied; it does not necessarily mean that the organisation has suffered a data breach.

From an AI and governance perspective, the role of AI in investigating these vulnerabilities is significant. AI can help researchers uncover weaknesses in existing software and assess how they might be exploited. However, discovering a problem does not automatically make systems safer. Organisations still need the people, processes and resources to respond.
The governance challenge is whether organisations know which technologies their services depend on, who is responsible for maintaining them, and how quickly they can act when a serious vulnerability emerges. Outsourcing a website does not remove the need for clear accountability.

Public communication also matters. People need to understand why a service is unavailable, what is known about any risk to their information, and how they can access essential services during the disruption.

For me, the central lesson is that investment in AI capability must be matched by investment in maintenance, human expertise and incident preparedness. Detecting vulnerabilities delivers protection only when organisations can act on the findings.”
 

Conflict of interest statement: "None."
Shalinka is contactable at s.jayatilleke@latrobe.edu.au

--

Dr Sam Seo is a Lecturer in the School of Computer Science and Information Technology at Adelaide University

"These are critical flaws in the PHP engine. PHP powers more than 70% of websites. Since a patch is now available, I wish every organisation, especially government and critical infrastructure operators, would patch these immediately and take vulnerable systems offline. Attackers could be operating at machine speed, exploiting these flaws. These flaws have been tested and validated that attacker can take over PHP server without logging in.

Can you imagine sensitive information like passwords, tokens, and API keys being easily accessed by attackers?

To make things worse, remote code execution allows attackers to download and install malware, ransomware, or backdoors. What would happen if a government or critical infrastructure operator does not patch these flaws in time, and attackers are ready to knock on its PHP servers? 

Conflict of interest statement: "None"
Sam is contactable on +61 8 8302 3332 or at sam.seo@adelaide.edu.au

--

Dr Rebecca Johnson is an AI evaluation and governance expert based at the University of Sydney, specialising in how generative and agentic AI systems behave in real-world contexts. She has worked with Google Research’s Ethical AI team and develops approaches to evaluating AI systems in practice.

"AI didn't find the PHP flaw on its own. A security researcher knew where to look, drew on decades of earlier work, and used AI to investigate. Human expertise was central to this discovery. That gets lost when we simply say ‘AI found the bug’.

We are entering an era of AI versus AI in cybersecurity. AI can help defenders discover and repair vulnerabilities, but it can also give attackers powerful new capabilities. There were attempts to exploit the PHP flaws before they became public, although we don't know whether AI was involved.

The real danger is the widening gap between how quickly vulnerabilities can be exploited and how quickly organisations can protect themselves. AI can help find the flaw and develop the fix. But a patch protects nobody until it's deployed.

OpenAI is understandably presenting this discovery as a cybersecurity success, and there is genuine value in it. But one successful discovery tells us little about how reliably these systems perform, how much expert direction they need, or whether defenders are gaining ground against attackers.

Australia needs independent evaluation of these capabilities, beyond the claims of the companies developing them. Finding a vulnerability demonstrates capability. Keeping people safe is the real test."

Conflict of interest statement: No declaration received.
Rebecca is contactable on +61 429 216 199 or at rebecca.johnson@sydney.edu.au

  

 
"This news is important because it's reasonable to call PHP one of the building bricks of the internet. It's used in a lot of places so there will need to be a lot of maintenance to fix the vulnerabilities - there will be disruption as this is done, and as PHP is quite old in internet terms it will be in unexpected places and the original authors might have left. Site owners might not even know they are using it. This is why governments have announced it - a commercial product would normally involve the seller contacting the customer list, but here there isn't one.

"The vulnerability appears to have been discovered by AI - this is one of the first announcements of its type.

"We have no idea of whether it has been exploited, which could be worrying. A major attack against PHP websites could steal/affect a lot of vital data, so this needs patching - but of course you need to know you are using it. Just as if there was a safety recall on a particular type of brick or fastening, a lot of building owners are potentially affected, but finding out if you are depends on good records and sharing information. the response from government reflects this.

"I think there will need to be a lot of auditing and record keeping going forward and I think there will need to be an updating of policies about this in companies, government and schools etc."

Conflict of interest statement: "No COI."

Dr Farkhondeh Hassandoust, Senior Lecturer, Information Systems, University of Auckland Business School, comments:
Contact: +64 21 0299 4171, farkhondeh.hassandoust@auckland.ac.nz 

"These vulnerabilities show how a weakness in software used by many websites can quickly become a risk to essential public services.

"A website going offline does not necessarily mean it has been hacked. In some cases, temporarily shutting down a service is a sensible precaution while security teams apply the required fixes.

"For New Zealand organisations running PHP-based websites or applications, including those built on platforms such as WordPress, Drupal and Joomla, the immediate priority is to check which versions of PHP they use and apply the latest security updates. This includes systems hosted or managed by external providers. Public-facing services, particularly those handling sensitive information, should be prioritised.

"There is also a broader concern about AI. The same tools that help security researchers discover hidden flaws can also help attackers exploit them. This means organisations may have less time to respond before a vulnerability becomes a serious threat.

"The key lesson is that cybersecurity is not simply about having the right technology. It also requires clear accountability, effective risk management, and the ability to make timely decisions under pressure."

Conflict of interest statement: "No conflict of interest." 

• 한국과학기술미디어센터 초대 이사장에 노정혜 서울대 교수(조선일보)
• 한국과학기술미디어센터장에 이근영 사회평론아카데미 기획위원(연합뉴스)
• 언론-과학자 잇는 ‘가교’ 되겠다…한국과학기술미디어센터 개소(매일경제)
• 대형 산불 때 정치인 찾아가던 기자들이 달라졌다… 과학기술미디어센터, 과학 보도를 바꿔놓다(한국일보)

• 과학자, 연구자에게는 의견과 해설이 온전한 맥락과 함께 제공되는 안전한 발언 공간이 돼줍니다. 선의를 위해 한 논평이 기사화 과정에서 왜곡되거나 부정확하게 변질될 우려를 줄이는 완충 작용을 합니다. 
• 기관 홍보 담당자에게는 기관의 성과를 기자들에게 보다 객관적이고 정교하게 알리고, SMC 글로벌 네트워크를 통해 영향력을 높일 기회를 제공합니다. 
• 기자에게는 사안을 해석하는 데 도움이 될 치우침 없는 종합적인 정보를 빠르고 풍성하게 제공하고, 이를 통해 기사에서 과학과 기술을 보다 자유롭고 편리하게 활용하도록 돕습니다.

지속적으로 SMCK의 전문가 해설 및 의견을 받아보길 원하신다면 아래 링크에 등록해주세요.
📌 기자 등록하고 전문가 의견 받기 >