On 21–22 October 2026, a cluster of Australian government websites flickered offline or displayed maintenance pages. The Australian Signals Directorate's own cyber.gov.au portal went dark. The Australian Bureau of Statistics site was unavailable. Jobs and Skills Australia and others followed. A spokesperson for the Minister for Cybersecurity confirmed that sites had been taken down temporarily "as work is undertaken to mitigate risks arising from this vulnerability." The Australian Cyber Security Centre issued a critical alert, noting it was not yet aware of active exploitation in Australia but urging organisations to identify PHP installations and apply patches immediately.
The trigger was not a targeted intrusion. It was the public disclosure of two critical remote-code-execution vulnerabilities in PHP itself, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP underpins roughly 70 percent of the web, including countless government, media, and commercial sites that run WordPress, Drupal, or custom applications. The flaws, present in versions stretching back more than a decade, allowed unauthenticated attackers, under the right conditions, to execute arbitrary code on the server or read process memory that might contain credentials and keys. Researchers at cybersecurity firms Calif and Wiz, assisted by frontier AI models (including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon), turned long-standing memory-handling edge cases into practical exploits. What had once sat at the edge of human analysis became demonstrable in weeks. PHP maintainers released emergency patches; governments and operators worldwide, including in the Netherlands, Finland, and elsewhere, pulled sites offline as a precaution while they applied fixes. Reports of scanning and exploitation attempts appeared almost immediately.
This episode is a clear illustration of two overlapping realities. First, the software stack that runs public-facing government websites is ordinary commercial and open-source code, not exotic hardened systems. Second, artificial intelligence is now accelerating both the discovery of such flaws and the speed at which they can be weaponised. The same models that help defenders audit code can, in adversarial hands, compress the time between disclosure and working exploit.
Are government sites vulnerable in a wartime cyber campaign?
They are, with important qualifications. Public government websites are attractive targets precisely because they are designed to be reachable. In a conflict, an adversary need not penetrate the most sensitive classified networks to achieve useful effects. Taking down or defacing official sites, injecting false information, or disrupting citizen-facing services (tax, health, emergency notifications, parliamentary information) can create confusion, erode trust, and force defenders to divert resources. The PHP incident shows how a single widely deployed component can create simultaneous exposure across many agencies. Similar patterns have appeared in past conflicts and campaigns: supply-chain compromises, zero-days in common libraries, and opportunistic exploitation of unpatched public systems.
Governments are not defenceless. Australia's response: rapid advisory from the Australian Signals Directorate, temporary takedowns, and coordinated patching, demonstrates standard incident handling. Critical backend systems are typically segmented, monitored more heavily, and less dependent on the same public web stacks. Air-gapping, strict access controls, and dedicated security operations centres raise the bar for core military and intelligence networks. Attribution, diplomatic signalling, and the risk of escalation also constrain pure cyber campaigns against state infrastructure.
Nevertheless, the residual risks are real and grow in a wartime setting. Legacy systems and the sheer number of public sites make complete, instantaneous patching difficult. AI-assisted offensive tools lower the skill threshold and increase the volume of scanning and exploit attempts. Hybrid attacks that combine cyber disruption with information operations can amplify the impact of even temporary outages. Past examples, from the disruption of Ukrainian government and critical infrastructure systems to broader campaigns targeting government networks, show that states treat public digital services as legitimate elements of the battlespace.
The practical lesson from the outages is not that government websites are uniquely fragile, but that they sit on the same contested foundation as the rest of the internet. Continuous inventory of dependencies, rapid patching capacity, network segmentation, and the use of AI for defensive discovery are the necessary countermeasures. In peacetime these reduce ordinary risk. In wartime they become the difference between a manageable disruption and a broader loss of operational and informational coherence. The PHP flaws were found and patched relatively quickly once AI helped surface them. The next set of flaws, or the next deliberate campaign, will not wait for a convenient disclosure timeline.