GovCMS and Moodle Pull Back as AI-Found ‘PHP2shell’ Flaws Trigger a Rare ASD Alert

Australian government websites, education platforms and web hosts limited access or went offline this week after researchers using AI uncovered two critical vulnerabilities in PHP, the programming language behind an estimated seven in 10 websites, ABC News reported on October 22. The flaws, dubbed “PHP2shell”, can let attackers run their own code on affected servers without logging in.

The Australian Signals Directorate issued a rare critical alert aimed at everyone from government and critical infrastructure operators to individuals and families. GovCMS, which hosts many major government websites, blocked direct access to its servers while keeping cached copies of public pages available. Moodle, whose learning software powers hundreds of thousands of university and school platforms, took its website offline as a precaution before restoring services after patching, and hosting provider VentraIP restricted some file uploads on customer sites.

The PHP Foundation released a fix and urged operators to update immediately. Amazon Web Services said it had seen attempts to exploit the vulnerability as early as October 17, before public disclosure. Security expert Troy Hunt told ABC News Breakfast that operators must patch very quickly or take services offline, and that Australians should expect elevated numbers of data breaches.

What it means in practice

The AI angle cuts both ways. US security firm Calif said it confirmed one of the flaws using OpenAI’s models, building on earlier research that had only theorised about the attack path; the bug appears to date back to PHP versions released as early as 2012. The PHP Foundation said AI helped assess reports, but that a person made every call and worked on every patch. OpenAI warned that the same capabilities could help attackers build exploits quickly.

That tension is already on Canberra’s agenda. The ASD’s chief has argued Australia needs an AI early-warning system, and Home Affairs ordered AI cyber reviews after the Medicare breach. OpenAI has since named an Australian incident taskforce of its own.

What to watch: whether any Australian organisation reports a breach tied to PHP2shell, how quickly smaller hosts, councils and schools patch, and whether the ASD’s alert feeds into the AI security funding and standards work now under discussion in Canberra.