The NSW Government has temporarily taken down several official websites in response to a critical global security vulnerability affecting the PHP scripting language.
Cyber Security NSW is actively collaborating with various state departments and agencies to ensure necessary updates and security patches are applied to any affected digital infrastructure.
In Short
- Global Incident: The NSW Government is currently responding to a critical global security vulnerability affecting the PHP scripting language.
- Service Disruptions: Some NSW Government websites have been temporarily taken down to apply patches and updates as a precaution.
- No Breaches Reported: Cyber Security NSW has confirmed that to date, no state government agencies have reported any information breaches.
- Local Action Required: NSW businesses, councils, and organisations are strongly urged to follow Australian Cyber Security Centre guidance and patch their systems.
Minister for Customer Service and Digital Government, Jihad Dib, confirmed the precautionary measures, noting that while this is a global incident, no NSW Government agencies have reported any information breaches to Cyber Security NSW to date.
"As a precaution, some NSW Government websites have been temporarily taken down while work to apply patches and updates is completed."
The state’s response is being coordinated alongside national cyber authorities, closely following mitigation advice issued by the Australian Cyber Security Centre (ACSC) to contain any potential risks.
The ACSC has elevated the situation to a ‘Critical Alert’, identifying two severe vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP that both carry a critical severity score of 9.2. According to the federal agency, these flaws could allow unauthenticated attackers to remotely execute malicious code on vulnerable web servers without requiring login credentials.
While the ACSC is not currently aware of active exploitation targeting these specific vulnerabilities within Australia,global researchers have already demonstrated successful exploitation. The vulnerabilities are understood to affect all PHP versions from PHP 5 onwards.
Local businesses, strata groups, and local councils across the Northern Beaches and North Shore are being strongly urged to review their digital infrastructure immediately. Minister Dib specifically called on all NSW organisations to follow ACSC guidance, including identifying where PHP is utilised within their environments and applying patches as required
Read the full technical guidance and patch requirements provided by the Australian Cyber Security Centre to protect your business.
View ACSC Alert