The NCSC proactively notified cyber security customers and trust groups to be alert to the risk and install PHP updates, Bickerstaffe said.
If organisations are unable to patch immediately, they should consider disabling public-facing web services, Bickerstaff said.
The NCSC has also posted a technical advisory, including links to PHP fixes.
But Adam Holt – a tech consultant and “Claude community ambassador” for the AI created by Anthropic – tells the Herald he used AI agents to scan every website with a .nz address, and as of midday, 90% had not applied PHP’s patch.
A third were using an outdated version of the software that was end-of-life and too old for the update.
By 4pm, 86% of websites that show their PHP version had not put the patch in place – and a third were “running PHP so outdated there was no official fix for it”. Holt can tell if the version of PHP on a site predates the release of the patch.
Holt has put a live tracker online here.
Some government sites offline, including NZ
PHP (which originally stood for “Personal Home Page” in the early days of the web) is used by many government websites, including those in New Zealand.
Several government websites in France, Denmark and the Netherlands were taken offline as a precautionary measure, according to an AFP report.
When asked if any NZ Government sites had been taken offline, an NCSC spokesperson responded, “NCSC is aware that some websites will have been taken down to apply patching and mitigation strategies.”
Which sites? The spokesperson said, “Providing information about the security status of specific websites could make those or other sites targets of malicious activity.”
Asked, “Are you aware of any local sites of any type being compromised?”, the spokesperson responded: “At this point, it is too early to tell the full impacts of these vulnerabilities.”
There have so far been no reports, in NZ or globally, of any sites being compromised as a result of the PHP vulnerability.
Major New Zealand government websites are up and running. The Herald.
The PHP issue is the most widespread security vulnerability discovered by an AI.
Experts have also been concerned at AI’s potential to amplify hackers’ powers, and the new phenomenon of rogue AI agents.
OpenAI chief executive Sam Altman last month apologised to the Australian Government over a June incident – only revealed three months later – in which a ChatGPT agent hacked into Australia’s Medicare system. No personal information was accessed.”
“As AI systems become more capable and more autonomous, they can move faster than our institutions … or make decisions that people no longer understand or control,” Altman said in a speech to the UN on September 23.
Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.
