Widespread PHP Vulnerabilities Threaten Australian Small Business Websites

Krebs on Security reported today that a pair of critical vulnerabilities in the PHP scripting language are being actively exploited in the wild, causing a surge of 404 and ‘Page Not Found’ errors across the internet.

The flaws allow an attacker to gain full control of the underlying server by injecting malicious code, and security researchers estimate that nearly 70 percent of active websites run vulnerable versions of PHP that require immediate updates.

In Australia, a large proportion of small and medium‑size enterprises rely on PHP‑based platforms such as WordPress, Joomla and Drupal for their online presence, meaning many local businesses could see their sites taken offline or compromised if the patches are not applied promptly.

IT managers and managed service providers are urged to verify the PHP version on every web server, apply the latest security releases from the PHP development team, and run vulnerability scans to confirm that the patches have been successful. Enabling a web‑application firewall and monitoring for unusual traffic can also help mitigate exploitation while updates are rolled out.

Wepro Technology, a Darwin‑based IT support and training firm, recommends that Australian SMEs work with their MSP to fast‑track the patching process and consider security‑focused training such as its CCNA and upcoming CEH courses to build internal resilience against similar threats.