This week the Australian Signals Directorate posted that its own website, cyber.gov.au, and other Australian government sites had reported outages.[1] The outages were a defensive response to a global PHP vulnerability, not evidence that Australia itself had been singled out. PHP is the free programming language that quietly runs a large part of the web, from WordPress and Drupal to Wikipedia and a good many government portals.
On 21 October the PHP project released emergency fixes for two critical vulnerabilities that, in the right conditions, let an attacker run code on a server without logging in.[2] One of the security firms that reported them says every PHP version released in the last decade is affected by at least one of the two.[3] Agencies in the Netherlands, Finland, Denmark and France took services offline as a precaution.[1]
What caught my eye was not the flaw itself. Long-lived code carries long-lived design assumptions. It was the PHP Foundation’s own account of how long the fix took.
The first signs of the problem turned up in 2024, during PHP’s first external security audit in years. The team developed several possible fixes, each with real costs, and could not agree on one. Work “stalled and restarted repeatedly over months”. The Foundation does not dress it up: “the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”[2]
The Foundation credits Germany’s Sovereign Tech Agency, a government fund for open-source infrastructure, with funding the 2024 audit. Its appeal ends by asking “governments and public institutions whose services run on PHP” to help, “on a sustained basis”.[2]
In forty years of delivering systems, I built a great deal on open-source components. I cannot recall a single project where anyone put a line in the budget to support the people who maintained them.
A few days ago I wrote that trust is work that has to be designed, funded and maintained.[4] This is what that sentence looks like when it fails. Free software is free to use. It is not free to keep. Somebody has to read the bug reports, argue over the fix, test it across every platform and, when it matters, work around the clock to ship it. According to the Foundation, that work on PHP still rests on “a small group of foundation-funded developers and a little volunteer help”.[2]
So here is a question I cannot answer, and would like to: does Australia make a sustained, public contribution to the open-source infrastructure on which its services depend? If it does, it should say so. If it does not, this week was a cheap lesson.
The next one may not be.
ABC News, “Australian government sites among those exposed to ‘critical’ PHP software FLAW”, 22 October 2026.
The PHP Foundation, “Today’s PHP Security Release, and How We’re Strengthening PHP Security”, 21 October 2026.
Wiz Research, “PHP2Shell”, October 2026.