What a critical flaw in one of the internet’s oldest programming languages means for the Tasmanian businesses running on it.
In the last week of October, the Australian Signals Directorate’s own cyber security website briefly went offline, along with the Parliament of Australia’s site, because of a newly discovered flaw affecting a huge share of the websites on the internet. If the agency that tells the rest of the country how to do cyber security couldn’t keep its own front door open, it’s worth a few minutes of any Tasmanian business owner’s time to understand what happened.
This wasn’t an attack aimed at any particular business or country. It was a flaw in underlying software that businesses all over the world didn’t know they were relying on. Governments in Germany, Finland, Belgium and the Netherlands pulled sites offline as a precaution while they patched, and the Australian Cyber Security Centre issued its own warning.
A Flaw Found by AI, in Code Running Almost Everywhere
The vulnerability sits in PHP, a programming language that quietly underpins a huge share of the internet, including popular platforms many small businesses build their websites on. It was found using an artificial intelligence tool, which is part of the story. AI now works on both sides of the security fence, and this time it found the hole before criminals did. That won’t always be the order things happen in.
The timeline moved fast. PHP’s developers released emergency fixes the same day the flaw became public, and major infrastructure providers pushed out protective firewall rules before most IT teams had finished reading the advisory. Even so, several government websites were caught mid-patch and went offline for hours while the fix was applied. For a business without anyone watching security advisories day to day, that kind of turnaround isn’t realistic without outside help.
Why This Matters More for Small Business, Not Less
Larger organisations usually have an IT team watching for this kind of advisory and a process for patching quickly. Most small and medium Tasmanian businesses don’t, and many have no clear idea what their website or booking system is built on.
Picture a local retailer whose website was built by a designer a few years ago and has run on autopilot ever since. Nobody at the business owns the relationship with the hosting provider, and nobody has asked what software the site runs on. If that host patched automatically during last month’s scramble, the business never knew there was anything to worry about. If it didn’t, the business was exposed for as long as nobody noticed. The difference between those two outcomes usually isn’t luck. It’s whether anyone was watching.
If you’ve never asked your web developer or IT provider what your site runs on, this is the reason to ask now rather than after something goes wrong.
Patching Is Boring Until It Isn’t
It’s hard to get excited about the word “patch.” It’s also one of the cheapest, least glamorous things a business can do to reduce its risk. The businesses that came through this scramble cleanly were almost all already running current software, with someone responsible for applying updates quickly. The ones that didn’t weren’t necessarily careless. They just hadn’t made patching anyone’s job.
The Pritech Approach
At Pritech, we monitor exactly these kinds of advisories for our clients, so a critical flaw like this one is patched within hours of a fix being available, not whenever someone happens to notice. If you don’t know who’s watching for the next one on your behalf, that’s worth a conversation.
Get in touch with our team today.
