AI readiness is now a security check

BRISBANE — The global disruption caused by critical vulnerabilities in PHP has reinforced a warning from ARM Hub: manufacturers cannot secure systems they cannot see, understand or manage. The PHP flaws, uncovered with the assistance of AI and followed by urgent patches and precautionary website shutdowns around the world, show how quickly long-standing software weaknesses can become an operational crisis.

ARM Hub, the AI Adopt Centre for Australian manufacturing, says the immediate lesson for manufacturers is to use an AI-readiness assessment as a structured self-check of their technology, data, connectivity and security foundations.

"AI readiness is more than adding automation or a chatbot," said ARM Hub AI Engineer Charlotte Birkinshaw. "It's an opportunity to map systems and identify legacy or unsupported technology, understand where sensitive data sits, and put in place the controls needed to operate safely. Right now, AI readiness is a security exercise as much as it is a productivity exercise."

Legacy systems are the immediate exposure

PHP is the programming language behind many business websites and online stores, including platforms such as WordPress, Drupal and Magento. Censys data reported in October 2026 showed about 1.5 million of 2.6 million PHP hosts running versions for which no fix was then available.

Australian factories, plants and supply-chain businesses also rely on operational technology, production software and connected machinery designed for a different threat environment. The Australian Signals Directorate (ASD) notes that operational technology environments can contain legacy devices, outdated protocols and slow replacement cycles, with systems that were not engineered to withstand cyber security incidents.

These environments can be difficult to document, patch, monitor and isolate. SMEs may have undocumented systems, limited visibility, poor integration with modern identity and monitoring controls, and no clear view of how equipment, suppliers and data systems connect.

ASD Director-General Abigail Bradshaw has warned that AI will either prompt decisions to replace legacy technology or, if Australia does not move quickly enough, make legacy technology "almost certainly … the first to be compromised in a major AI-enabled attack".

October shows the speed of AI-enabled risk

The PHP incident demonstrates the changed risk environment. Two critical vulnerabilities in PHP, a language used across a large share of the web, were discovered with AI assistance and prompted emergency fixes, with government and other organisations temporarily taking websites offline while systems were patched.

ASD guidance warns that malicious actors may use AI to rapidly discover and exploit vulnerabilities, especially in websites, target many victims at once, and move rapidly from initial compromise to data theft or extortion.

For manufacturers, the exposure is not limited to public websites. Customer portals, supplier systems, remote-access tools, industrial software, cloud applications and connected equipment can all form part of an attack surface that is poorly understood if the underlying technology stack has not been modernised.

Security firm ZeroFox found manufacturing was the industry most targeted by ransomware and digital extortion in the second quarter of 2026, a position it says the sector has held consistently since at least 2021.

AI readiness as a security self-check

ARM Hub says a practical AI-readiness review gives manufacturing businesses a clear picture of whether they are prepared for both AI adoption and AI-enabled threats. A practical review should examine:

• What systems, machines, software and data sources the business operates, including legacy and unsupported technology.
• Which services are internet-facing, who can access them, and whether they are still required.
• Whether security patches, identity controls, monitoring, backups and network segmentation are current and effective.
• Where sensitive production, customer, design and commercial data is stored, shared or exposed.
• Whether AI, automation and robotics can be deployed safely, with human oversight and clear governance.

ASD recommends that organisations minimise their attack surface, remove unnecessary internet-facing services, replace services no longer receiving vendor patches, apply updates rapidly, and use AI carefully and under human supervision to analyse security logs and test for vulnerabilities.

"Manufacturers do not need to become cyber security specialists overnight," said Birkinshaw. "But you do need to know what you're running, what's connected, what is out of date, and what would happen if a key system went down. AI readiness gives a disciplined way to answer those questions."

Modernisation supports security and productivity

The average age of Australian manufacturing capital rose from 11 to 13 years over the decade to 2024, and the Australian Government has identified robotics, automation and advanced manufacturing investment as part of the response to ageing assets, labour pressures and stagnant productivity.

ARM Hub helps manufacturers design, test and deploy advanced technologies, from audits and roadmaps through to prototyping, automation and AI. Its approach maps how a business's technology fits together, identifies priority improvements, and supports implementation through services including Data & AI-as-a-Service for businesses without internal data science capability.

Modernising to support AI brings unmanaged systems into view, reduces exposure created by unsupported or poorly governed technology, and creates the foundation for AI-enabled defensive measures recommended by ASD. It also improves productivity, quality, consistency, operational decision-making and resilience.

"Delaying modernisation does not reduce risk," said Birkinshaw. "It leaves businesses running older systems with less visibility and fewer options, while attackers' tools get faster and more capable. The businesses that treat AI readiness as a security and productivity check will be better placed to adopt new technology, protect their operations and compete."

ENDS

About ARM Hub: The Advanced Robotics for Manufacturing Hub is one of Australia's four government-backed AI Adopt Centres. Based in Brisbane, ARM Hub partners with manufacturers, SMEs, researchers and technology companies to drive innovation and productivity through advanced automation and AI solutions.

Media Contact: Mike Woodcock, Communications Director, ARM Hub
E: Mike.Woodcock@ARMHub.com.au
P: +61 411 969 248

Sources

Reuters, "Government websites go dark after AI-discovered flaw sparks security scramble," 21 October 2026:
https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/

Reuters, "What is PHP and why did it take government websites offline?," 21 October 2026:
https://www.reuters.com/technology/what-is-php-why-did-it-take-government-websites-offline-2026-10-21/

Australian Signals Directorate, "Defending against AI-enabled cyber attacks: Guidance for small businesses," 6 July 2026:
https://www.cyber.gov.au/sites/default/files/2026-07/Defending%20against%20AI-enabled%20cyber%20attacks%20-%20Guidance%20for%20small%20businesses.pdf

Australian Signals Directorate, "Defending against AI-enabled cyber attacks," 6 July 2026:
https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/defending-against-ai-enabled-cyber-attacks

Cyber Daily, "ASD chief says Aussie companies' ageing tech a growing concern in the age of AI," 16 September 2026:
https://www.cyberdaily.au/security/14190-asd-chief-says-aussie-companies-aging-tech-a-growing-concern-in-the-age-of-ai

The Mandarin, "ASD chief targets legacy tech," 15 September 2026:
https://www.themandarin.com.au/320160-asd-chief-targets-legacy-tech/

ZeroFox, "Q2 2026 Ransomware Wrap-Up," 6 July 2026:
https://www.zerofox.com/intelligence/q2-2026-ransomware-wrap-up/