Australia tells users to expect service outages

Australians should brace for interruptions to essential online services. The Australian Signals Directorate, or ASD, warned on Monday that organizations may take systems offline to fix security flaws. The agency stated that protecting data now ranks higher than keeping services accessible.

The warning appears in the ASD's annual cyber threat report. The agency handled 1,500 cybersecurity incidents during the 2025-26 period. That figure represents a 20 percent increase over the previous year. ASD also notified external organizations, including businesses and government bodies, of more than 4,400 potentially malicious incidents. That notification count rose by 80 percent in one year.

The report attributes the surge to hostile foreign governments, criminals, and hackers using artificial intelligence. Attackers use AI tools to collect intelligence, disrupt infrastructure, and steal money. State-based actors made persistent attempts to breach Australian networks. ASD noted that actors in the Indo-Pacific region may be preparing for future conflicts through intelligence gathering and disruption.

ASD director general Abigail Bradshaw said Australia needs to improve its technology foundations. She called for AI tools to automate defensive work. Bradshaw mentioned ASD's access to Anthropic's Mythos model. The developer said it could not release the model publicly because it identifies previously unknown flaws in IT systems.

Defence minister Richard Marles and home affairs minister Tony Burke urged Australians to improve their protections. Marles said security should come before keeping systems online. This approach may leave more services temporarily unavailable while organizations secure them. Bradshaw identified ageing technology as a major vulnerability. She pointed to systems that no longer receive updates from their makers.

Newly identified weaknesses in PHP, a programming language used by most websites, forced governments and businesses to act last week. ASD urged organizations to keep systems updated and report suspicious incidents. The agency said cybersecurity must be treated as a central business risk for organizational leaders.