Cybersecurity experts worldwide were caught in a "rat race" to secure sites in the hours between when the weakness was found via artificial intelligence and a fix was developed.
Two patches for the problem were released mid-morning on Thursday, with governments and large corporations jumping into action.
Many sites were taken offline while the work was completed.
Usually, a vulnerability issue was patched before news of the problem was released, University of Canberra cybersecurity expert Abu Barkat Ullah said.
"Otherwise, there is a race between the organisation securing its system and attackers trying to exploit it," Dr Barkat Ullah said.
"Time remediation remains a challenge for small and medium businesses that may lack dedicated IT teams."
The head of cybersecurity firm Aristotle Metadata, Sam Spencer, said it would be difficult for the federal government to bolster all its systems.
"The government is currently scrambling again to try and identify impacted systems that are at threat from one of the largest cybersecurity vulnerabilities in the last decade," he told AAP, urging departments to keep clear catalogues of their data.
The Australian Signals Directorate, the intelligence body that handles cybersecurity threats, said its website had been among domestic government sites affected by an issue with software that powers much of the internet.
"We are aware of an outage that may be affecting government websites," the agency said in a statement.
Government websites in Europe and Asia went offline and US departments also moved to protect networks after a disclosure of two critical vulnerabilities in a widely used programming language called PHP.
PHP is a programming language used to run websites and powers millions of sites that depend on popular application such as WordPress.
When a visitor loads a page, a server running PHP assembles the content and sends it to the browser.
The Australian Signals Directorate said the agency was not aware of active exploitation of the vulnerabilities.
"Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available."
The directorate's full statement was inaccessible for several hours before coming back online.
The websites of several government departments and agencies had been affected, a spokesperson for Home Affairs Minister Tony Burke said.
"Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability," the spokesperson said.
"Organisations and individuals using PHP within their environments should follow advice from the Australian Signals Directorate."
The flaw in PHP was discovered using an artificial intelligence tool.
Developers of the PHP programming language have released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years.
With reports that hackers were exploiting the flaws to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline as a precaution.
Dutch prime minister Rob Jette said he was closely monitoring the situation and Japanese Prime Minister Sanae Takaichi urged website owners to use a new fix.
7°C