Websites go dark as AI exposes critical security flaws

Government websites, online stores, news platforms and other major services went offline worldwide on Wednesday following the discovery of two severe security flaws in PHP, a programming language underpinning much of the internet. PHP powers about 70% of all websites globally, including government services, online retailers and media outlets.

Two security firms, Wiz and Calif, identified the flaws using advanced AI models, estimating them as among the most critical vulnerabilities ever found in PHP, and potentially in software history. The US National Security Agency urged organizations to patch immediately or take vulnerable systems offline. Many large platforms, built on alternative programming languages or with easy update mechanisms, remained online.

The flaws could provide attackers direct access to server files or databases, enabling them to take control of web servers without passwords. The PHP Foundation, which funds developers working on the language, deemed the issue the most serious it had faced in over a decade, comparing it to the 2014 Heartbleed flaw. PHP programmers released a fix on Wednesday.

AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, played a crucial role in the discovery. Experts warn that companies are struggling to keep up with the rapid pace of patches needed to combat AI-driven cyber threats. Numerous government websites, including those of the Paris police in France and the national cybersecurity center in the Netherlands, were inaccessible due to the flaws.