Websites go dark as AI exposes critical security flaws

On Wednesday, numerous websites across the globe went offline following the discovery of critical vulnerabilities in PHP, a widely used programming language that underpins a significant portion of the internet. This included government agencies and corporations, as PHP supports a vast array of online platforms, including e-commerce sites, news outlets, and government services.

Security firms Wiz and Calif identified the flaws using AI tools like OpenAI's GPT-5.6 Sol model, highlighting that PHP powers approximately 70% of the world's websites. The US National Security Agency advised organizations to patch these vulnerabilities immediately or disable affected systems to prevent potential exploitation. Only websites running PHP on their own servers are at risk, as many large platforms utilize alternative programming languages or can swiftly implement the fix.

The security flaws provide an easy pathway for attackers to gain control of server file systems and databases, negating the need for passwords. Volker Dusch, a PHP Foundation engineer, likened the issue to the 2014 Heartbleed vulnerability, which sparked global urgency to patch systems. PHP programmers promptly released a fix on Wednesday, urging users to update their systems immediately.

The discovery coincided with a surge in software security disclosures, driven by advanced AI models, with 2026 on track to see a nearly doubling of vulnerabilities found compared to the previous year. PHP Foundation funded developers worked on the language released a fix on Wednesday. The flaws were privately reported to PHP developers, and details leaked online before the planned fix release, prompting sites to take down their services as a precaution.