Websites go dark worldwide as AI exposes critical security flaws

On Wednesday, websites around the globe went dark as critical security flaws in PHP, the programming language powering much of the internet, came to light. PHP is the foundation for a vast array of websites, including online stores, news outlets, and government services. Security firms Wiz and Google-owned Wiz discovered the flaws independently, estimating that PHP runs on approximately 70% of the world's websites.

The US National Security Agency advised organizations to patch immediately or take vulnerable systems offline, emphasizing that attackers could exploit these vulnerabilities to gain direct access to server file systems or databases without needing a password. These flaws were deemed among the most severe ever discovered in PHP, potentially comparable to the 2014 Heartbleed vulnerability.

Volker Dusch, a security engineer at the PHP Foundation, likened this issue to Heartbleed, a major flaw that caused widespread patching efforts. The discovery occurred amid a surge in software security disclosures being facilitated by powerful AI models, with the number of vulnerabilities found in 2026 expected to nearly double last year's record total.

PHP volunteers released a fix on Wednesday, strongly urging affected entities to update their systems promptly. OpenAI's GPT-5.6 Sol model played a crucial role in identifying these flaws during an audit funded by OpenAI. Notable government websites in France, the Netherlands, Belgium, and Australia were among those affected as a precautionary measure.