Websites go dark worldwide as AI exposes critical security flaws

On Wednesday, websites across the globe went dark as critical security flaws in the PHP programming language came to light. PHP, a foundational language for a substantial portion of the internet, was found to have vulnerabilities that could allow attackers to gain complete control of web servers without passwords. The affected platforms span from online stores and news sites to government services.

Security experts Wiz and Google-owned Wiz independently discovered the flaws using AI-powered systems. Wiz estimated that PHP runs on approximately 70 percent of the world’s websites. The US National Security Agency urged organizations to either patch the vulnerabilities immediately or take their systems offline. The flaws could directly access a server's file system or database, enabling full server takeover.

Security engineer Volker Dusch from the PHP Foundation called the issue the most severe the language had faced in over a decade, likening it to the 2014 Heartbleed vulnerability. The discovery occurred amidst a surge in software security disclosures, with 2026 on track to nearly double the 2025 record for vulnerabilities found. PHP volunteers released a fix on the same day, strongly advising anyone using PHP to update their systems immediately.

AI models were instrumental in uncovering the flaws, with the researchers using OpenAI’s GPT-5.6 Sol model. OpenAI, which funded the audit, termed the bugs "one of the most impactful vulnerabilities in recent memory". This incident highlights the growing role of AI in detecting security issues.