Websites worldwide go dark as AI exposes security flaws

On Wednesday, websites across the globe went dark due to the exposure of two critical flaws in PHP, a programming language fundamental to much of the internet. The US National Security Agency advised organizations to patch immediately or take vulnerable systems offline, stating that the flaws could provide attackers with direct access to server file systems or databases without requiring a password.

PHP underpins popular web design platforms, meaning the vulnerabilities could impact a wide array of websites, ranging from e-commerce sites and news outlets to government services.

The discovery of these flaws coincided with a surge in software security disclosures, driven by advanced AI models, with the number of vulnerabilities reported in 2026 expected to nearly double last year's record total. PHP volunteers published a fix on Wednesday, warning that it was imperative for users to update their systems immediately.

The flaws were initially reported in August by security firm Calif and by OpenAI, the company behind ChatGPT, on the same day. Subsequently, further exploitation methods were reported by Google-owned cloud security firm Wiz.

These vulnerabilities had been privately disclosed to PHP developers but were kept confidential until a fix was prepared. However, details leaked online on Tuesday, prompting a swift response from affected entities. In France, local government websites, including the Paris Police Prefecture, were inaccessible from Wednesday afternoon at the request of the French National Cybersecurity Agency.

Similarly, the Netherlands took precautionary measures by taking down the national digital identity service DigiD, the House of Representatives website, and the national cybersecurity center. Belgium's foreign ministry also temporarily took its websites offline as a precaution, although there were no recorded attacks on Belgian sites by the Centre for Cybersecurity Belgium.