Websites go dark as AI exposes critical security flaws

Websites worldwide went dark on Wednesday as two critical security flaws in PHP were exposed, potentially affecting a vast majority of websites. PHP, a programming language underlying many web platforms, runs on approximately 70 percent of internet sites. The flaws, identified by security firms Wiz and Calif, rank among the most severe vulnerabilities ever found in PHP, and arguably in software history.

The US National Security Agency advised organizations to patch immediately or shut down vulnerable systems. Only websites running PHP on their own servers are at risk. Large platforms built on alternative languages or using operators that can quickly implement the fix remained online. The flaws often grant attackers direct access to a server's file system or database, enabling them to take over web servers without passwords.

The discovery occurred during a surge in software security disclosures, driven by advanced AI models. PHP programmers released a fix on Wednesday, urging those using PHP to update immediately. The flaws had been privately reported to PHP's developers and kept confidential until a fix was ready. However, details leaked online, prompting a rush to take sites offline.

Notable affected entities included French government websites, the Dutch national digital identity service, Australian cyber.gov.au, Wikipedia, and several Pokemon apps.