Websites go dark as AI exposes critical security flaws

Global governments and companies shut down websites on Wednesday after critical security flaws were exposed in PHP, a programming language powering a majority of the internet. Experts estimate that 70% of the world's websites run on PHP and that these vulnerabilities are among the most severe in software history. The US National Security Agency and national cybersecurity agencies in several countries called for immediate patching or offline procedures.

Global governments and companies shut down websites on Wednesday after critical security flaws were exposed in PHP, a programming language powering a majority of the internet.

Surge in software security

Since PHP is widely used as the foundation for many websites, including online stores and news outlets, as well as government services, the vulnerabilities discovered posed a significant threat to a vast range of sites.

Context This discovery occurred amid a surge in software security disclosures fueled by increasingly powerful AI models, with the number of vulnerabilities on track to roughly double last year's record total. For example, in August, security firm Calif discovered these flaws using OpenAI's GPT-5.6 Sol model as part of an OpenAI-funded audit of PHP's code. The flaws were reported privately to PHP's developers and kept confidential while a fix was being prepared, but details leaked online on Tuesday, prompting the rush to take sites offline before hackers could exploit them.