Websites go dark as AI exposes critical security flaws
It could allow ‘attackers to get into your servers without any authorization, without any username or password.’
WASHINGTON, United States (AFP) — Governments and companies around the world shut down websites as they raced Thursday to protect themselves from hacks after artificial intelligence (AI) uncovered critical flaws in a widely used programming language called PHP.
PHP helps run about 70 percent of the world’s websites — from online stores and news outlets to government services — according to Wiz Research, one of the cybersecurity firms that found the two flaws.
Created in the early 1990s, PHP originally stood for “personal home page” but now means “hypertext preprocessor” and sits underneath popular web design platforms.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” a Wiz blog post said.
Increasingly powerful AI models can spot weak points in back-end computer code that have gone unnoticed by humans for years.
That has heightened cybersecurity fears, with the number of software vulnerabilities discovered worldwide in 2026 on track to roughly double last year’s record total.
PHP programmers released a fix Wednesday, and the US National Security Agency told organizations to patch their sites immediately or pull vulnerable systems offline — a call echoed by authorities from Japan to the European Union.
A platform affiliated with China’s Ministry of Industry and Information Technology urged the same, warning of “two critical remote code execution vulnerabilities with severe impact” in PHP.
Only sites that run PHP on their own servers are exposed. Many large platforms are built on other programming languages or use operators that could install the fix quickly and were able to stay online.
Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales, Sydney, described the discovery as “quite devastating.”
It could allow “attackers to get into your servers without any authorization, without any username or password,” she told Agence France-Presse.
“Once they are in the servers, they can do anything they want” — from stealing sensitive information to modifying website content — she added, urging institutions to “take it seriously.”