Websites go dark as AI exposes critical security flaws worldwide

Websites and online services were taken offline because two serious flaws were found in PHP, a programming language used by many websites. Governments and companies wanted to prevent attackers from entering vulnerable servers while developers prepared a fix. Some services stayed online because they used other languages or could patch quickly.

Government agency sites in Australia, Finland, and the Netherlands went dark. Insurance firms, transport operators, media outlets, and a Pokemon sleep tracker also entered emergency maintenance. Wikipedia’s foundation warned users that outages could occur while it addressed the vulnerabilities.

PHP programmers released a fix Wednesday, and authorities urged organizations to install it immediately or remove vulnerable systems from the internet. Details leaked online Tuesday, increasing fears that hackers could exploit the flaws quickly, possibly with AI assistance. So far, the article reports little evidence of damaging attacks.

PHP is a programming language used to build and operate websites. It was created in the early 1990s and originally stood for “personal home page.” Its name now means “hypertext preprocessor.” PHP commonly works behind the visible webpage, processing requests and helping websites deliver content and services.

The language sits underneath popular web design platforms. That means visitors may never see PHP directly, but their online stores, news websites, or government services may depend on it. When PHP runs on an organization’s own servers, a flaw in the language can expose those systems.

The article describes PHP as a major part of the web, supporting about 70 percent of websites worldwide. This broad use explains why the newly discovered vulnerabilities caused international concern. Sites using other programming languages were not affected by these specific PHP flaws.

PHP is used across about 70 percent of the world’s websites, according to Wiz Research. This makes it one of the most widely deployed technologies supporting online services. Its reach includes online stores, news outlets, government services, and other sites built on popular web platforms.

The percentage matters because a security weakness in widely used software can affect organizations in many countries at once. The article reports that government websites, insurance companies, transport operators, media outlets, and apps had to respond. However, not every website was exposed. Only sites running PHP on their own servers faced these particular flaws.

Some large platforms stayed online because they used different programming languages or had operators able to install the fix rapidly. Even so, the scale of PHP’s use made immediate patching important. The article also says vulnerabilities discovered worldwide in 2026 were on track to roughly double last year’s record.

The article identifies two critical remote code execution vulnerabilities in PHP. It does not provide separate technical names for them. Remote code execution means a flaw may let an attacker make a vulnerable computer run commands from elsewhere. That makes the problem more dangerous than a weakness requiring ordinary login access.

Rahat Masood said attackers could get into affected servers “without any username or password.” Once inside, they could potentially steal sensitive information or modify website content. A platform affiliated with China’s Ministry of Industry and Information Technology warned that the vulnerabilities had a severe impact.

Wiz called the findings among the most severe vulnerabilities discovered in PHP and arguably in software history. Volker Dusch compared them with Heartbleed, a major 2014 flaw. The danger increased when details leaked before the planned fix, raising fears that hackers could exploit the weaknesses quickly, potentially with AI assistance.

A remote code execution flaw can allow an attacker to make a server run unauthorized commands from a distance. In this case, Rahat Masood said attackers could enter affected servers without a username or password. That removes a major barrier normally used to protect online systems.

Once inside, attackers could do “anything they want,” Masood warned. Possible results include stealing sensitive information and modifying website content. Steve Kerrison also warned that user-run blogs could be weaponized to spread computer viruses, send spam, or distribute malicious content.

The consequences might continue even after the original intrusion. Data breaches could expose personal details, creating opportunities for phishing attacks designed to steal passwords later. The article reports little evidence of damaging attacks so far, but organizations still faced serious exposure. Vulnerable sites could remain at risk for days, weeks, or months if their operators did not know about the problem.

Governments and companies took websites offline because the PHP flaws could allow remote code execution without passwords. Waiting could give attackers time to enter servers, steal information, or alter public content. The urgency grew because details leaked online one day before the planned fix was released.

Security researchers feared that increasingly capable AI could help hackers understand and exploit the weaknesses quickly. Steve Kerrison said this fear fueled the rush to respond. The US National Security Agency told organizations to patch immediately or pull vulnerable systems offline. Authorities in Japan, the European Union, and China issued similar warnings.

Taking a site offline reduced exposure while operators installed the PHP fix. Some organizations could remain online because they used other programming languages or patched quickly. The article reports little evidence of damaging attacks so far, but warns that less-informed site operators could remain vulnerable for days, weeks, or months.

In general, a programming language such as PHP provides instructions that web servers use to process requests and deliver website content. PHP often sits underneath website platforms, so a defect in its code can affect the services built on it. The article shows why this connection matters: a flaw in shared software can reach many organizations.

A security patch changes the vulnerable software to block the dangerous behavior. Operators install the PHP fix on servers, test their services, and restore them if the systems work safely. If a site runs PHP on its own server and cannot patch quickly, disconnecting it removes the immediate route attackers could use.

The article reports that PHP programmers released a fix Wednesday. Some large platforms stayed online because they used other languages or could apply the fix quickly. Others went offline during emergency maintenance. This process will remain important as AI finds more previously unnoticed weaknesses in widely used software.