Websites go dark after AI exposes major programming language security flaw

Critical security flaws have been discovered in PHP, a widely used programming language that helps power around 70% of the world’s websites.

Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured.

The warning prompted governments, companies and major online services in several countries to temporarily shut down websites and other systems as a precaution.

The vulnerabilities were uncovered with the help of artificial intelligence. Security firm Calif identified one of the flaws in August during an OpenAI-funded audit of PHP, while Google-owned cybersecurity company Wiz independently discovered and reported both vulnerabilities. OpenAI said its GPT-5.6 Sol model was used in the Calif research.

The PHP security team rated both vulnerabilities 9.2 out of 10 for severity. Details were meant to remain confidential while developers prepared fixes, but information about the flaws emerged publicly before the planned release, intensifying the race to secure vulnerable systems.

Security researchers initially reported little evidence of widespread exploitation before the vulnerabilities became public. However, attempted attacks have since been detected, increasing concern that unpatched systems could be targeted.

Websites and services taken offline

The Wikimedia Foundation, which operates Wikipedia, said it deliberately took a number of supporting services offline while security updates were installed and warned users that some disruption could occur.

Amazon Threat Intelligence also detected attempts to exploit the vulnerabilities, including activity before their public disclosure. Security researchers have since reported attempts to target vulnerable systems in the wild.

Several European governments have also taken precautionary action.

France’s Interior Ministry temporarily took prefecture websites offline while updates were applied, while Germany’s federal IT provider ITZBund shut down several government websites. German officials said the move was precautionary and that no security incidents had been identified.

Government and public-service websites were also taken offline in countries including the Netherlands and Finland, as authorities worked to secure their systems.

In the UK, the National Cyber Security Centre urged organisations running PHP to identify vulnerable systems, monitor them for suspicious activity and install security updates as soon as possible.