Why are websites going dark worldwide? AI has uncovered something alarming

Washington: Websites operated by governments, businesses and major online platforms across the world were temporarily taken offline on Thursday after artificial intelligence tools uncovered two critical security vulnerabilities in PHP, a programming language used by nearly 70 per cent of websites globally.

The discovery triggered an international cybersecurity alert, with authorities urging organisations to immediately update vulnerable systems or disconnect them from the internet to prevent potential cyberattacks.

The vulnerabilities were identified using advanced AI models capable of examining software code and detecting weaknesses that may have escaped human scrutiny for years.

According to cybersecurity firm Wiz Research, PHP supports approximately 70 per cent of websites worldwide, including online shopping platforms, news portals and government services.

The programming language, developed in the early 1990s, was originally known as Personal Home Page before being renamed Hypertext Preprocessor. It remains a key technology behind several widely used website development platforms.

"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," Wiz said in a blog post.

Emergency security alert issued worldwide

PHP developers released a security patch on Wednesday, prompting governments and cybersecurity agencies to issue urgent warnings.

The US National Security Agency advised organisations to immediately install the update or take vulnerable systems offline until they could be secured.

Similar alerts were issued by authorities in Japan and the European Union.

A platform associated with China's Ministry of Industry and Information Technology also warned organisations about "two critical remote code execution vulnerabilities with severe impact" in PHP.

The vulnerabilities primarily affect websites running PHP on their own servers. Platforms built with other programming languages, or those whose hosting providers quickly deployed the security update, were largely able to keep operating.

Cybersecurity specialists warned that the flaws could allow attackers to gain unauthorised access to servers and potentially compromise sensitive information.

Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as "quite devastating."

She warned that the vulnerabilities could allow "attackers to get into your servers without any authorisation, without any username or password."

"Once they are in the servers, they can do anything they want" -- from stealing sensitive information to modifying website content -- she added, urging institutions to "take it seriously."

Government websites and online services disrupted

The security scare forced several government agencies and private organisations to suspend their websites while technical teams installed emergency updates temporarily.

Government websites in Australia, Finland and the Netherlands were among those affected.

Insurance companies, transport operators and media organisations also carried out emergency maintenance, temporarily disrupting access to some online services.

Several popular applications, including a Pokemon sleep-tracking app, were taken offline as a precaution.

The foundation responsible for operating Wikipedia also warned users about possible service interruptions while it addressed the vulnerabilities.

"If you run PHP, it is imperative that you update now," the PHP Foundation, which supports developers working on the programming language, said in a blog post.

Volker Dusch, a security engineer associated with the foundation, told the Wall Street Journal that the vulnerabilities represented PHP's most serious security crisis in more than a decade.

He compared the situation to Heartbleed, a major security vulnerability discovered in 2014 that forced organisations worldwide to urgently update their systems.

How AI uncovered the vulnerabilities

The discovery has also highlighted the growing role of artificial intelligence in cybersecurity research.

Security firm Calif first identified the vulnerabilities in August while conducting an OpenAI-funded security audit of PHP's source code.

Researchers used OpenAI's GPT-5.6 Sol model to analyse the code and identify potential weaknesses.

OpenAI described the discovery as a major development in AI-assisted cybersecurity research, saying it "marks a new phase, where AI can find security bugs with internet-scale impact."

Weeks later, Wiz independently discovered the same vulnerabilities using AI models, including Google's Gemini 4 Argon and GPT-5.6 Sol.

Both discoveries were privately reported to PHP developers, allowing them to prepare a security patch before publicly revealing the flaws.

However, details of the vulnerabilities leaked online on Tuesday, a day before the scheduled release of the security update.

The leak intensified concerns that cybercriminals could exploit the weaknesses before vulnerable websites were patched, prompting organisations worldwide to temporarily shut down affected services.

Experts warn of possible cyberattacks

Cybersecurity researchers believe the increasing ability of AI systems to identify software weaknesses could significantly change the global cybersecurity landscape.

AI-powered tools can examine enormous volumes of computer code, potentially discovering vulnerabilities that have remained undetected for years.

The number of software vulnerabilities discovered worldwide in 2026 is already on course to roughly double the record total reported last year.

Steve Kerrison, a senior lecturer in cybersecurity at James Cook University's Singapore campus, said concerns about cybercriminals using AI to exploit the PHP flaws had contributed to the urgency of the response.

Although there has been limited evidence of serious attacks so far, experts warned that compromised websites could expose personal information and create opportunities for future phishing campaigns.

Such attacks typically involve criminals using stolen information to trick individuals into revealing passwords or other sensitive details.

Kerrison said larger organisations, including government agencies and major media companies, would likely be able to deploy security updates relatively quickly.

However, smaller websites and independently managed online platforms could remain exposed for considerably longer.

"There are sites, systems and people out there who will have no idea about this and still won't for days, weeks and months," Kerrison warned.

He cautioned that vulnerable personal blogs and smaller websites could potentially be exploited to distribute malware, send spam or circulate malicious content.

The incident has renewed concerns about the dual role of artificial intelligence in cybersecurity, with the same technology helping researchers discover dangerous vulnerabilities also potentially enabling cybercriminals to exploit them more rapidly.