The personal data of millions of people could be at risk after two critical flaws were discovered in software used to power most of the world's websites.
The developers of PHP, a programming language used by up to 70 percent of websites, disclosed the vulnerabilities on Wednesday.
The flaws could allow hackers to take control of affected servers without needing a password or account.
A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors.
Website operators now face a race to install the fixes before hackers can use AI to study the updates and work out how to attack sites that remain unprotected.
Thai Duong, chief executive of Calif, the security company that discovered the vulnerabilities, told The Wall Street Journal: 'Some dude on Twitter could take the patches and run AI against it and post some exploit script.'
He added: 'All hell will break loose.'
The US National Security Agency (NSA) issued a warning to all organizations using PHP, advising preperation for an update addressing the critical vulnerabilities.
The flaws could allow hackers to take control of affected servers without needing a password or account
Cybersecurity company Huntress said in a blog post: 'PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood.'
Both flaws involve how PHP handles a server's memory. One can cause the software to mishandle information when it encounters memory problems, while the other allows it to reuse information from memory that has already been released.
AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King's College London.
'The scale is huge,' Olejnik said. 'And with AI, exploitation may happen instantly, on a large scale.'
The security team that maintains PHP reportedly released patches to fix the problem at 10am ET.
Several websites were temporarily down on Wednesday over fears of being hacked, including Pinboard, a bookmarking site, and parts of Wikipedia.
European and British authorities have recommended that websites go offline.
CERT-EU, the European Union's technical cybersecurity advisory body, said, 'Organizations should consider isolating internet-facing applications from public networks until a fix is available.'
A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors
Sites in Japan are voluntarily going dark, including those for daycare centers, video games and news outlets.
The extent of the attacks remains unclear, although cybersecurity platform Patchstack said it had received 'reports of active exploitation.'
Cloudflare, which provides internet infrastructure and security services, also reported signs of attacks.
Its chief technology officer wrote on X: 'We are seeing early attacks emerging and are updating mitigations as new vectors show up.'
PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser.
Security experts said the vulnerabilities could potentially open the door to millions of servers because so many websites rely on the same underlying software.
Rather than target victims individually, attackers could scan the internet for systems running vulnerable versions of PHP.