Websites go dark worldwide as AI exposes critical security flaws

WASHINGTON — Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet. The U.S. National Security Agency told organizations to patch immediately or pull vulnerable systems offline. The flaws "often provide a direct path to the server's file system or database," the NSA said in a statement on X. Attackers could use them to take over web servers without needing a password. PHP sits underneath popular web design platforms so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services. The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year's record total. PHP volunteers released a fix on Wednesday. "If you run PHP, it is imperative that you update now," the PHP Foundation, which funds developers working on the language, said in a blog post. The flaws