Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws

Government agencies and private organizations across the globe took websites offline this week after researchers identified two severe security vulnerabilities in the widely used PHP programming language.

The flaws, which security experts collectively dubbed PHP2Shell, affect a technology that powers an estimated 70 to 75 percent of all websites on the internet.

The vulnerabilities allow unauthorized users to execute remote commands on servers, potentially granting them full control over systems without requiring a password or legitimate account access.

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” said the security firm Wiz, which identified one of the flaws.

The discovery was made possible by artificial intelligence models, which enabled researchers to identify complex exploit chains that were previously considered beyond the reach of human analysis.

“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” said the PHP Foundation in a statement.

While no successful breaches have been confirmed, CloudFlare reported observing millions of attempts to exploit the vulnerabilities within hours of their public disclosure.

Authorities in countries including Japan, France, Germany, and the United Kingdom directed administrators to apply urgent security patches or temporarily suspend vulnerable services to mitigate risk.

“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the United States National Security Agency said.

The PHP Foundation released a software fix on Wednesday, but experts warned that systems running older, unsupported versions of the language require a full upgrade to remain secure.

“Applying a patch alone will not be sufficient for systems running unsupported versions, where upgrading is the only viable long-term solution,” said Saeed Abbasi, a director at Qualys.

It remains unclear how many organizations will successfully update their infrastructure before attackers can weaponize the vulnerabilities, leaving the long-term security of millions of web services in question.