Websites go dark as AI exposes critical security flaws

Government agencies and companies around the world shut down websites on Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet. PHP sits underneath popular web design platforms, so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services. Wiz, one of the security firms that found the flaws, estimated that PHP runs about 70 percent of the world's websites and said they rank "among the most severe vulnerabilities discovered in PHP, and arguably in software history." The US National Security Agency told organisations to patch immediately or pull vulnerable systems offline. Only sites that run PHP on their own servers are exposed. Many large platforms are built on other programming languages or use operators that could install the fix quickly and were able to stay online. The flaws "often provide a direct path to the server's file system or database," the NSA said in a statement on X. Attackers could use them to take over web servers without needing a password. Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal it was the most serious problem PHP had faced in...