PHP vulnerabilities are forcing websites to go offline as AI speeds up attacks

The internet is going dark

Parts of the global internet are currently being taken offline by choice. In the Netherlands, government websites and digital ID login services have become unavailable. Finland has similarly pulled public services from the web, while Wikimedia has disabled some of its own systems.

These are not necessarily the results of active cyber-attacks. Instead, the people running these sites are deliberately switching them off because the risk of staying online is too high. They are reacting to two serious security vulnerabilities found in PHP, a programming language used by about 70% of the websites we can track.

If these sites remained active, hackers could use the vulnerabilities as an open window to enter systems. This could allow them to steal customer addresses and passwords from online shops or manipulate checkout pages to harvest credit card details.

How PHP powers the web

For those unfamiliar with the term, PHP stands for Hypertext Preprocessor. While the name is recursive and technical, it is easiest to understand through an analogy. Think of a website like a restaurant: your web browser is the customer placing an order, and PHP is the back-of-house team that handles the cooking and delivers the meal.

Because it is so widely used, a flaw in PHP is like a structural crack in the foundation of a city's buildings. The UK’s National Cyber Security Centre recently advised organizations that were unable to patch the software immediately to consider taking their systems offline entirely to protect their users.

The AI acceleration problem

While vulnerabilities have existed for decades, the speed at which they are discovered and exploited is changing. Researchers recently identified how easily this specific PHP issue could be exploited using AI tools. Once identified, hackers quickly followed suit, using automated systems to hammer away at weaknesses in an instant.

Cloudflare’s chief executive, Matthew Prince, noted that his company has already seen millions of attempts to exploit the flaw. AI makes it significantly cheaper for bad actors to scan vast volumes of old code to find these cracks. This creates an onslaught where vulnerabilities are being reported at a staggering rate, with researchers documenting one every five minutes in some periods.

A structural failure of resources

The PHP Foundation admitted that the delay in fixing this issue was a "structural failure" caused by poor resource levels. It was seen as too expensive and too tricky to fix quickly. This mirrors previous crises like Heartbleed and Log4j, where small teams working for the public good were forced to shoulder massive responsibility on shoestring budgets.

A 2025 review by the UK government found that about 28% of central government technology is considered "legacy," meaning it is out of date. Some organizations cannot even estimate how much old software they have. The underlying problem is a lack of documentation and funding for the boring but essential work of maintaining the internet's plumbing.

There is some progress, however. The OpenSSL Foundation received over €400,000 from Germany’s sovereign tech fund to bolster its resources. The PHP Foundation has also hired more staff and is beginning to use AI to help triage which issues are the most important to fix first.

The path forward

The current situation highlights a growing tension between the companies that profit from the internet and the people who maintain it. Many of the tools that keep the web running are open-source, meaning they are provided for free. The PHP Foundation and other groups argue that big tech companies making billions from this software should contribute more to its maintenance.

Governments also face a challenge in moving away from legacy systems. Without proper funding and a commitment to updating old code, the internet will continue to face these periodic shutdowns. The goal is to move toward a model where the people keeping our digital world safe are properly valued and resourced before the next crisis hits.