Websites go dark worldwide after critical flaws are exposed, putting 70% of sites at risk of attack

Websites went dark worldwide on Wednesday as operators scrambled to protect against two critical security flaws in software used to power up to 70 percent of sites.The US National Security Agency (NSA) urged organizations using PHP to prepare for emergency updates and take affected systems offline if they could not immediately install the fixes.Websites in Europe and Japan were temporarily shut down over fears of being hacked, while the Wikimedia Foundation also took some of its systems offline as a precaution.The vulnerabilities could allow hackers to take control of affected servers without needing a password or account.A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors.Website operators now face a race to install the fixes before hackers can use AI to study the updates and work out how to attack systems that remain unprotected.Thai Duong, chief executive of Calif, the security company that discovered the vulnerabilities, told The Wall Street Journal: 'Some dude on Twitter could take the patches and run AI against it and post some exploit script.'He added: 'All hell will break loose.' The flaws could allow hackers to take control of affected servers without needing a password or accountCybersecurity company Huntress said in a blog post: 'PHP is everywhere. It quietly powers WordPress, ​Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under ⁠the hood.'Both flaws involve how PHP handles a server's memory. One can cause the software to mishandle information when it encounters memory problems, while the other allows it to reuse information from memory that has already been released. AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King's College London.'The scale is huge,' Olejnik said. 'And with AI, exploitation may happen instantly, on a large scale.' The security team that maintains PHP reportedly released patches to fix the problem at 10am ET. CERT-EU, the European Union's technical cybersecurity advisory body, said, 'Organizations should consider isolating internet-facing applications from public networks until a fix is available.' In the Netherlands, several organisations followed the example of the National Cyber Security Center and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country's five largest political parties and several hospital websites.Danish municipal IT company Kombit said it shut down several ⁠services, including ​the national school communication platform, a spokesperson told Reuters.Disruption was even more widespread in Finland, where state IT services provider ​Valtori said government public network services had been taken offline 'as a precautionary measure.' A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitorsFrance's Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.The extent of the attacks remains unclear, although cybersecurity platform Patchstack said it had received 'reports of active exploitation.'Cloudflare, which provides internet infrastructure and security services, also reported signs of attacks. Its chief technology officer wrote on X: 'We are seeing early attacks emerging and are updating mitigations as new vectors show up.'PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. Security experts said the vulnerabilities could potentially open the door to millions of servers because so ​many websites rely on the same underlying software. ​Rather than target victims individually, attackers could scan ⁠the internet for systems running vulnerable versions of PHP.