Websites plunge into darkness following AI warning amid global internet chaos and 'millions' of hacking attempts

Internet users have for days been warned about major security flaws described as the 'most severe vulnerabilities ever discovered' by AI.

And now, thirty-two UK Government services are offline while work is carried out to address cybersecurity issues.

Throughout Thursday (22 October), organisations globally have been scrambling to fix a critical security flaw in the programming language PHP used by the majority of websites.

The vulnerabilities lie within PHP, which has been used internationally since the 2000s to build websites.

It's estimated that it powers more than 75 percent of all websites on the internet, meaning the server outage could impact millions of sites across major platforms and social media.

Site operators have now been urged to install a new emergency fix or consider taking their platforms offline.

Greg Brockman, the president of OpenAI, said in an X post that hackers could exploit the vulnerability to steal private user data or modify websites.

'Millions' of hacking attempts

The PHP security issue identified could allow attackers to remotely control any web servers running PHP. Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.

Cloudfare chief executive Matthew Prince said on Thursday the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions now ongoing.

"We consider this one of the most impactful security issues in recent memory," OpenAI described in a blog post.

Downing Street on Thursday said no large UK public-facing critical services have been affected, but some 'limited' Government websites have gone dark while issues are resolved.

National Cyber Security Centre (NCSC) experts are working with OpenAI, whose technology was used to discover the vulnerabilities, and partners around the globe to address potential problems, a No 10 spokesperson said.

Developers warned of 'critical' issue

The development comes after cybersecurity chiefs warned UK organisations on Wednesday that a 'critical security issue' had been discovered in PHP, which is used by almost 70 percent of websites according cybersecurity firm Cloudflare.

A Downing Street spokeswoman told reporters: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.

“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out.

“But this does not mean they were hacked, and work continues to resolve any issues.”

Organisations have been urged by the NCSC to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately.

PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.

Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said the vulnerability had in fact already been identified by human researchers in 2024, but it was then believed exploiting this security flaw would be “too complicated”, and nothing was done.

"The cat was let out of the bag rather earlier than it was supposed to have been", he said.

“There’s always a window between the flaw being publicly known about and it being patched so that the attackers can’t successfully get in.

“And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.

“There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.”