Prepare for more website shutdowns in the age of AI – but human inaction is the real culprit | Chris Stokel-Walker

The Netherlands has taken its digital ID login service offline, and Finland has switched off public services, while parts of the Wikimedia network have also been disabled. These shutdowns were not the result of a cyber-attack but deliberate decisions by administrators to protect their systems from hackers.

The outages were triggered by two serious security vulnerabilities in PHP, a programming language that powers roughly 70% of the websites that can be tracked. The flaws created an open window for attackers to access sensitive data, such as customer addresses, passwords, and payment details.

Cloudflare’s chief executive, Matthew Prince, said his company had already seen millions of attempts to exploit the vulnerabilities. Automated systems powered by AI have made it easier for hackers to find and target weaknesses in vast volumes of old code.

A history of recurring failures

The current situation echoes past incidents like Heartbleed in 2014, Log4j in 2021, and the XZ Utils backdoor in 2024. In each case, small teams working for the public good recognised the problem and acted to avert disaster, highlighting how the internet relies on under-resourced individuals to maintain its security.

The PHP Foundation first identified the issue that could bring the internet to a halt in 2024, but it was deemed too expensive and too tricky to fix. The foundation has since admitted the delay was a 'structural failure' owing to poor resource levels.

The scale of the threat

Researchers have documented about 48,000 vulnerabilities across the internet in 2025, but that number has already surpassed 84,000 in 2026, with more than two months of the year still to go. This averages to one vulnerability every five minutes.

The latest PHP vulnerabilities scored 9.2 on a 10-point scale used to measure severity, making them particularly dangerous. While not every vulnerability will be as critical as this one, the sheer volume of threats poses a growing risk to digital infrastructure.

A 2025 review by the UK government found that about 28% of central government technology was classified as 'legacy' or out of date. Some organisations could not even estimate how much old software they were using, leaving them vulnerable to exploitation.

The need for funding and documentation

The solution requires companies and organisations to know what software they are using, including obscure elements, and who is responsible for fixing it. This documentation is often overlooked because it is considered boring work, but it is essential in the current threat landscape.

Experts argue that big tech companies making billions from open-source software should contribute properly to maintaining it, and governments should do the same rather than relying on exhausted developers. The OpenSSL Foundation, which faced the Heartbleed vulnerability in 2014, received more than €400,000 from Germany’s sovereign tech fund last year to bolster its resources.

Paradoxically, AI can help with the documentation and triage of vulnerabilities, but companies and the organisations protecting us also need adequate funding. Without proper investment, the cycle of shutdowns and security failures is likely to continue.