Parts of the internet are going dark. In the Netherlands, government websites, including its digital ID login service, have become unavailable. Finland has taken public services offline, and Wikimedia, the organisation behind Wikipedia, has switched off some of its systems too.

This sounds like the results of a cyber-attack. In most instances, however, the people running the sites deliberately switched them off because the alternative – keeping them online – was too risky. The future is here, and suddenly much of our digital infrastructure is looking very fragile.

The websites were turned off because of two serious security vulnerabilities in PHP, a programming language that is used by about 70% of websites that we can track. Those vulnerabilities in effect gave hackers an open window through which to climb and loot everything within. That could mean an attacker getting into an online shop, stealing customers’ addresses and passwords, or changing its checkout page to harvest card details. The UK’s National Cyber Security Centre advised organisations that were unable to update immediately to consider taking their systems offline.

It’s very tricky to get people to care about something quite so techy. PHP is a tricky abbreviation – even explaining what it stands for (PHP: Hypertext Preprocessor) is complicated, because it’s recursive. And how it helps the web work is also difficult to explain: a good analogy is it’s like the back-of-house team in a restaurant: your browser puts in an order, and PHP handles the cooking and delivers the meal. In any case, what matters is that you’ve almost certainly used websites powered by it this week.

I’ve been reporting on scares like these in our digital architecture for more than a decade, and the underlying problem barely changes. In 2014, I wrote about Heartbleed, a vulnerability in OpenSSL, the software that helps keep communications across the internet secure. It was up to two men named Steve – working for OpenSSL on a shoestring budget and shouldering an awful lot of responsibility – to keep us from disaster. Twelve years later, it feels like we’re still having the same conversation.

Heartbleed wasn’t the end of it. In 2021 I reported on a dangerous flaw in Log4j, a seemingly mundane tool that records what happens inside computer systems. Then three years later we had XZ Utils, a tool for shrinking file sizes used on Linux computers into which someone had deliberately planted a backdoor. In each of these incidents, small teams working for the public good recognised the problem, acted, and averted disaster. Each one of these incidents underscored how we rely on a handful of under-resourced individuals to keep vital parts of the web secure.

The PHP Foundation made that point itself this week. Its developers first identified the issue that could bring the internet to a halt in 2024, but it was seen as too expensive and too tricky to fix. The foundation has since admitted the delay was a “structural failure” owing to poor resource levels.

This is where AI comes in. In August, researchers working with Calif, OpenAI and Wiz identified how easily the PHP issue could be exploited by using AI tools. And hackers quickly did too. Cloudflare’s chief executive, Matthew Prince, said his company had seen millions of attempts to exploit it already.

Automated systems powered by AI can hammer away at weaknesses in an instant, bombarding their human guards with reports that they have to sift through. Researchers documented about 48,000 vulnerabilities across the internet in 2025. We’ve already passed 84,000 in 2026, with more than two months of the year still to go. That’s one every five minutes. Not every one will be as serious as this latest one, which scored 9.2 on a 10-point scale used to measure these things. But we’re facing an onslaught.

Which all makes for an uncomfortable reality: we’re going to have more days like these. AI makes it inordinately cheaper to find weaknesses in vast volumes of old code, and repairing them is difficult. A 2025 review by the UK government found that about 28% of central government technology was classed as “legacy” – meaning out of date – while some organisations couldn’t even estimate how much old software they had. In April, ministers admitted they couldn’t give a comprehensive account of what had since been fixed or retired.

So we need to fix that. Companies need to know what software they’re using, including the obscure elements they rely on, and who’s responsible for fixing it. That documentation is boring work, which is probably why it’s overlooked. But we’re in a different world now, and it needs to be done. Paradoxically, AI can help with it. But companies and the organisations protecting us also need adequate funding.

There are some things to be optimistic about. The OpenSSL Foundation, the not-for-profit company that fell victim to the Heartbleed vulnerability in 2014, received more than €400,000 from Germany’s sovereign tech fund last year to bolster its resources. The PHP Foundation has hired more staff and is using AI to help triage what’s important and what’s not. And a number of organisations deployed fixes before the current issue went public.

But more is needed. The solution is the same one we keep talking about, but rarely actually do anything about: the big tech companies making billions from software they get for nothing (because of its open-source nature) should contribute properly to maintaining it. Governments ought to do the same, rather than hoping a handful of exhausted developers will keep things ticking over indefinitely.

I’m growing sick of reporting on, and explaining why, the internet repeatedly breaks. I’ve covered Heartbleed, Log4Shell and XZ Utils – and am now documenting the fallout from PHP. I don’t particularly want to keep doing it. Yet I fear unless we start properly valuing those who keep our internet safe, I will be.

• Chris Stokel-Walker is the author of TikTok Boom: The Inside Story of the World’s Favourite App