Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond