PHP gap in Germany: Many German websites are accessible again

dpa | In the crisis surrounding the serious security gaps in the widely used programming language PHP, the situation for website operators in Germany has largely stabilized. As experts report, almost all websites that were taken offline as a precautionary measure - including ministries, authorities and medical institutions such as the Berlin Charité - can be accessed again after security updates have been installed.

Despite the administrators' quick reaction, experts warn against giving the all-clear just yet. The security breach was classified by authorities as an extraordinary emergency. According to data from cybersecurity firm Cloudflare, automated attack attempts began 10 hours before the vulnerability was officially announced. As a result, the number of attacks rose rapidly and reached millions within a short period of time.

The Federal Office for Information Security (BSI) and the Digital Ministry announced that so far there have been no reports of successful attacks on the federal administration or the regulated economy. However, experts emphasize that this is not a guarantee of the absence of damage. Since around 70 percent of all websites worldwide are based on PHP, the risk of successful manipulation is high.

Processing the incidents could take weeks or months. There is a risk that in the event of successful attacks, sensitive data such as passwords could be leaked, which could lead to data theft or blackmail attempts in the future.

According to experts, there is currently no direct need for action for normal Internet users. Customers of web hosting providers usually do not have to take action themselves, as professional hosts install the necessary security updates promptly.

However, according to security experts, simply installing software updates is far from enough. Thomas Boele, security expert at the software company Check Point, warned against lulling yourself into a false sense of security. He urged system operators to take action beyond just installing patches.

The necessary immediate measures include a retroactive check of the log data up to October 17, 2026 in order to identify possible compromises. The reason: On this day, the first attack attempts were registered on a so-called Amazon honeypot - a digital trap designed to lure attackers. If you don't check your data by this date, you may miss whether your system was secretly infiltrated before the update.

Boele also called on those responsible to consistently renew the access data and keys for so-called programming interfaces (API keys). A central component of defense is also the updating of web application firewalls (WAF).

A WAF acts as a protective shield between a web application and the Internet; it analyzes incoming traffic and blocks malicious requests before they can reach the system.

In a conversation with the dpa news agency, Boele also called for the creation of a complete system inventory in order to create transparency about where and in which versions PHP components are used in one's own network. Since PHP runs on a majority of the world's web servers, the risk from the vulnerability, which can serve as a gateway for attacks on internal networks, remains high.