PHP security gap: Digital Minister sees no evidence of cyber attacks

Security vulnerability in PHP Millions of attack attempts in a short period of time As of: October 22, 2026 • 6:27 p.m

Millions of cyberattacks within a few hours: The PHP security gap has caused concern worldwide. Many websites are still unavailable - and criminals continue to try to exploit the gap.

The global security gap in the PHP programming language continues to cause turmoil in the IT world and website operators. The Federal Office for Information Security (BSI) and international experts warn of acute danger.

The vulnerabilities sparked a race between website operators and cybercriminals. While some are working hard to install an updated version of the software, attackers continue to search for unprotected servers.

The PHP Foundation, which continues to develop the programming language, called on all users to install a security update immediately. Websites and applications that remain vulnerable could be hacked and used to spread viruses, spam and misinformation.

Answers to the most important questions about the new security vulnerability. more

The serious security flaw in the widely used programming language PHP has caused concern worldwide, and many websites have been shut down for security reasons.

As a precautionary measure, several websites were taken offline by federal ministries. According to Digital Minister Karsten Wildberger, there has apparently been no damage to IT systems at the federal government so far. Accordingly, there is “no evidence” that federal websites and IT infrastructure are affected by the PHP security hole.

The BSI and the federal government's central IT service company (ITZ-Bund) "reacted very quickly and clearly," Wildberger told the Bild newspaper.

The Digital Minister continued: "The case also shows that we are at the beginning of a new age of cybersecurity. AI-based tools can help us detect vulnerabilities faster and more precisely than ever before."

Numerous websites and online services worldwide are currently in acute danger due to a security gap. more

Authorities and IT security experts classified the situation as an extraordinary emergency because the security gap threatened a complete takeover of affected systems and the details of the gap were unintentionally made public in advance. Many website operators took their websites offline as a precaution and frantically installed updates. Many websites are now online again.

The PHP security hole gave IT managers a sleepless night, said Microsoft boss Satya Nadella at an event in Cologne. "I haven't seen anything like this in a long, long time." It was a wake-up call.

According to cybersecurity firm Cloudflare, the discovery of the PHP flaws triggered a flood of attacks. In the hours beforehand, there had been several thousand attempts to exploit the security gaps, company boss Matthew Prince wrote on the short message service

According to the digital association Bitkom, a large proportion of companies, organizations and institutions in Germany are theoretically affected by the security gap. “Practically every company with its own website, online shop or web-based application can be affected, from craft businesses to corporations,” explained the association. "PHP is the most widely used programming language for websites." According to security company Wiz Research, around 70 percent of the world's websites are based on PHP.

The problem is "that many companies use PHP without knowing it, for example because their website runs with a content management system," explained Bitkom expert Felix Kuhlenkamp. "Many companies probably lack an overview of exactly which servers can be accessed from the Internet with which software."

Customers who operate websites via the servers of web hosting providers usually do not have to take any action themselves, as the hosts have already installed the necessary security updates.

However, experts and the BSI also warn that many websites use outdated PHP versions for which there is no security update.

In view of the PHP security gap, the German Association of Cities and Municipalities (DStGB) has called for better structures in Germany to protect against cyber attacks. “We also see the federal and state governments as having a responsibility to provide appropriate structures for better protection and the ability to react quickly in the event of a crisis,” an association spokesman told the “Rheinische Post”.

This topic in the program: BR24 Radio | News | Oct 22, 2026 | 2:47 p.m