PHP programming language: Security vulnerability threatens websites worldwide

PHP programming language security vulnerability threatens websites worldwide As of: October 21, 2026 • 7:32 p.m

A serious security gap threatens millions of websites. The widely used programming language PHP is affected. In Germany, websites in several cities have been shut down as a precaution.

Government authorities and companies around the world have shut down websites due to massive security gaps. In Europe, websites in Germany, France, the Netherlands and Denmark were affected, among others.

The serious security flaw affects the widely used PHP programming language, on which much of the Internet is based - from simple blogs to large news portals to complex online shops and content management systems such as WordPress.

Answers to the most important questions about the new security vulnerability. more

Experts estimate that between 400 and 500 million websites are operated worldwide using WordPress alone.

Several municipalities, authorities, universities and hospitals responded to the security authorities' warnings and took their online offerings offline at short notice in order to forestall possible attacks.

In Rhineland-Palatinate, for example, the state capital Mainz temporarily switched off several city internet services and its central web portal as a precautionary measure following a warning from the federal government. Potsdam and Halberstadt also shut down their websites as a precaution. The Charité University Hospital in Berlin also took its official website offline. In Hanover, the Üstra transport company temporarily shut down its website. “Purchasing tickets and displaying purchased tickets in the app are also affected,” the company said.

Websites in the Netherlands, Denmark, Finland and Japan were also shut down for safety reasons. In the Netherlands, for example, the websites of the National Center for Cybersecurity, the Port of Rotterdam and the national football association were not accessible.

Security experts warn of two critical vulnerabilities at the core of the programming language. In addition to the IT security company Huntress and the PHP security team, the Federal Office for Information Security (BSI) is also sounding the alarm and has issued an official cybersecurity warning.

In its published warning, the BSI classifies the risk as extremely high with warning level “3/Orange”. This means that countermeasures must be taken immediately, as there is a risk of massive disruption to regular operations.

Daniel Frevel, NDR, on the serious security gap in millions of websites tagesschau24, October 21, 2026 • 5:00 p.m. Criminals could access customer data The potential danger of the security gap is therefore extremely high: Criminal actors can exploit the vulnerabilities to remotely execute their own malicious code on the affected servers.

In practice, this allows potential attackers to take control of a website, access sensitive customer data or misuse the infrastructure for further cyberattacks.

The vulnerabilities were initially reported confidentially to the PHP developers and remained secret while a solution was worked on. Details were leaked online on Tuesday - a day before the update was scheduled to release. This led to the precautionary shutdown of many websites.

Since detailed information about the vulnerabilities was unintentionally made public in advance, the entire global IT industry is under considerable time pressure. IT experts advise that the updates must be installed without any delay.

The developers of the PHP project released updated versions of the web scripting language on Wednesday afternoon in which the security holes were closed. "If you are using PHP, it is imperative that you update now," the PHP Foundation said in a blog post.

The expert service Heise Security warned that anyone who does not want to take the risk of being compromised only has one option, namely to disconnect the web servers running PHP from the network as long as the update has not been installed.

German companies are increasingly becoming victims of cyber attacks. But many are not well prepared. more

This topic in the program: NDR Info | News | Oct 2, 2026 | 4:15 p.m