IT security: Security gap threatens websites worldwide

A serious security gap is currently threatening the foundation of numerous websites and online services worldwide. The widespread programming language PHP is affected, on which a large part of the Internet is based - from simple blogs to large news portals to complex online shops and content management systems such as WordPress.

Security experts warn of two critical vulnerabilities at the core of the programming language. In addition to the IT security company Huntress and the PHP security team, the Federal Office for Information Security (BSI) is also sounding the alarm and has issued an official cybersecurity warning.

Criminals can exploit the vulnerabilities

The potential danger of the security gap is therefore extremely high: criminal actors can exploit the vulnerabilities to remotely execute their own malicious code on the affected servers. In practice, this allows potential attackers to take control of a website, access sensitive customer data or misuse the infrastructure for further cyberattacks.

Since detailed information about the vulnerabilities was unintentionally made public in advance, the entire global IT industry is under considerable time pressure. IT experts strongly advise you to contact the responsible system administrators, IT service providers or web hosting providers immediately. Security updates provided for the PHP environment and for the systems used would have to be installed without any delay.

Consumers could be indirectly affected

The first municipalities, authorities, universities and hospitals have responded to the warnings of the security authorities and taken their online offerings offline at short notice in order to forestall possible attacks. For example, the state capital Mainz temporarily switched off several city internet services and its central web portal as a precautionary measure following a warning from the federal government.

For normal Internet users, there is no direct need for action when surfing on a smartphone or PC every day, as the security gap is not on the user's end devices, but on the servers in the background. However, consumers can be indirectly affected - for example through temporary outages of online services or potential data leaks on websites that are not protected in a timely manner.