A serious security hole in the PHP programming language is currently causing the IT world and website operators to be in turmoil. The Federal Office for Information Security (BSI) and international experts warn of acute danger. The most important questions and answers at a glance:
What exactly happened and how serious is the problem?
Two extremely critical vulnerabilities have been discovered in the widely used programming language PHP, which serves as the technical foundation for the majority of websites worldwide. Called “PHP2Shell” (registered under CVE-2026-109618 and CVE-2026-109619), these flaws allow criminals to remotely execute their own malicious code on servers. Because this threatens to completely take over the affected systems and the details of the vulnerability were unintentionally made public, authorities and IT security experts are classifying the situation as an extraordinary emergency. Many website operators have taken their websites offline as a precautionary measure - including numerous authorities in Germany.
What is the situation in Germany?
In the morning, some offers were activated again, including many websites in Rhineland-Palatinate and Saarland. In Thuringia, too, many sites were online again since late Wednesday evening, including those of the State Chancellery, the State Police and the Ministry of the Interior.
In Baden-Württemberg there were some references to maintenance work. “The measure serves to protect the infrastructure as a precautionary measure until the developers provide the necessary security updates,” said the State Ministry.
In North Rhine-Westphalia, some prominent websites were also still unavailable in the morning. According to the authorities, several online services of the NRW police were online again. “After intensive work, the sites were able to be put back into operation,” said the State Office for Central Police Services.
Are my personal data at risk on online portals or in online shops?
Yes, there is an indirect risk. If a website, a citizen portal or an online shop uses the affected PHP version and was not protected in a timely manner, attackers can gain access to the underlying databases via the malicious code. This could result in sensitive customer data, passwords or contact details being leaked.
However, there is no direct danger on the users' end devices themselves (such as smartphones, tablets or PCs); The vulnerability lies exclusively on the servers of the website operators in the background.
What role does artificial intelligence play in the PHP crisis?
It is not yet known exactly how the PHP errors were discovered. However, there is much to suggest that they were detected through the massive use of artificial intelligence - also because the security gaps had previously been overlooked for decades. But AI also plays a role in the threat scenario. Attackers can use artificial intelligence to scan the vulnerabilities of unprotected PHP servers and carry out large-scale attacks in seconds without any manual effort. In this crisis, AI acts as a catalyst on both sides - when attacking and defending.
There have been “millions” of attempts by hackers worldwide to exploit the vulnerability, said the head of the IT company Cloudflare, Matthew Prince, to the British broadcaster Sky News.
As the operator of my own website, how can I check whether I am safe?
Operators of websites - whether blogs, club homepages or websites of companies and public institutions - must check the PHP version used in their server environment. The development team provided emergency updates on Wednesday. Large web hosts like Ionos have already updated the PHP version in their systems, so that at least those websites that have provided automatic security updates are protected.
What happens next and when will the danger be averted?
The global wave of automated attacks is now underway and is expected to continue for weeks and months as attackers relentlessly search for unpatched systems. The all-clear can only be given once the majority of web hosts and system administrators have installed the security updates. Systems and outdated PHP versions for which there are no longer any official updates must be isolated or immediately shut down by the operators in order to prevent permanent entry points for cybercriminals.
