PHP: Association of cities and municipalities calls for more protection against cyber attacks

In view of the PHP security gap, the German Association of Cities and Municipalities (DStGB) sees a need to catch up when it comes to protection against cyber attacks. “We also see the federal and state governments as having a responsibility to provide appropriate structures for better protection and the ability to react quickly in the event of a crisis,” said an association spokesman for the “Rheinische Post”.

The municipalities have already made great progress in this area. Nevertheless, there are still deficits in many cities and municipalities, said the spokesman. The reasons for this include a lack of human and financial resources as well as "the rapidly increasing demands in this area, not least in view of the ever shorter response times to threats." In the case of the PHP security gap, however, the municipalities “reacted quickly and responsibly” by taking their websites offline as a precaution.

Two critical vulnerabilities were confirmed on Wednesday in the widely used programming language PHP, the technical foundation for the majority of websites worldwide. Called “PHP2Shell,” these errors allow criminals to remotely execute their own malicious code on servers. Authorities around the world warned about the vulnerability and called on website operators to immediately install a security update.

Federal Digital Minister Karsten Wildberger has now given the all-clear for the federal government. There is “currently no evidence of a successful compromise of federal administration systems,” the CDU politician told “Bild”. The Federal Office for Information Security and the federal government's central IT service company "reacted very quickly and clearly." The fact that federal administration websites were taken offline as a precautionary measure on Wednesday was “the right decision”.

His party colleague and chairman of the Parliamentary Control Committee for the Secret Services, Marc Henrichmann, had previously warned of a new dimension of cyber threat in the “Handelsblatt”. Artificial intelligence quickly turns vulnerabilities that were previously considered hard to exploit into “real gateways.” The case also shows how vulnerable state institutions are when central software contains errors that have gone undetected for years.

Since the security gap became known, the most important thing for users is to be vigilant.