Thorsten Holz: A serious amount of damage cannot yet be quantified. What is special about this vulnerability is not the damage caused by a single attack, but the large number of potentially affected systems. If such a gap is exploited automatically, even comparatively small damages can add up to significant costs for each affected company.
Large corporations are generally better positioned
tagesschau.de: How well prepared are German companies for such a security gap?
Holz: At this point it is not possible to make a general judgment about how well German companies are dealing with this overall. Because what matters is how quickly the companies react. In order to close the security gaps, you have to quickly install so-called patches. These work like a security update for Windows.
For large corporations with more applications, the effort is higher. However, they usually also have entire teams that take care of IT security and can act more quickly. The situation is often different for smaller companies that only operate one website, but for which perhaps only a single employee is responsible.
Numerous authorities, universities and companies have switched off their systems as a precaution in order to be able to close gaps in peace. The Federal Office for Information Security reacted urgently and issued a warning.
Installation only takes a few minutes
tagesschau.de: How quickly can such a gap be fixed once it has been found?
Wood: A company with a complete asset inventory and automated patch management can respond relatively quickly. Then installing the patch only takes a few minutes.
tagesschau.de: What costs will be incurred to fix the security gap?
Holz: Updating the software yourself is not expensive because the software is free. It becomes expensive if a company first has to find out where vulnerable PHP versions are running, if old applications are not compatible with a new version or if it has to be checked whether an attacker was already in the system.
Consumers indirectly affected
tagesschau.de: Are consumers also affected by the security gap?
Wood: Consumers are not directly affected because PHP is typically used on servers. However, indirect consequences are possible: websites or online services may be temporarily switched off for security reasons. If the compromise is successful, personal data or access information could also be stolen or websites could be manipulated.
Banks can also generally operate vulnerable PHP systems. However, whether online banking or core banking systems are affected depends on where PHP is used, how the systems are separated from the rest of the network and how quickly security updates are applied.
What role AI plays
tagesschau.de: What role does artificial intelligence play in discovering and closing such security gaps?
Holz: What's interesting is that we may be seeing a foretaste of how IT security is changing through AI. The vulnerability was found by GPT 5.6 Sol. AI systems can quickly find security gaps and help defenders close them.
At the same time, attackers can use the same capabilities to quickly analyze released patches and automate attacks. Because by publishing a patch that closes a security hole, information about where the security hole is is also indirectly published. This shrinks the window in which companies can respond after a critical vulnerability is published.
“Have to live with such gaps”
tagesschau.de: What can we learn from this discovery for the future?
Holz: We have to be aware that we have to live with such gaps - we have been doing that all the time. However, this shows even more how important good preparation is when it comes to IT security. The better you are prepared for such a security gap, the quicker you can act to close it. Especially in such a digital world, it is important to always keep security in mind.
The interview was conducted by Lilli-Marie Hiltscher, ARD finance editor for tagesschau.de.
