PHP Security Flaw Causes Outages Across Germany
- Millions of web servers worldwide running the PHP programming language face critical remote code execution risks following the disclosure of vulnerabilities cataloged as CVE-2026-109618 and CVE-2026-109619, with Cloudflare...
- The flaws, known as PHP2Shell and assigned CVSS scores of 9.2, impact every known version of PHP, Deutschlandfunk reported.
- Preventive shutdowns hit government portals, city administrations, universities, and hospitals across Germany.
Millions of web servers worldwide running the PHP programming language face critical remote code execution risks following the disclosure of vulnerabilities cataloged as CVE-2026-109618 and CVE-2026-109619, with Cloudflare reporting millions of attack attempts globally as documented by heise online. The Bundesamt für Sicherheit in der Informationstechnik warned authorities and website operators about the flaws affecting virtually all known versions of the widespread technology.
Vulnerabilities Allow Remote Server Takeover Across PHP Versions
The flaws, known as PHP2Shell and assigned CVSS scores of 9.2, impact every known version of PHP, Deutschlandfunk reported. According to security data cited by heise online, attackers require no authentication to exploit the weaknesses, with test exploits demonstrating successful code execution after tens of thousands of HTTP requests within 38 seconds. The United States National Security Agency warned that the vulnerability grants hackers direct access to datastores or server databases, putting dynamic websites, contact forms, customer accounts, and online shops at risk.
Public Sector Web Services Go Offline in German Municipalities
Preventive shutdowns hit government portals, city administrations, universities, and hospitals across Germany. While services in regions such as Hesse and Lower Saxony gradually returned online following software patches, portals and specific regional clinics remained offline while administrators inspected systems, according to reporting by Bild and NDR.de. Hamburg data protection commissioner Thomas Fuchs told NDR.de that no data breaches had been detected locally, though institutions like the University of Hamburg maintained precautionary outages.
Authorities Urge Rapid Updates Amid Supply Chain blind spots
Karsten Wildberger described the coordinated government reaction as the beginning of a new era of cyber security, noting in Bild that artificial intelligence tools could help trace flaws faster. However, Chaos Computer Club spokesperson Neumann criticized standard corporate update cycles in Deutschlandfunk, arguing that organizations often handle patches monthly rather than immediately.
Patch Deployment and Future System Redesign Requirements
PHP developers released updated versions including 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on php.net, while major Linux distributions issued fixed packages alongside updates for Docker containers and network-attached storage devices from vendors such as QNAP and Synology, heise online reported.