Some German websites may be unreachable over the next few days: two critical flaws in the PHP programming language have led authorities and companies to switch pages off as a precaution. In Bremen, the city site bremen.de and the police homepage were offline on Wednesday. Germany’s Federal Office for Information Security (BSI) rates the situation “criticality 3 of 4” (orange). As of the afternoon of 21 October.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”. Each scores 9.2 out of 10 on the CVSS 4.0 scale. According to current reports, an attacker can run their own code on a server remotely and without logging in. That could mean taking over a site, stealing customer data or using the server for further attacks. PHP underpins a large share of the web, including WordPress and many online shops.
Why public bodies are pulling the plug
The PHP team had announced fixes for 21 October at 16:00 German time, with technical details to follow only alongside the patch. Media reports say unconfirmed exploit attempts were circulating before then. The EU’s cybersecurity service CERT-EU, in advisory 2026-018, advises taking applications offline as a last resort where immediate patching is impossible. The BSI also knows of no reliable interim workaround.
BSI Vice-President Thomas Caspers said, according to Radio Bremen’s buten un binnen, that attackers can analyse the flaw “within a short time” using AI-assisted tools. That explains the rush: the gap between a patch appearing and the first mass attacks is now often a matter of hours. Cloudflare reports attacks on customer sites and has adjusted its filter rules, according to cms-admins.de. The PHP project itself has not confirmed any attacks so far.
Which versions are fixed, and what operators must do
The corrected releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official updates; operators of those need backports from their Linux distribution or must upgrade. The BSI considers even very old branches, back to PHP 5, to be affected. A WordPress or plugin update is no substitute for the PHP update, because PHP is separate software on the server. If your site is with a hosting provider, ask today whether the update is installed and get written confirmation.
For ordinary users the picture is less dramatic, though not harmless. If a city, agency or service portal won’t load, it is more likely caution than a hack. Don’t leave appointments, applications and deadlines to the last minute; for time-critical matters, phone or email the office. Also expect fake sites and emails after waves like this, claiming “maintenance” or “data verification”. Enter personal details only at the official address you type in yourself.
Our assessment, with caution: most switched-off sites should return within days once operators have patched. The harder period comes after that. Small unmaintained sites, old servers and devices with embedded PHP often stay unpatched for weeks, which is where attackers typically strike. How many sites will actually be compromised can’t be said yet.
Sources: Handelsblatt, buten un binnen, netzwelt, drohnen.de (BSI notice), PHP.net
