PHP security flaw risks millions of websites; German public sites taken offline

October 22, 2026 — A newly disclosed security flaw in the PHP programming language has put millions of websites at risk and prompted widespread defensive measures across Germany and beyond.

Authorities urge immediate patching; some public sites taken offline

Security experts say the vulnerability affects a broad swath of the web because PHP underpins everything from small blogs and major news portals to large e-commerce platforms and content management systems such as WordPress. Matthew Prince, chief executive of the U.S. IT company and content delivery network Cloudflare, told Sky News that there have already been "millions of hacking attempts worldwide" to exploit the weakness.

The German Federal Office for Information Security (BSI) issued an official cyber‑security alert and warned the flaw carries a serious threat. As a precaution, several German states, many municipalities, public institutions, universities and hospitals temporarily took their websites offline to limit exposure.

IT security expert Christoph Fischer urged decisive action. "Systems that have not yet installed the security update must under no circumstances remain connected to the internet," he said to the German news agency dpa. He added: "Every unpatched PHP application right now represents an open door for criminals."

Both the BSI and the U.S. National Security Agency (NSA) recommended immediate installation of the security update, which was released on Wednesday, October 21, 2026. If patching cannot be completed quickly, the agencies advised taking affected sites offline temporarily; otherwise attackers could seize control of servers without needing a password.

German officials reported ongoing disruptions in several regions. North Rhine‑Westphalia said some state government and ministry sites were inaccessible on Thursday morning, although many police online services there were restored after intensive work. Other states such as Baden‑Württemberg displayed maintenance notices while Rhineland‑Palatinate, Saarland and Thuringia restored numerous public pages, including provincial offices and police sites. In Berlin, S‑Bahn web pages were reported fully available again, while the Free University of Berlin said some IT services remained limited as a preventive measure.

Parliamentary oversight chairman Mark Henrichmann of the CDU warned the incident marks a shift in cyber threats. "We are witnessing a turning point," he told Handelsblatt, saying artificial intelligence can rapidly convert formerly hard‑to‑exploit weaknesses into "real entry points" for attackers.

Photo: press material from the event