Domestic

Serious security flaw in PHP threatens millions of websites worldwide

A critical security vulnerability in the PHP programming language endangers numerous websites. Municipalities and authorities have already taken measures to protect themselves.

21 October 2026Tagblick Newsdesk

AI-generatedWritten by an AI system, editorially responsible — how we work

Archive photo: Serious security flaw in PHP threatens millions of websites worldwide — Archive photoPhoto: Betancort 741 · Wikimedia Commons · CC BY-SA 4.0

The Federal Office for Information Security has classified the situation as critical due to a serious security flaw in the widely used programming language PHP. This vulnerability allows attackers to remotely take control of servers without requiring login credentials. Details of the security vulnerability were inadvertently published, increasing the pressure on operators to act swiftly.

According to various security authorities, numerous municipalities, universities, and hospitals have already taken their online services offline as a precaution. These measures are intended to protect against potential hacker attacks that could be triggered by the weakness.

The security flaw affects not only simple websites, but also complex systems such as content management systems and large online portals. Experts argue that the risk situation is significant for many internet offerings, which represent a substantial part of daily internet life that relies on PHP.

Affected institutions, including governmental agencies, are responding to the warnings. Despite the alarming situation, a security update has been available since the afternoon, aimed at providing possible protective measures.

The potential risks are assessed as extremely high, as the flaw makes a vast number of websites worldwide vulnerable. The alarming scope of this threat affects blogs, online shops, and news portals, all of which are based on the PHP programming language.

So far, there is little clarity on how many websites are actually impacted by the security vulnerability. Transparency regarding the measures taken and the number of affected services remains an open issue that may be observed further in the coming days.

This item was written by an AI system on the basis of the headlines and short teasers of the independently operating newsrooms named below. We disclose this under Art. 50(4), second subparagraph, of Regulation (EU) 2024/1689 (AI Act). Before publication we check origin and verifiability — anything that appears in only one place is not published — as well as language, substance and legally sensitive content. No separate substantive review of each individual item by a natural person takes place; we therefore do not rely on the exemption in Art. 50(4), second subparagraph, of the AI Act. Editorial responsibility for this publication rests with the person named in the imprint (§ 18 Abs. 2 MStV). Please report errors to [email protected] — we will correct or remove the item. Full reports are available from the sources listed.