Programmiersprache PHP: PHP-Sicherheitslücke alarmiert Sicherheitspolitiker

A critical security flaw in the widely-used programming language PHP has alarmed cybersecurity officials worldwide. Marc Henrichmann, chairman of the Bundestag's Intelligence Oversight Committee, warned that the issue represents a "turning point," as artificial intelligence makes previously hard-to-exploit vulnerabilities "real entry points" in a short time.

PHP underpins much of the internet, from simple blogs to large news portals, complex online shops, and content management systems like WordPress. Security experts have deemed the vulnerability "highly critical." The flaw affects a significant portion of global websites, posing a "problem for the entire digital infrastructure." Along with IT security firm Huntress and the PHP Security Team, the German Federal Office for Information Security (BSI) issued an official cyber-security warning.

Hackers could launch large-scale attack campaigns, taking control of websites or stealing sensitive user data. Professor Dennis-Kenji Kipker from the Hochschule Bremen warned that this is "a technical error at the foundation of the internet." Anyone running a blog, online shop, social network, or even Wikipedia is affected, as this represents "the invisible structure of the internet we know."

Unauthorized access through this vulnerability could allow attackers to steal customer data, passwords, inject malware, and misuse servers for further attacks. Kipker emphasized that AI's faster exploitation of such flaws is a concern. The incident could have a long-term impact, as millions of unsecured systems on the network could now be compromised.

Several German states, municipalities, agencies, universities, and hospitals have taken precautionary measures by going offline temporarily and pulling their websites from the network. International measures have also been taken. Normal end-users do not need to take direct action while browsing but could indirectly be affected by service outages or potential data leaks from unsecured servers.

The update is meant to provide a solution, and operators of web applications are obligated to implement patches and security updates without delay. Older PHP versions, no longer officially supported by developers, pose an incalculable risk and should be isolated or updated immediately. Henrichmann noted how vulnerable the public sector is when central software contains undiscovered errors for years.

Criminals and even state actors have been known to exploit such gaps. He welcomed the Great Coalition's plan to significantly increase the BSI's budget in the 2027 budget proposal. "Our security agencies need the tools, experts, and legal authority to stay ahead in this race," he said. "But every civilian actor must finally recognize how real and severe security gaps on the network are." More: Critical security gap threatens websites worldwide - Expert: "We're already seeing attacks"