What does the security flaw in "PHP" language mean for the internet?

A critical security vulnerability in the PHP programming language has sparked concern among information technology professionals and website operators. The German Federal Office for Information Security and international experts are warning of an imminent threat. Below are the key questions and answers:

Two highly critical vulnerabilities have been discovered in PHP, a widely used programming language that forms the technical foundation for a large portion of websites worldwide. These vulnerabilities, known as “PHP2Shell” and registered under CVE-2026-109618 and CVE-2026-109619, allow criminals to execute malicious code on servers remotely.

Given the risk of complete system compromise and the unintended early disclosure of details about the two vulnerabilities, authorities and IT security experts have classified the situation as an exceptional emergency. Many website operators have proactively taken their sites offline.

Yes, there is an indirect risk. If a website, citizen service portal, or online store uses an affected version of PHP and has not been promptly secured, attackers may gain access to the databases behind the site via malicious code. This could lead to the leakage of sensitive customer data, such as personal information, passwords, and contact details.

However, there is no direct risk to individual devices such as smartphones, tablets, and computers, as the vulnerability is limited to the servers hosting websites in the background.

It remains unclear exactly how the two PHP vulnerabilities were discovered. However, there are strong indications that the widespread use of artificial intelligence contributed to their detection, especially since the flaws had gone unnoticed for decades.

AI also plays a role in the nature of the threat. Attackers can use it to scan unprotected PHP servers for vulnerabilities and carry out large-scale attacks within seconds, without manual intervention. Thus, AI acts as an accelerant in this crisis for both sides, in attack and defense.

Website operators, whether running blogs, association sites, or corporate and public institution websites, must verify the version of PHP used in their server environment.

The development team released emergency security updates on Wednesday. Major web hosting companies, such as IONOS, have already updated PHP in their systems, providing protection at least for sites that rely on automatic security updates.

A wave of automated attacks has begun globally and is expected to continue for weeks or months, as attackers relentlessly search for systems that have not installed security updates.

The threat cannot be declared over until the vast majority of web hosting companies and system administrators install the security updates. Systems and old PHP versions that no longer receive official updates must be isolated or shut down immediately by their operators to prevent permanent vulnerabilities that cybercriminals could exploit.