Security flaw in PHP leaves German police and hospital sites down
A newly found flaw in the PHP programming language forced German authorities to take down police, hospital and university websites as a precaution.
Also in:Deutsch
A newly discovered security flaw in the PHP programming language has left police, hospital and university websites in Germany restricted, German outlets Tagesspiegel and Rheinische Post reported on Wednesday. Berlin's and Brandenburg's police online services, where people normally file reports, remained unreachable, as did the capital's official portal, berlin.de, and some municipal sites in Brandenburg.
Authorities in several German states took websites offline on Wednesday as a precaution after the flaw was found, the outlets reported. By Thursday morning some services had been restored, including sites in Rhineland-Palatinate, Saarland and Thuringia, among them Thuringia's state chancellery, police and interior ministry pages; several North Rhine-Westphalia police services were also back online, though other prominent sites in the state remained down.
Germany's Federal Office for Information Security (BSI) issued an official cybersecurity warning over the flaw, saying it carries a high threat potential and urging rapid installation of security updates. PHP underpins a large share of the internet, from blogs and news sites to online shops and content-management systems such as WordPress, the outlets said.
Follow this story
An email when there is a real update (a new toll, a cause, an arrest). Nothing else; stop with one click.
Free: one story at a time. Members follow as many stories as they like.
What we know
- 2+ outlets · Tagesspiegel, Rheinische Post A newly found security flaw in PHP left police, hospital and university websites in several German states restricted, Tagesspiegel and Rheinische Post reported.
- 1 outlet · Tagesspiegel Berlin and Brandenburg police online reporting services and the berlin.de portal remained unreachable; Berlin's S-Bahn said its own sites were fully back online.
- 1 outlet · Tagesspiegel Germany's BSI issued an official warning, calling the threat potential high and urging rapid security updates.
- 1 outlet · Rheinische Post Some services, including in Rhineland-Palatinate, Saarland, Thuringia and parts of North Rhine-Westphalia, were restored by Thursday morning.
How each fact is established: Verified checked by an ECTV editorOfficial stated by an official body2+ outlets reported independently by two or more news organisations1 outlet reported by a single news organisation so farUnconfirmed claimed or reportedHow we label facts
Why it matters for Europe
PHP underpins a large share of websites and online services worldwide, from government and police portals to hospitals, universities and online shops, so a flaw in it can disrupt services across many sectors at once. The outage of police reporting sites and partial restrictions at hospitals in the Berlin-Brandenburg region show how a single software flaw can touch essential public services, even though ordinary users browsing on their own phones or computers face no direct risk, the BSI said.
Sources
Reported by 3 reports from 3 independent outlets in 2 countries.
- Tagesspiegel: PHP-Webskriptsprache: Internetangebot weiter eingeschränkt wegen Sicherheitslücke
- Stern: PHP-Webskriptsprache: Sicherheitslücke: Internetangebot teils noch eingeschränkt
- Rheinische Post: Programmiersprache PHP betroffen: Internetangebot nach Sicherheitslücke teils noch eingeschränkt
- Tagesspiegel: PHP-Webskriptsprache: Sicherheitslücke: Internetangebot teils noch eingeschränkt
Source balance
PremiumSee how the 3 outlets behind this story spread from left to right, and which are official or OSINT sources.
Free during the launch: create an account →Log inHow we rate sources
Intelligence file
PremiumSee how we verified this story
Confidence and impact scores, the full situation report and the event timeline.
Launch offer: free for members until 31 October 2026
Questions and answers
- What caused the disruption?
- A newly discovered security flaw in the PHP programming language, which underpins much of the internet, prompted German authorities to take affected websites offline as a precaution.
- Which services were affected?
- Berlin and Brandenburg police online reporting services, the berlin.de portal, some municipal sites in Brandenburg, and several hospitals and universities in the region, among others.
- Are ordinary internet users at risk?
- Germany's BSI said there is no direct risk for people browsing on their own devices, since the flaw affects servers rather than end-user devices, though some online services may be disrupted.
This article was written with AI assistance from 4 verified reports and checked under the ECTV editorial policy. Spotted an error? Request a correction.