PHP Incident Analysis: Two Flaws That Paralysed Millions of German Websites

On 22 October 2026 the Tagesspiegel published a detailed analysis of how two newly disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell) cascaded into a nationwide website shutdown. PHP, which powers an estimated large proportion of the world's websites including WordPress-based news portals, e-commerce shops, and government systems, had the flaws inadvertently made public before a patch was ready. The BSI issued its urgent warning at 14:06 on Wednesday, demanding that administrators 'install the security update today'. The scale of the shutdown was remarkable: within hours, dozens of German public institutions had taken their sites offline, including the Charité hospital, the Free University and Humboldt University, the fire departments of Berlin and other cities, and the police internet reporting portals of Berlin and Brandenburg. PHP developers published PHP 8.5.12 that same afternoon. The article quoted cybersecurity experts warning that AI-assisted attacks are shortening the window between vulnerability disclosure and mass exploitation to hours rather than days, calling this 'a turning point' in infrastructure security. Federal Digital Minister Karsten Wildberger confirmed federal systems were unaffected but acknowledged that the incident illustrates the need for near-instant patching capabilities.