PHP Security Flaw Takes Berlin Authority Websites Offline; Most Now Restored

On approximately 21 October 2026, security researchers disclosed two critical vulnerabilities in PHP — the scripting language that underpins a large share of the world's websites — designated CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed 'PHP2Shell'. The flaws could allow an unauthenticated attacker to execute arbitrary code on an affected server. Germany's Federal Office for Information Security (BSI) issued an urgent 'Orange' warning, calling for an immediate update to PHP 8.5.12 'today'. In Berlin, the university hospital Charité, the Free University, Humboldt University, the Berliner Feuerwehr web presence, and the Berliner Tafel all took their sites offline as a precaution. The police internet reporting portal (Internetwache) in both Berlin and Brandenburg also went dark. PHP developers published a patched version on Wednesday afternoon. By Thursday, Charité, the Free University, S-Bahn Berlin, and berlin.de were largely back online. The Brandenburg police portal remained down on the Thursday evening. Federal Digital Minister Karsten Wildberger said federal systems were unaffected but called the incident a sign that 'we are entering a new era of cybersecurity'.