Thought Leadership
Millions of automated attack attempts, while authorities and website operators take sites offline: Many are now back online. But systems that have missed a critical update remain vulnerable.
The global security vulnerability continues to cause concern. As administrators worldwide rush to install emergency patches, a wave of cyberattacks is sweeping across the internet. There are, however, some encouraging signs: Many websites that were taken offline as a precaution have returned after their operators successfully secured them.
Millions of Attack Attempts After the Vulnerability Was Disclosed
Recent figures from cybersecurity providers show why the drastic precautionary measures were justified. Matthew Prince, CEO of US-based network and security company Cloudflare, told British broadcaster Sky News that the internet had been hit by a substantial wave of automated attacks.
According to Prince, malicious actors began systematically scanning the internet for unprotected servers immediately after details of the vulnerability, known as “PHP2Shell,” became public. Within hours, the number of access attempts had risen exponentially.
During the first ten hours before the official announcement, Cloudflare had recorded only a few thousand attempts. Just two hours after the disclosure, that figure had climbed to hundreds of thousands. The total has since reached millions of attempts worldwide to exploit the vulnerability.
Unpatched Systems Remain at Immediate Risk
Although many major platforms and web hosting providers responded quickly, IT experts and Germany’s Federal Office for Information Security (BSI) continue to urge caution. Criminal networks are still using automated scanning scripts, leaving every PHP installation that has not been updated to a patched version exposed to attack.
Website operators are being urged to check immediately through their hosting provider’s customer portal or their content management system’s dashboard to confirm that the emergency updates have been installed. Outdated PHP versions that are no longer officially supported by their developers should not remain exposed to the public internet without protection while operators plan a migration or isolation.
Cybersecurity Warning
On Wednesday, the BSI issued an official cybersecurity warning, calling for security updates to be installed without delay. The vulnerabilities pose a significant threat. In response, several German states, municipalities, government agencies, universities and hospitals took their websites offline as a precaution.
“Systems for which a security update has not yet been installed must under no circumstances remain connected to the internet,” IT security expert Christoph Fischer told the German Press Agency (dpa). He called for operators to take decisive action. “Every unprotected PHP application is an open door for criminals right now.”
No Federal Government Websites Compromised
Germany’s Digital Minister Karsten Wildberger said there was no evidence that federal government websites or IT systems had been affected by the PHP vulnerability. Speaking to the German newspaper Bild, the Christian Democratic Union (CDU) politician said: “We are taking this incident and the current warnings very seriously.” The BSI had responded quickly and clearly in coordination with ITZBund, the federal government’s central IT services provider.
Wildberger also defended the precautionary decision to take federal government websites offline. “Based on what we know so far, there is currently no evidence of a successful compromise of federal government systems.”
The Situation Across Germany’s States
By Thursday, some government websites across Germany had become accessible again, including many sites in Rhineland-Palatinate and Saarland. In Thuringia, numerous websites had also returned online since late Wednesday evening, including those of the State Chancellery, state police and Interior Ministry.
In Baden-Württemberg, some websites displayed maintenance notices. “This measure is intended to protect the infrastructure as a precaution until the developers provide the required security updates,” the State Ministry said.
In North Rhine-Westphalia, several high-profile websites were still unavailable on Thursday morning. However, according to authorities, several online services operated by the state’s police had already been restored.
“We Are Reaching a Turning Point”
For ordinary internet users, everyday browsing on smartphones and PCs did not initially require any direct action. The vulnerability affects servers running in the background, not end-user devices themselves. Consumers may nevertheless be affected indirectly, for example through outages affecting essential online services or potential data leaks from websites that were not secured in time.
Debate Over PHP Security
In response to the latest critical PHP vulnerability, Thomas Boele, a security expert at Check Point, called for more sustainable funding for open-source projects.
Speaking to the German Press Agency (dpa), he said the foundations responsible for maintaining these essential components of digital infrastructure urgently needed broad-based, reliable funding. This would help ensure that security standards are continuously maintained, modern development practices incorporating expensive AI tools are implemented, and regular audits are conducted.
“The real sticking point is ensuring that open source is properly funded,” Boele said.
(Christoph Dernbach, dpa/Translation: Editorial Team)
