Overview
- A set of critical PHP vulnerabilities that allow unauthenticated remote command execution was disclosed and patched after security advisories were published on and around October 21.
- Many operators in Germany — including universities, city administrations, cultural sites and some police services — took public-facing websites offline on Wednesday as a precaution while IT teams and hosting providers prepared and applied updates.
- The federal cybersecurity agency BSI said the flaw can affect more than standard websites and highlighted risks to firewalls, load balancers, routers and NAS devices that expose web management interfaces.
- After providers applied the published patches, most affected pages were restored by Thursday and no confirmed intrusions or data thefts have been reported in the covered regions so far.
- Authorities urge continued monitoring and comprehensive patching at application, hosting and device levels and advise citizens to disable external router web access and delay downloads from unknown sites until providers confirm fixes.