Hardly any web service runs without PHP. Security experts are warning of a highly critical vulnerability in the programming language. Millions of web servers are potentially at risk, including online shops, government portals and content management systems such as WordPress. As a precaution, many operators have taken their websites offline until security updates could be installed. In this interview, Leonard Renners, Professor of Computer Science specialising in IT security at Ostfalia University of Applied Sciences, explains why this is the case and what everyone can do themselves:
Many people probably heard about PHP for the first time yesterday as a result of the global security alerts. What exactly is it, and why does this security vulnerability affect us in our daily lives?
PHP is a scripting language used to run dynamic websites. It is used, amongst other things, in content management systems such as WordPress, which are used to create websites and blogs, but also in cloud services such as Nextcloud and ownCloud. Precisely because PHP is so widely used, these security vulnerabilities can affect a great many online services that form part of our digital daily lives.
What exactly can happen if a website or online shop fails to patch this vulnerability (in good time)?
Strictly speaking, two security vulnerabilities have been disclosed: CVE-2026-109618 and CVE-2026-109619. Both have been given a severity rating of 9.2 out of 10, particularly because they allow for so-called ‘unauthenticated remote code execution’. This means that an attacker can execute their own malicious code on a vulnerable server via the network without first logging in and without the victim’s involvement. This malicious code is executed with the privileges of the affected process that hosts the website. As a result, an attacker may, under certain circumstances, be able to access data and read, modify or delete it. The extent of control over the server depends specifically on the privileges of the process and the respective system configuration.
Security vulnerabilities are a recurring issue. However, this one seems to carry a different level of urgency. Why is that? Is it partly because cyberattacks have become more agile and more likely as a result of AI development?
One factor is certainly the increasing use of generative AI. It can facilitate and accelerate the development and, in particular, the customisation of so-called exploits – that is, malicious code that exploits a vulnerability. In this case, however, the particular urgency stems primarily from the high criticality of the vulnerabilities combined with the widespread use of PHP.
If, for example, someone has a small WordPress website and has virtually no specialist IT knowledge, nor has they commissioned an agency, what advice would you give that person now?
Updated software packages are now available. My advice is therefore to install the necessary security updates as soon as possible to secure the websites. It is important to note that updating WordPress alone, for example, may not be sufficient, as the security vulnerability affects PHP itself and the underlying software package must therefore be updated. According to the PHP developers themselves, even some of the suggested workarounds cannot offer comprehensive protection, so the secure solution is to use the updated version of PHP.
If a security update cannot be applied promptly, the website should be temporarily taken offline or shielded from public access until the vulnerability has been rectified.
Should ordinary internet users now start to panic, or does the responsibility lie with website operators?
No, there is no cause for panic. The immediate need for action lies primarily with the operators of the affected servers and websites. However, there is an indirect risk for users: there may be restrictions on the availability of online services, and if a service they use has been successfully attacked, their personal data may also be affected. Operators must investigate such incidents and, where necessary, inform those affected.