Thousands of websites offline across Germany due to security flaw

Thousands of websites were taken offline because authorities warned that a critical vulnerability in PHP could expose the servers running them. Hackers might gain control of those servers or reach sensitive information. Taking sites offline reduced the immediate exposure while organisations installed security updates. The risk mattered because PHP supports millions of websites worldwide.

The effects were visible across Germany. Parts of Berlin’s official portal disappeared, along with hospital, university and police websites. Berlin Police also reported an outage affecting its Internetwache online reporting service. The disruption extended beyond government services. Wikipedia and Pokémon apps warned users about possible interruptions. Websites in France, Belgium and the Netherlands were affected too.

Many services returned after updates were installed on Wednesday and overnight. However, some remained inaccessible on Thursday morning. BSI vice-president Thomas Caspers said there was no evidence of significant damage so far. Unpatched systems still face danger, and securing every affected website could take months.

PHP is a programming language and web technology used to build and operate many websites and online services. It runs on servers, which process requests and deliver pages or other digital services to users. The article describes PHP as widely used and says it underpins millions of websites worldwide. That broad use makes a weakness especially important.

The vulnerability was not mainly located on people’s phones or computers. It affected systems using PHP on their servers. If those systems were not updated, attackers could potentially exploit the flaw to gain control of a server or access sensitive data. Organisations therefore installed emergency patches and, in many cases, temporarily removed websites from public access.

The danger is large because PHP appears across many sectors. Government bodies, universities, hospitals, police services and other organisations rely on affected websites. Patches are now available, but older websites and applications may need more work than a simple update. Experts expect securing every affected system could take months.

The article says PHP underpins millions of websites worldwide. It does not provide a precise total or a country-by-country breakdown. Its importance comes from the technology’s broad use across websites and online services. A weakness in such a widely deployed system can create risks for many organisations at once.

In Germany, affected sites included parts of Berlin’s official portal, hospital websites, university websites and police services. The Berlin Police said its Internetwache online reporting service was disrupted. Government websites in France, Belgium and the Netherlands were also affected. Wikipedia and Pokémon apps warned users to expect possible service interruptions, showing that the impact extended beyond public authorities.

The scale also makes recovery difficult. Emergency updates brought many services back online, including sites in Rhineland-Palatinate, Saarland and Thuringia. Some North Rhine-Westphalia police services returned too, while other prominent sites stayed inaccessible. Experts warned that securing all affected systems could take months, especially for older applications.

The central danger was that attackers could exploit the PHP vulnerability on an unpatched server. Germany’s Federal Office for Information Security warned that hackers might gain control of servers or access sensitive data. Server control is serious because it can threaten the website and the services or information connected to it. The article does not describe a confirmed large-scale attack.

The risk affected public and private-facing services alike. Berlin’s official portal, police websites, hospitals and universities were among the sites disrupted. The Berlin Police’s Internetwache reporting service also experienced an outage. Wikipedia and Pokémon apps warned of possible interruptions. Organisations took systems offline while installing emergency security updates, limiting exposure during the response.

Patches are available, and many websites returned after updates were installed. BSI vice-president Thomas Caspers said there was no evidence of significant damage linked to the vulnerability so far. However, unpatched systems remain at risk. Older websites may require extensive work, and experts believe full remediation could take months.

Germany’s Federal Office for Information Security, or BSI, issued the key warning about the PHP vulnerability. It told organisations that hackers could exploit the flaw to gain control of servers or access sensitive data. That warning helped communicate the seriousness of the problem and prompted many bodies to take websites offline while updates were installed.

The BSI’s response was visible through both its alert and its assessment of the situation. Thomas Caspers, the BSI’s vice-president, said there was no evidence of significant damage linked to the vulnerability so far. Meanwhile, government bodies, hospitals, universities and other organisations installed emergency security updates. Many services then began returning online.

The BSI also warned that the response was not finished. Systems without patches remained vulnerable, and securing every affected website could take months. Older websites and applications might need more extensive work than a standard update. The office’s warnings therefore focused on immediate protection and continued remediation.

Organisations took websites offline because the vulnerability affected servers, and authorities warned that attackers could exploit unpatched systems. Removing a site from public access reduced its immediate exposure while technical teams installed emergency security updates. The article does not say that every organisation used exactly the same procedure, but it records widespread temporary shutdowns during the response.

The approach caused visible disruption. Parts of berlin.de became unavailable, and hospital, university and police websites went offline. Berlin Police reported an outage affecting its Internetwache service. Several services in Rhineland-Palatinate, Saarland, Thuringia and North Rhine-Westphalia later returned after updates were installed. Other prominent sites remained inaccessible.

Keeping a vulnerable website online might have preserved access for users, but it would also have left the exposed server reachable. The article identifies possible server control and data access as the major risks. Once patches were installed, many services came back. Yet older systems could require months of further work before they are fully secured.

A website server is the system that stores, processes or delivers a website and its services. A user’s phone or computer is the device used to connect to that service. The article makes this distinction clear: the problem was on website servers, not on users’ phones or computers. Most people therefore did not need to take immediate action.

The server-side flaw could allow hackers to gain control of affected servers or access sensitive data. Organisations using PHP had to protect those systems by installing emergency updates. Some took their websites offline during the process. Users might then see temporary outages when filing reports, making appointments or using government portals. Hospitals and universities also experienced disruption in some regions.

The main danger remained with unpatched servers. Users could still face inconvenience because services might be unavailable, but the article does not describe a need for them to repair their devices. Many websites returned after updates, while older applications could take longer to secure. Experts warned that full remediation might take months.