# Source: PHP-Lücke legt Webseiten der MUL-CT und der BTU in Cottbus lahm

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

NIEDERLAUSITZ aktuell: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP-Lücke legt Webseiten der MUL-CT und der BTU in Cottbus lahm

**NIEDERLAUSITZ aktuell** · [https://www.niederlausitz-aktuell.de/niederlausitz-aktuell/orte/spree-neisse/329774/cottbus-brandenburg-php-sicherheitsluecke-php2shell-webseiten-offline-mul-ct-btu.html](https://www.niederlausitz-aktuell.de/niederlausitz-aktuell/orte/spree-neisse/329774/cottbus-brandenburg-php-sicherheitsluecke-php2shell-webseiten-offline-mul-ct-btu.html) · published 2026-10-22 · added by `curator@php.newsroom` · slug `niederlausitz-aktuell-niederlausitz-aktuell-orte-spree-neisse`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261029T094207Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A German regional news report (NIEDERLAUSITZ aktuell, 22 October) on websites in Cottbus, Lusatia and Brandenburg that went offline on Wednesday eveni...

## What it says, as the collector read it

#### PHP-Lücke legt Webseiten der MUL-CT und der BTU in Cottbus lahm

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/niederlausitz-aktuell/niederlausitz-aktuell-orte-spree-neisse-329774-cottbus-brand`, snapshot `20261029T094207Z`. Copied byte for byte; every file's sha256 is in `captures/20261029T094207Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A German regional news report (NIEDERLAUSITZ aktuell, 22 October) on websites in Cottbus, Lusatia and Brandenburg that went offline on Wednesday evening after the BSI warning, among them the city of Cottbus, the medical university MUL-CT, the BTU and the state portal brandenburg.de; by Thursday morning many were back, while Cottbus's site was still down while systems were patched and checked, with the city saying no damage had been found. The outlet polled about 110 sites in the region and found most reachable but a number not, without being sure the PHP flaw was the cause for each. It quotes the BSI's level 3 / Orange rating and that no confirmed attacks were known on Wednesday but unconfirmed reports of working attack tools existed, and relays heise that Cloudflare and Amazon report mass attack attempts with no successful attacks reported at first.

> Bestätigte Angriffe waren laut BSI am Mittwoch nicht bekannt, es gebe aber unbestätigte Berichte über funktionierende Angriffswerkzeuge.

_Curator's translation:_ "According to the BSI, no confirmed attacks were known on Wednesday, but there were unconfirmed reports of working attack tools."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP-Lücke legt Webseiten der MUL-CT und der BTU in Cottbus lahm". Selected mechanically, not read by a person.

#### Capture notes

Language `de`. A local outage log; the outlet says it could not confirm the PHP flaw as the cause for each unreachable site. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261029T094207Z · HTTP 200 · https://www.niederlausitz-aktuell.de/niederlausitz-aktuell/orte/spree-neisse/329774/cottbus-brandenburg-php-sicherheitsluecke-php2shell-webseiten-offline-mul-ct-btu.html- `headers.json` 76d7831c55cc3335ac526bb7d0f8b75bbae1064fc4e32a682a559101c3853d77 1,507 bytes
- `page.html` 4caee8a94b7906afc422f8a915ec8a6da92511254af0a17ab7908a075797d69f 298,005 bytes
- `provenance.json` c34c05de70d623d63e6d6075a55901d0c20ce81de4b972d513eb435e943fc124 1,954 bytes
- `rendered.html` 750d47b881f311ae872c3183213f5f001940ade4fc13634b7d0d2b2fc2767f80 296,518 bytes
- `screenshot.jpg` 155184bb5b6b3fa8e992834169078c16fd81701cb2f5fdf6abbe639ac20b5502 778,503 bytes
- `text.txt` f080f37d22fb0dea58902636eeb7b8a678674d98ea9c9efdde60f601b6071227 11,443 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.54 · data as of 2026-10-29T17:13Z · vault commit cd9375f1aefd · https://refs.php.oct.2026.newsroom.sgit.ai/sources/niederlausitz-aktuell-niederlausitz-aktuell-orte-spree-neisse/index.html