Kritische PHP-Schwachstellen: Behörden gehen offline

Kritische PHP-Schwachstellen: Behörden gehen offline

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page de/news/security-insider/kritische-php-schwachstellen-behoerden-offline-a-607c4678fa9, snapshot 20261103T094430Z. Copied byte for byte; every file's sha256 is in captures/20261103T094430Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A German IT-security trade report (Security-Insider) on the PHP flaws and the authorities that went offline. It recounts that Baden-Württemberg's state government took ministry and regional-council sites offline on 21 October as 'precautionary protection of infrastructure', that several universities and the university hospitals of Heidelberg and Mannheim did the same while stressing it was not a cyberattack, and that Mainz switched off several municipal services and its portal. It says it is open how many are affected, that PHP names the 8.2 to 8.5 series as affected and rates mod_php the highest risk, that Wiz's claim that every version of the last decade back to 5.4 is affected is not confirmed by PHP, that the sources do not prove exploitation before the patch though details were public in advance, that on 20 October around 15:20 UTC a Hacker News user wrote about the two embargoed flaws and the post was removed, that watchTowr confirmed the flaws and reproduced one, that Huntress and watchTowr had seen no attacks on real systems and Sansec's expectation of mass attacks was a forecast, and that who found the flaws is not clear (PHP's advisories name several reporters; Wiz says it found the first on 19 August and reported it on 24 August, confirmed by PHP on 21 September). It records PHP's advice to update at once, the UK NCSC's and CERT-EU's advice to take systems that cannot be secured quickly off the network, and temporary mitigations that reduce but do not remove exposure.

> Einen Zero Day, also eine Ausnutzung vor Verfügbarkeit des Patches, belegen die Quellen nicht.

_Curator's translation:_ "The sources do not prove a zero day, that is, exploitation before the patch was available."

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "Kritische PHP-Schwachstellen: Behörden gehen offline". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language de. The capture shows no publication date. The page names the Hacker News poster, a private user, and other forum and tool handles; none is recorded here. It describes how the flaws work and temporary configuration settings; none is copied. Nothing in the page addresses an AI or hides text from a reader.