Marc Henrichmann, the Chairman of the Parliamentary Control Committee for Intelligence Services, warns of a new dimension of cyber threat caused by a severe security vulnerability in the PHP programming language. Speaking to the “Handelsblatt”, he stated that “we are experiencing a turning point,” explaining that artificial intelligence (AI) is transforming weaknesses-which were previously considered almost impossible to exploit-into “real entry points” in a short amount of time.
The CDU politician described this flaw as one of the most serious security gaps of recent years, noting that it affects a large proportion of websites worldwide, representing a crisis for the entire digital infrastructure. This incident also highlights how vulnerable governmental institutions are when central software contains undetected errors over several years. Such vulnerabilities are actively exploited by both criminal elements and state actors.
In this context, Henrichmann welcomed the planned strengthening of the Federal Office for Information Security (BSI) within the 2027 budget draft. He emphasized that security agencies “need the tools, the experts, and the legal authority to stay ahead in this race.” However, he simultaneously placed responsibility on companies and other operators of digital infrastructure. The CDU politician stressed that “every civil actor must finally grasp how real and consequential network vulnerabilities are.”
The issue stems from a critical vulnerability within the widely used PHP programming language. Attackers could use this flaw to take control of websites or steal sensitive data. Many public bodies and agencies have voluntarily taken their internet sites offline as a precaution, while a security update has since been released to patch the vulnerability.
