Digital Minister Karsten Wildberger announced that there is currently no indication that German federal websites or IT systems have been affected by the PHP security vulnerability. While emphasizing the seriousness of the incident and the rapid and clear reaction from the Federal Office for Information Security (BSI) and the federal IT service provider (ITZ-Bund), Wildberger noted that several government ministerial pages hosted by the ITZ-Bund were taken offline on Wednesday afternoon. He described the precautionary shutdown of these administration websites as the “right decision,” adding that current findings show no signs of a successful compromise of federal administrative systems.
The minister, who is responsible for federal digitization, also highlighted that this crisis marks the beginning of a new era in cybersecurity. He suggested that AI-powered tools could help detect vulnerabilities faster and more precisely than ever before. In the digital space, the focus is now on speed-identifying and closing security gaps in a timely manner. The government is approaching this development “resolutely,” planning targeted investments in “digital sovereignty” and building up internal competencies, including through a new AI security institute. By independently testing “leading models” and consistently deploying AI for network protection, the goal is to “win this race.”
However, security experts maintain caution regarding the full containment of the threat. Felix Kuhlenkamp, head of security at the digital industry group Bitkom, warned of future vulnerabilities in the internet, noting that powerful AI systems might eventually uncover errors that have gone undetected for years. Even with the updates released on Thursday afternoon, Kuhlenkamp stated that the risk is far from eliminated. He pointed out that the patch has not been universally implemented and that some software still relies on older, unsupported versions of PHP. He stressed that both these factors are dangerous, as attackers actively target systems that remain vulnerable.
Political voices are calling for wider public transparency regarding the incident. Donata Vogtschmidt, a digital politician, demanded that the government quickly leverage its communication channels to comprehensively inform companies, agencies, and the public about the risks. She argued for coordinated public education to ensure necessary security updates are implemented as rapidly as possible. Vogtschmidt asserted that cybersecurity must be understood as a component of disaster protection in the digital age, warning that any further delay increases the risk of serious attacks, and that the global vulnerability demonstrated underscores the fragility of German digital infrastructure.
Meanwhile, the German Association of Cities and Municipalities (DStGB) is demanding better federal and state structures to combat cyberattacks. A DStGB spokesman communicated that both the federal government and the states bear primary responsibility for establishing appropriate structures to enhance protection and ensure rapid crisis response. While the association acknowledges significant progress in the field of cybersecurity in recent years, they reported that deficiencies persist in numerous local communities, primarily due to a lack of financial and personnel resources coupled with rapidly rising security demands and shorter reaction times to threats. This situation, however, is unrelated to the PHP vulnerability. Despite the challenges, the spokesman praised the response of many municipalities, noting that their precautionary decision to take their websites offline was “quick and responsible,” serving the purpose of protecting their services and data.
