Many websites in Germany were back online on Thursday, 22 October 2026, after an IT security incident disrupted access, according to Deutschlandfunk. The country's federal cybersecurity office, the BSI, said the danger has not yet been averted, the outlet reported.
The disruption is tied to a vulnerability in PHP, a widely used server-side scripting language, based on the reporting. Coverage from NDR.de described a dangerous security gap and noted that the first websites had become reachable again. Spiegel referred to the flaw as "PHP2Shell" and reported that a server weakness knocked government agencies offline.
Germany's digital minister said he saw no damage to the federal government following the IT gap, according to DIE ZEIT. WEB.DE published a question-and-answer piece on the security gaps.
The reports give no further detail on how many sites were affected, how long they were down, or who was behind any exploitation. The BSI's warning that the threat is not over suggests remediation work may still be under way.
What to watch next: whether the BSI lifts its warning and whether federal authorities confirm any impact beyond the temporary outages.
