PHP Security Vulnerability: Obligations for Businesses and Management
Updated: Oct 23
Website security vulnerability: what the GDPR and the BSI Act require for updates, data breaches and reporting duties
According to media reports, two critical vulnerabilities have become known in the core of the widely used programming language PHP, through which attackers are said to be able to take over web servers without logging in. The Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) has issued a level 3 (orange) warning; some public bodies have switched off online services as a precaution. For businesses with a website, online shop or customer portal this is also a legal issue.
Security in Line with the State of the Art
Anyone who processes personal data, such as customer accounts or contact forms, must, under Art. 32 Abs. 1 of the General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO), take appropriate technical and organisational protective measures “taking into account the state of the art” and review them regularly. This includes closing known vulnerabilities promptly. If an available update is left uninstalled, it is hard to justify the appropriateness of the measures.
The Court of Justice of the European Union (Europäischer Gerichtshof, EuGH) has clarified: a successful attack does not in itself prove that the protective measures were inadequate. In a damages action, however, the company must prove that they were suitable (EuGH, judgment of 14.12.2023 – C-340/21). Data subjects (Betroffene) may under certain circumstances claim damages merely because of a justified fear of misuse of their data. Complete documentation is therefore decisive.
When a Report Is Required
A vulnerability alone is not yet a data breach. A report is required only where there is a personal data breach, for example unauthorised access, but also manipulation, loss or encryption of data. The data protection supervisory authority must then be informed “without undue delay and, where feasible, not later than 72 hours” after becoming aware of it, unless the breach is unlikely to result in a risk for the data subjects; a later report must be justified (Art. 33 Abs. 1 DSGVO). Where the risk is high, the data subjects must also be notified (Art. 34 DSGVO). Hosting providers and other processors (Auftragsverarbeiter), that is, service providers that process data on behalf of others, must notify their customers of breaches without undue delay (Art. 33 Abs. 2 DSGVO).
Additional Obligations under the BSI Act
The newly worded BSI Act (BSI-Gesetz, BSIG), implementing the European NIS 2 Directive, has applied since 6.12.2025. In certain sectors it already covers businesses with 50 or more employees or with annual turnover and balance sheet total each exceeding EUR 10 million; affiliated companies may count towards these thresholds. Covered businesses must register with the BSI, manage vulnerabilities systematically (§ 30 BSIG) and report significant security incidents in stages: an initial report without undue delay and no later than 24 hours after becoming aware, a more detailed report no later than 72 hours, and a final report one month later (§ 32 Abs. 1 BSIG).
Responsibility of the Management
Under § 38 BSIG the management (Geschäftsleitung) must implement and monitor the security measures and regularly take part in training. If it culpably breaches these duties, it is liable to the company under company law, in the case of a GmbH under § 43 Abs. 2 GmbHG. Outside the BSIG, too, an appropriate IT security organisation forms part of the “care of a prudent businessman” (§ 43 Abs. 1 GmbHG). Fines may be imposed on the company itself, under the GDPR up to EUR 10 million or 2 % of worldwide annual turnover – in each case whichever is higher (Art. 83 Abs. 4 DSGVO).
Practical Checklist
Establish which systems use PHP, including at the hosting provider.
Have updates installed and document them.
Isolate or replace versions that are no longer supported.
Secure logs before systems are cleaned up.
If access is suspected, check the reporting deadlines towards the data protection authority and, where applicable, the BSI.
Review contracts with IT service providers for security, information and support obligations (Art. 28 Abs. 3 DSGVO).
Establish whether the company falls under the BSIG.
Conclusion
Anyone who closes known vulnerabilities quickly and documents this reduces technical and legal risks alike. Please do not hesitate to contact us if you have any questions.
Status: 22 October 2026
NIETZER Rechtsanwälte · Attorneys at Law (USA) · Heilbronn · www.unternehmensrecht.com
This article is for general information purposes and does not replace legal advice in an individual case.
