(de-news.net) — Germany’s federal government says it has found no evidence that a PHP security vulnerability has compromised federal websites or IT systems after several ministry websites were taken offline as a precaution. Meanwhile, the CDU Economic Council is calling for sustained investment in municipal IT resilience, while the head of the Federal Office for Information Security (BSI) is demanding enforceable safeguards for artificial intelligence (AI). Developments point to complementary policy priorities: precautionary responses to software vulnerabilities, sustained resources and recovery planning for local government, and clearer accountability for AI systems capable of acting autonomously.

Digital Minister Karsten Wildberger (CDU) said there were currently no indications that the PHP vulnerability had affected federal government websites or IT systems. The Federal Office for Information Security (BSI) and the Federal Information Technology Center (ITZ-Bund), the federal administration’s central IT service provider, had responded swiftly to the warnings. Several ministry websites hosted by ITZ-Bund were taken offline early Wednesday afternoon as a precaution. Wildberger defended the decision as appropriate, adding that available findings showed no evidence of a successful compromise of federal administrative systems.

CDU Economic Council seeks stronger municipal defenses

While federal authorities assess the vulnerability, the CDU Economic Council is urging federal and state governments to improve municipalities’ protection against cyberattacks. A position paper due to be submitted to the Federal Government argues that digital public services must be supported by measures to ensure their security and availability. Council Secretary-General Wolfgang Steiger said public authorities should not expand digital services without ensuring that the systems behind them remain protected and operational. The organization is calling for multiyear funding for IT personnel and maintenance, warning that municipalities should not be assigned new responsibilities without adequate resources.

The proposals also address continuity after an attack. Municipalities should secure essential data so it can be restored following a hacker intrusion and regularly rehearse how to continue operating if computer systems become unavailable.

Steiger stressed that a digital state must remain functional even when its IT infrastructure is under pressure. The council plans to present its paper to Digital Minister Karsten Wildberger in November. It is also urging the CDU/CSU–SPD coalition to complete initiatives already underway, including CyberGovSecure, which aims to strengthen federal administrative IT, and the planned Cyberdome, designed to detect attacks at an early stage. The paper cautions that announcing a project does not mean protection is available nationwide.

BSI chief calls for enforceable rules on autonomous AI

Beyond conventional software vulnerabilities, AI may introduce additional risks for public institutions and private companies. BSI President Claudia Plattner criticized major developers for paying insufficient attention to system security, telling Der Spiegel that the problem extended to leading providers in both the United States and China. She called on manufacturers to prevent their systems from enabling uncontrolled attacks and accept responsibility when safeguards fail. Providers, she argued, must ensure that such incidents do not recur; otherwise, questions of legal liability could arise. She went on to say that repeated incidents involving autonomous AI agents, alongside the deliberate misuse of AI by humans, made stronger oversight necessary. Voluntary commitments and promises to exercise greater caution would not be enough, she argued, while conventional political instruments might also prove inadequate.

Plattner called for rules that reflect how AI systems operate, including who owns them, who instructs them, and which actions they are authorized to perform. Existing frameworks must be adapted to account for autonomous agents rather than relying exclusively on approaches developed for earlier technologies. She also advocated establishing a body to verify compliance, moving oversight beyond voluntary assurances. Plattner does not expect the problems caused by autonomous agents or the deliberate misuse of AI to subside soon, warning that a prolonged period of heightened security challenges lies ahead.