(de-news.net) – After a significant PHP vulnerability revealed flaws impacting websites and online businesses globally, Germany is increasing its cybersecurity efforts. Attacks against law firms have sharply increased, underscoring the mounting hazards of ransomware and state-sponsored espionage as governments push AI-driven defenses and companies boost security investment. The cyber chief of the Bundeswehr, meanwhile, cautions that AI might speed up attacks beyond current reaction capabilities, leaving vital infrastructure exposed while software patches are delayed.

Germany is facing mounting cybersecurity challenges as a critical vulnerability in the widely used PHP programming language exposes websites and online services to potential attacks. The incident has renewed calls for greater investment in digital protection, while security researchers report a sharp increase in cyberattacks against law firms. Government officials are looking to artificial intelligence (AI) to strengthen defenses and accelerate vulnerability detection, but the German military’s cyber chief warns that AI-enabled attacks could develop faster than existing response capabilities, particularly threatening critical infrastructure.

Following the discovery of a serious vulnerability in PHP, Ralph Brinkhaus, a CDU lawmaker specializing in digital policy, has called for increased investment in cybersecurity. He said the incident demonstrated the exposure of digital systems to exploitation and underscored the need to strengthen protective measures. The vulnerability affects technology underpinning a substantial number of websites and online services worldwide, potentially providing cybercriminals with opportunities to compromise inadequately protected systems.

Germany turns to AI-driven defenses

Federal Digital Minister Karsten Wildberger (CDU) has advocated a more extensive application of artificial intelligence to identify and address software vulnerabilities. He emphasized that the speed and precision of security responses were becoming increasingly important as AI-powered tools offered new opportunities to detect weaknesses before they could be exploited.

Wildberger also highlighted government efforts to strengthen digital sovereignty and develop domestic technological capabilities. These include the establishment of a new AI security institute in Berlin, intended to contribute to the independent assessment of leading AI models. Combining such evaluations with the systematic use of artificial intelligence to protect digital networks is considered an important component of Germany’s cybersecurity strategy.

The Federal Office for Information Security (BSI) and international authorities issued warnings last week about the highly critical PHP vulnerability. Given PHP’s widespread use in operating websites and online services, the discovery prompted precautionary shutdowns affecting numerous websites, including those belonging to the federal government and its administration.

Wildberger said the government was treating the incident and associated warnings with considerable seriousness, adding that national cybersecurity authorities had responded swiftly and proactively. At the time of his assessment, there were no indications that federal administrative systems had been successfully compromised. Nevertheless, the Digital Ministry confirmed that the BSI’s warning issued Wednesday remained in effect, urging all PHP users to install the available security patches without delay.

Companies increase spending amid mounting risks

German businesses are allocating more resources to information technology security as the threat of cyberattacks continues to grow. Bitkom, the country’s digital industry association, expects domestic cybersecurity expenditure to exceed 14 billion euros this year, with further growth forecast for 2027. The projection is based on figures supplied by a market research institute.

Security software represents a particularly significant area of expanding investment. This includes applications designed to protect end-user devices, regulate access privileges and detect digital intrusions. The growing expenditure reflects the substantial economic consequences of data theft, industrial espionage and sabotage. A Bitkom study estimates that the resulting losses amount to at least 211 billion euros annually, with cyberattacks accounting for almost three-quarters of the damage.

Despite the increase in spending, the association considers current investment levels insufficient. German companies devote an average of 18 percent of their IT budgets to security measures, falling short of the 20 percent allocation recommended by the BSI. The gap highlights the continuing challenge of aligning corporate security expenditure with the scale of the risks facing increasingly interconnected business operations.

Attacks against law firms, legal departments more frequent

Cybercriminals and state-sponsored espionage groups are increasingly targeting law firms and corporate legal departments, attracted by the sensitive information held within their systems. According to CrowdStrike’s Legal Threat Landscape Report 2026, published Wednesday, the number of attacks against organizations in the legal sector has nearly doubled since 2023.

The information sought by attackers includes confidential client records, intellectual property, financial documents, merger and acquisition plans, and litigation strategies. Such material can be exploited for financial extortion or economic espionage, making legal organizations particularly valuable targets. Germany ranks among the countries most frequently attacked, alongside the United States, the United Kingdom, Canada, Australia and Israel.

Financially motivated cybercriminals accounted for 82 percent of the attacks observed by CrowdStrike. Between September 2025 and August 2026, ransomware groups specializing in high-value targets, commonly known as Big Game Hunting operations, listed 455 legal-sector organizations on data-leak websites. This represented a 39 percent increase over the previous 12-month period. The attackers exploit the strict confidentiality obligations governing legal practices, which can place firms under considerable pressure to pay ransoms quickly to prevent reputational damage and potential regulatory penalties.

Ransomware groups exploit legal confidentiality

CrowdStrike identified Chatty Spider as the most aggressive individual threat, with its activity increasing by 129 percent within a year. The group focuses almost exclusively on law firms and employs sophisticated social engineering techniques to obtain access to their systems. Its members impersonate internal IT personnel during telephone calls, persuading lawyers or administrative employees to authorize access through remote-management software. In one documented incident, the attackers attempted to extract sensitive information just four minutes after entering the system. In several cases in the United States, individuals were reportedly recruited to enter law offices physically and connect directly to workplace computers.

The report points to increasing technical specialization. A ransomware, for example, exploited vulnerabilities in Intapp Time Server, software used by law firms to record and bill working hours, to obtain remote access to their systems. Another ransomeware employed a different approach, targeting legal organizations through large-scale attempts to access their Microsoft 365 accounts.

The company warns that law firms are increasingly serving not only as direct targets but also as potential entry points into the networks of major corporations, government organizations and technology companies. It therefore recommends stronger multifactor authentication, tighter controls over remote-access software and more comprehensive protection of specialized legal-sector applications.

Military warns of AI-driven threats to critical infrastructure

Germany’s military leadership is increasingly concerned that artificial intelligence could substantially enhance adversaries’ ability to exploit software vulnerabilities and penetrate digital networks. Vice Adm. Thomas Daum, inspector of the Bundeswehr’s Cyber and Information Domain Command, described the potential misuse of advanced AI applications as a serious security threat.

According to Daum, increasingly powerful AI systems could give hostile actors unprecedented capabilities and speed in developing intrusion techniques and gaining access to protected digital environments. Although cybersecurity capabilities have improved in the affected sectors, he believes the associated risks have increased exponentially, creating a worldwide challenge extending well beyond military systems. In Germany, the threat also encompasses the country’s entire critical infrastructure.

Daum expressed particular concern about the inability of existing response mechanisms to match the speed at which potential attacks could develop. He described the growing disparity between emerging threats and institutional reaction capabilities as an exceptional source of concern, noting that this was the first time during his six years as inspector that the situation had caused him such serious unease.

Patching delays leave critical infrastructure exposed

Critical infrastructure encompasses sectors whose disruption or failure could result in supply shortages, threaten public safety or produce other serious consequences. These include energy, information technology, transportation, and traffic systems, all of which depend on increasingly interconnected digital networks.

For Daum, the central challenge lies not simply in identifying software vulnerabilities but in closing them before attackers can exploit them. This requires detecting weaknesses, developing appropriate security patches and distributing them to affected systems. Such procedures generally take between three and six weeks, leaving potentially vulnerable systems exposed throughout the interim period.

The recent PHP vulnerability illustrates the difficulties involved. Its discovery triggered an international race between website operators seeking to install updated software and cybercriminals searching for unprotected servers. Daum considered the precautionary shutdown of numerous websites an appropriate response, suggesting that comparable measures could also be necessary in future incidents.

He also raised the possibility of temporarily disconnecting substantial parts of affected networks from the internet when immediate protection becomes essential. In his assessment, restricting external connectivity could be preferable to leaving vulnerable systems accessible while security weaknesses remain unresolved. The approach reflects the growing tension between maintaining digital availability and ensuring operational security when vulnerabilities cannot be addressed quickly enough.