Hamburg, October 22, 2026. Due to serious security vulnerabilities in the widely used programming language PHP, numerous government agencies, universities, and other institutions have taken the precautionary measure of taking their websites offline. The Federal Office for Information Security (BSI) rates the threat posed by PHP2Shell as exceptionally high. These vulnerabilities could allow attackers to execute malicious code on affected web servers and take control of systems.

„The problem isn’t just the individual security vulnerability. Attackers today can exploit vulnerabilities in a matter of moments. Companies must therefore be able to detect suspicious activity early on and respond immediately,“ explains Tim Stephan Schulze, CEO of the Hamburg-based IT company OIT.One.

An attack is detected—other systems respond automatically

The Mesh Intelligence security solution developed by OIT.One demonstrates how this can work. The system connects 36 server locations worldwide into a single security network.

For example, if a web server detects repeated suspicious access attempts, the information about the suspicious IP address is analyzed within the network. If the address is classified as an attacker, it can be automatically forwarded to all relevant systems and blocked there.

According to OIT.One, it takes only one to two minutes for such a block to take effect across the entire network. The block is implemented on two levels: directly on the individual servers and at the central network firewall.

„When one server detects an attacker, the other servers shouldn’t have to go through the same experience first. That’s exactly the idea behind Mesh Intelligence: One server detects the threat, and all the others benefit from that insight,“ explains Schulze.

The system takes into account not only attacks on websites, but also suspicious activity involving email services, remote access, and Internet telephony. This creates a shared body of security knowledge that is continuously expanded.

A quick response is no substitute for security updates

The recent PHP security vulnerabilities also underscore the fact that no additional security technology can replace the correction of a software bug. The PHP security updates that have since been released must therefore be installed immediately.

„Security updates patch the vulnerability. Networked threat detection also helps fend off known attackers early on. The key is the synergy between these two measures,“ Schulze emphasizes.