The PHP2Shell Incident and What It Reveals About Digital Sovereignty

We spoke with René Lührsen about the incident and what it reveals about digital sovereignty. He is pursuing his Ph.D. at the Institute for Management and Organization (IMO) at Leuphana under Prof. Dr. Matthias Wenzel and is a research assistant to Prof. Dr. Maximilian Heimstädt at Helmut Schmidt University/University of the Federal Armed Forces in Hamburg. In his dissertation, he examines the Sovereign Tech Agency (STA), which has been promoting the maintenance and security of open digital infrastructure on behalf of the federal government since 2022. His research was funded by a doctoral fellowship from the Hans Böckler Foundation. Together with Maximilian Heimstädt and Thomas Gegenhuber (Johannes Kepler University Linz), he published the study “Organizing Public Support for Open Digital Infrastructure” with the foundation in 2025.

Dear Mr. Lührsen, PHP itself is open-source software. What advantages does open-source software offer for Germany's digital infrastructure?

Anyone can use, examine, modify, and distribute open-source software. Developers therefore do not have to start from scratch every time, but can build on freely available building blocks. PHP is one such building block. Systems such as WordPress and TYPO3 run on PHP, and with them, the websites of many municipalities, hospitals, and universities. Another advantage relates to digital sovereignty—that is, the ability to make autonomous decisions about the technology one uses. Because the source code is open, it’s possible to verify and modify what a piece of software actually does. Vulnerabilities can be identified and fixed independently. And no one is dependent on a single vendor who can unilaterally change prices, licenses, or support. Open-source software thus opens up the possibility of self-determination. Whether this possibility becomes a reality depends on whether someone maintains the software over the long term.

PHP's code is available for everyone to view. Why do such vulnerabilities remain undetected, and could the risk have been mitigated?

Just because code is publicly available doesn’t mean anyone is continuously maintaining and developing it. In the case of PHP, the bugs that have now been identified had been in the code for many years. The maintenance and further development of open-source software infrastructure often rely solely on a very small group of developers, who are generally underfunded. This is typical of maintenance work in open-source software; much of it is done on a volunteer basis. This openness makes it easy to use the software but difficult to fund the work required to maintain it. Companies usually pay for the features their own products need. Maintenance—that is, reviewing code, closing vulnerabilities, and updating outdated components—is often neglected. The risk can certainly be mitigated, and PHP in particular demonstrates this. In 2024, the STA funded the first external security audit of the PHP core in over ten years. It revealed 17 security-related findings and contributed to subsequent work on the root cause of one of the two PHP2Shell vulnerabilities. The PHP Foundation has expressly acknowledged this support. However, an audit is merely a snapshot. Finding vulnerabilities is only the first step. Fixing them and preventing them in the future requires people who know the code inside and out, as well as time that someone must pay for.

As an organizational researcher, you followed the STA for a year and a half. What did you learn about how government funding and open-source communities can work together?

The STA serves as a bridge between the government and communities—that is, the globally distributed groups that collaborate on software development—because it understands both sides. It was founded by members of the open-source communities and digital policy stakeholders, and the team brings technical expertise to the table. In other words, it knows what it’s funding and how the communities operate. At the same time, the agency is familiar with the rules governing taxpayer funds, such as accountability and reporting requirements. It adapts these rules so that projects only have to deliver what is truly necessary—for example, through streamlined applications and reports in a format that fits the project’s workflow. Conversely, it explains to policymakers and the public why seemingly unremarkable software like PHP is so important. Public funding, therefore, requires more than just money—it needs an intermediary organization that bridges both worlds.

AI played a role in uncovering the PHP2Shell vulnerabilities. What does this mean for the future of open digital infrastructure, and what needs to change?

AI accelerates the discovery of vulnerabilities, for security researchers as well as for attackers. However, the vulnerabilities still need to be fixed by people who know the code inside and out, and there are too few of them. The bottleneck is thus shifting from discovery to remediation—and consequently to underfunded maintenance work. Therefore, funding, above all, needs to change. Things are starting to move in this area, even at the EU level: Under the umbrella of Digital Commons EDIC, an alliance of several EU member states, a European Sovereign Tech Fund modeled after the German approach is being piloted. Ideally, many public and private programs will emerge side by side. Then, maintenance won’t depend on a single funder, and it will become as routine as the upkeep of roads and bridges, rather than merely a reaction to the next crisis.en und Brücken, statt nur eine Reaktion auf die nächste Krise zu sein.

Thank you!

René Lührsen