Yesterday afternoon, a vulnerability was discovered in the PHP programming language, which was deemed so critical that I was forced to take our websites, which rely on it, completely offline. The downtime lasted more than 12 hours. It was only this morning that our service provider applied the necessary patches, meaning we have been back online since around 09:00. As we use so-called ‘shared hosting’ with the provider all-inkl.com for the majority of our websites for cost reasons, we were unable to carry out this update ourselves.

Various services provided by all-inkl.com – for example, the webmail service accessible via the browser at https://webmail.all-inkl.com, which is used by many members in connection with ‘Tonmeisterei’ email addresses – are still difficult or impossible to access. I expect that everything will be back to normal by this evening.

In contrast to the website servers, we run a Nextcloud and a calendar server (Baikal) in an environment hosted by Hetzner, to which we have full root access.

I was therefore able to install the necessary security updates yesterday evening, meaning that this area effectively experienced no downtime. Following an audit, no specific attacks were recorded here either. These services are used by the administrative office, the educational centre and the voluntary service.

Unfortunately, the issue of IT security remains a pressing concern and continues to demand significant time, financial and human resources.

Christoph Thelen