Future Proof Tech Briefing · October 2026
RAMmageddon, Part 12: Two Speeds
482 megawatts next door, and a homepage that isn’t coming back.
Today I wanted to look something up on the website of a large association here in Rhineland-Palatinate. Nothing special, a piece of information you would normally find in two clicks.
The site is offline. No maintenance page, no notice, just a bare server error. I don’t know how long it has been down. The web archive last shows it working normally on 9 October, built on WordPress, which means PHP.
My guess, and I want to be explicit that it is a guess: the site has been dark since 21 October and is stuck on exactly the problem this part is about. I can’t prove it. But the pattern fits what we saw across Germany this week.
And a little under twenty kilometers away, in the neighboring district, one of the largest data centers in Europe is being planned.
That is Germany in autumn 2026. Two speeds, one region.
What happened on 21 October
Two critical vulnerabilities in the core of PHP, the language that a large share of all websites runs on. CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Anyone exploiting them can run their own code on the web server without logging in. In a nod to Log4Shell, the trade press now calls the whole thing PHP2Shell.
Germany’s federal cyber security agency BSI issued its second-highest warning level and advised operators to take affected servers completely offline if in doubt. That is exactly what happened. Berlin’s Charité hospital went completely offline, as did parts of berlin.de, the Berlin police’s online reporting service and municipalities all over Germany. The city of Mainz also switched off mainz.de. My favorite sentence of the week came from the Berlin police: in an emergency, please dial 110.
Two details make this story bigger than just another vulnerability.
First: an AI found it. The security company Calif came across the first flaw on 1 August using an OpenAI model. For two months the patch was prepared behind closed doors, then the details leaked two days before the planned date.
Second: the attackers were faster than the patch. Amazon observed a first exploitation attempt as early as 17 October, four days before the release.
The patch was ready. The system wasn’t.
And now the part hardly anyone talks about.
The patch arrived on time. PHP 8.5, 8.4, 8.3 and 8.2 had their updates on the evening of 21 October. Anyone running a well-maintained platform was back online within hours. Many hosting providers rolled out the updates centrally, and most of their customers never even noticed.
But only those on a supported version.
One hosting provider brought the patched versions back online the same evening. Everything older stayed on the maintenance page. Another could not update some customers at all, because their old applications could not handle the new PHP, and had to move those systems to other servers. In North Rhine-Westphalia, the district of Paderborn and the Bielefeld fire department were still dark three days later.
There is no patch for PHP 7, let alone PHP 5. There is only migration. And that has been pushed back for years, because the site still works.
This is exactly what I mean by DigitalWasteland. The vulnerability is not the problem. There will always be vulnerabilities. The problem is the legacy sprawl underneath: the content management system from 2014, the plugin nobody maintains anymore, the agency that no longer exists, and nobody who knows what is actually running on the server. If you do nothing, that is where you inevitably end up. PHP2Shell simply made visible who is already there.
And the next deadline is already set: security support for PHP 8.2 ends on 31 December 2026. Anyone who patched to 8.2 today has bought themselves two months.
Meanwhile in Rheinhessen
Change of scene, a little under twenty kilometers from my home. On the site of the former Anderson Barracks near Nierstein and Dexheim, NTT Data is planning a data center campus with 482 megawatts of IT capacity. Nine modules, its own substation, around 400 jobs. According to heise, the third-largest planned data center in Europe. The zoning plan has been in force since January. NTT intended to submit the building application in spring 2026; I could not confirm from public sources whether that has happened. Construction is planned to start in 2027, with first operations in 2029 and a build-out over roughly ten years.
Note that the 482 megawatts are for IT alone. Cooling and infrastructure come on top.
The local debate is correspondingly loud. Where is the power supposed to come from? What about cooling, water, waste heat? NTT’s answers: a grid connection via Westnetz and the Dexheim substation, closed-loop cooling with low water consumption, electricity from renewable sources on balance, plus solar and a wind farm on the site. On waste heat, the commitment for now is to support the town and the municipal association in developing concepts.
What I find fascinating is how the numbers take on a life of their own. One local portal writes about the power consumption of a city of a million. NTT itself calculates around 500,000 households. Run 482 megawatts at full load for a year and you end up at a good four terawatt hours. Depending on the utilization and household consumption you assume, both figures are a little bit right and neither is entirely right.
And that brings us back to the DigitalWasteland, just on a different level. Right now there are a lot of megawatt experts. In the entire debate, I have not heard anyone ask what is actually supposed to run in that building. Or whether their own software would even be able to benefit from it.
What this has to do with RAMmageddon
Quite a lot.
The data centers springing up everywhere are the customers memory makers are reserving their capacity for. For the fourth quarter, TrendForce expects contract prices to rise again by 10 to 15 percent for DRAM and 15 to 20 percent for NAND. The large cloud providers have secured themselves with multi-year contracts. The increases are borne by those who buy without such contracts: mid-sized companies, associations, municipalities. And even a confirmed order is no longer a fixed price: in 2026 HPE changed its terms so that prices can still be adjusted up to shipment.
In other words: the big players build 482-megawatt campuses. Everyone else pays more for hardware while struggling with systems that can no longer even be patched.
I stand by my thesis from Part 11. In your own data center, it usually does not pay to bring hardware purchases forward in a panic. Many systems will last another two years. But those two years are exactly the window for modernization. Move applications to supported platforms, standardize, automate, go cloud native where it fits. Not for the slide deck, but so that the next patch day takes hours instead of weeks.
The asymmetry
PHP2Shell was found by an AI. It won’t be the last. The tools that find vulnerabilities are getting faster, cheaper and available to everyone, on both sides.
The systems that need patching are not getting faster. They are getting older.
This gap will become the new normal. The question is not whether the next vulnerability will come, but whether you will be among those who are back online that evening, or among those whose site still shows a maintenance page a week later.
How was it for you on 21 October? Hours or days?
Transparency: The cover image was created with Gemini. I did the research and fact-checking with AI assistance; the theses and analysis are mine. Since 16 September 2026 I have been a Cloud Native Architect at Everpure (formerly Pure Storage), on the Portworx team. The opinions are my own.
Jens Klasen writes in the Future Proof Tech Briefing about the upheaval in enterprise IT. You can find all previous installments in my newsletter and at klasen.ai.