# BSI Warning Level Orange: What the Rating Means

> BSI warning level orange explained: what the four levels mean, why PHP2Shell counts as business-critical and which decisions companies need to make now.

Source: https://phpsos.de/en/blog/bsi-warnstufe-orange-erklaert/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

**In short:** BSI (German Federal Office for Information Security) warning level orange is the second-highest of four levels. It means that the IT threat situation is business-critical and normal operations may be massively impaired. For PHP2Shell, the BSI has assigned this level 3 and recommends updating immediately or, if that is not possible, taking affected web servers offline temporarily. For companies, orange means: this topic belongs on the management's table today.

## What the rating means for decision-makers

Many managing directors have heard about "warning level orange" in the news without knowing how to place it. Is it an alarm for everyone or a matter for the IT department? The short answer: orange is the level at which the BSI assumes that those affected risk serious disruption to their business unless they act quickly.

According to hessenschau, the BSI described PHP2Shell as having outstanding threat potential. It expected rapid, large-scale exploitation. Confirmed successful attacks on a broad scale were not known at the time of the warning, according to the BSI. Both belong together: the high level describes the risk, not damage that has already occurred.

## BSI warning level orange and the other three levels

The BSI classifies its cyber security warnings on a scale from 1 to 4. The following table gives the meaning in paraphrase:

| Level | Colour | Meaning (paraphrased) |
|---|---|---|
| 1 | Grey | IT threat situation without significant anomalies |
| 2 | Yellow | increased monitoring of anomalies, normal operations temporarily impaired |
| 3 | Orange | business-critical situation, massive impairment of normal operations |
| 4 | Red | extremely critical situation, normal operations can no longer be maintained in many areas |

The level says something about the overall situation, not about your individual server. A fully patched and checked web server is in a good position even at orange. An unpatched server with PHP 8.1 and mod_php is at risk even at a lower level.

### How to use the scale internally

Many companies have their own emergency levels, for example in the emergency manual or as part of an information security management system. It is worth assigning the BSI levels there permanently. A simple rule might read: at yellow, IT checks within normal operations. At orange, the management is informed the same day, a person in charge is named and the status of all affected systems is recorded in writing. At red, the crisis team convenes.

That turns a news item into a rehearsed response. Anyone who has defined the assignment beforehand does not have to debate in an emergency whether the situation is "serious enough". With PHP2Shell, this rule would have meant: on 21 October itself, an inventory, a patch plan and a decision on shutdowns.

The BSI publishes the warnings themselves on its website, where they are also updated when there are new findings. It is worth reading the current version each time, because recommendations and assessments can change over the course of a situation.

## Why PHP2Shell is orange and not red

Log4Shell is often used for comparison. For the vulnerability in the Java library Log4j, the BSI declared level red in December 2021, according to reports at the time among other things because the vulnerability was trivially exploitable and compromises were already known. In January 2022, according to the Bundestag, the warning was downgraded to yellow.

Only the BSI knows the exact reasoning for orange in the case of PHP2Shell. Visible differences are the situation regarding confirmed attacks and the fact that an update is available for all supported PHP branches. A detailed comparison is offered by the article [PHP2Shell and Log4Shell](https://phpsos.de/en/blog/php2shell-und-log4shell/). Orange is not an all-clear. The recommendation to take servers offline if necessary is a clear statement coming from an authority.

> **Important:**
> The warning level can change, in both directions. The current status on the BSI website is what counts, not a newspaper article from the day before.

## What orange does not mean

We currently encounter three misunderstandings frequently:

- **"Orange means we have been hacked."** No. The level describes the threat situation, not a finding on your systems.
- **"Orange only applies to authorities."** No. The warnings are addressed to all operators of affected systems, including small companies.
- **"If we have Cloudflare or a WAF, orange does not affect us."** No. Protective rules reduce the risk but do not replace the PHP update.

Whether the warning gives rise to legal obligations, for example under [NIS2](https://phpsos.de/en/compliance/nis2/), depends on your industry and size. This is not legal advice; clarify the details with your legal adviser or your data protection officer.

## Translating the rating into decisions

A warning level is only worth as much as the decisions that follow from it. For PHP2Shell, we recommend this order to companies:

1. **Clarify exposure:** Which servers and websites run PHP, and who operates them?
2. **Document the patch level:** fixed version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a backport confirmed by the vendor.
3. **Ensure the restart:** All PHP processes must have been restarted.
4. **If that is not possible immediately:** apply interim measures or take the server offline temporarily, as the BSI recommends. The options are described in [Immediate measures without a patch](https://phpsos.de/en/php2shell/sofortmassnahmen-ohne-patch/).
5. **Check for traces and preserve logs:** from 20 October onward.
6. **Document decisions:** who decided what and when, and on what basis.

The last point in particular is underestimated. Anyone who has acted in a traceable way in response to an official warning at level orange is in a better position with insurers, customers and supervisory bodies. Background is provided by the page on [management liability](https://phpsos.de/en/compliance/geschaeftsfuehrer-haftung/).

## How does PHP SOS help?

- **Situation for your company:** We translate the BSI rating into a prioritised list of your affected systems.
- **Implementing the recommendation:** We patch, restart or apply interim measures until the update is possible.
- **Proof:** You receive documentation of what happened on which server and when.
- **Monitoring:** If the BSI changes the rating or new announcements come in, we assess them for your systems.

More under [PHP2Shell immediate help](https://phpsos.de/en/leistungen/php2shell-soforthilfe/).

## Conclusion

Warning level orange is the BSI's second-highest level and is well founded for PHP2Shell. It does not call for panic, but it does call for a decision on the same day: patch, restart, check or shut down temporarily. Anyone who documents this has read the warning correctly.


## Frequently asked questions

**How many warning levels does the BSI have?**  
The BSI's cyber security warnings use four levels: 1 / grey, 2 / yellow, 3 / orange and 4 / red. Orange is the second-highest level and describes a business-critical IT threat situation with massive impairment of normal operations.

**Is warning level orange an obligation to act?**  
The warning itself is a technical assessment with recommendations for action. What obligations arise from it for your company, for example under NIS2, contracts or insurance terms, depends on the individual case. Clarify this with your legal adviser; this is not legal advice.

**Why is PHP2Shell not level red?**  
The BSI itself determines the reasons for a rating. One notable difference from Log4Shell, which received red in 2021: according to reports at the time, compromises were already known there. With PHP2Shell, confirmed successful attacks on a broad scale were initially not known, according to the BSI.

**Can the warning level change?**  
Yes. The BSI adjusts ratings to the situation, upward as well as downward. Log4Shell, for example, was downgraded from red to yellow in January 2022, according to the Bundestag. Check the current status directly with the BSI.

## Sources

- [BSI: German Federal Office for Information Security](https://www.bsi.bund.de/)
- [hessenschau: Numerous authority websites in Hesse taken offline](https://www.hessenschau.de/panorama/sicherheitsluecke-zahlreiche-behoerden-webseiten-in-hessen-abgeschaltet-v2,sicherheitsprobleme-hacker-webseiten-100.html)
- [php.net: security announcements](https://www.php.net/)