In short: IT security is among the tasks of senior management. Managing director liability for IT security gaps is discussed mainly when known risks were not handled appropriately, responsibilities were not settled or decisions were not made in a traceable way. In situations like PHP2Shell, a clear, documented decision based on the available facts helps. This page is general information and not legal advice.
Not legal advice: liability questions depend heavily on the individual case, the legal form and contractual arrangements. Have specific questions assessed by a lawyer specializing in company law.
Managing director liability and IT security: the general framework
For managing directors of a GmbH (German limited liability company), § 43 GmbHG (German law on limited liability companies) requires the diligence of a prudent businessperson. For members of the management board of a stock corporation, § 93 AktG (German Stock Corporation Act) contains a comparable rule; § 91(2) AktG also requires suitable measures to detect developments that threaten the company's existence at an early stage. In the specialist discussion, it is derived from these general duties that IT risks must also be managed appropriately.
For entrepreneurial decisions there is a margin of judgment. Anyone who decides on the basis of adequate information and for the benefit of the company is, under the so-called business judgment rule, generally acting in accordance with their duties, even if the decision later turns out to be unfavorable. A practical lesson follows: often what matters less is the outcome than whether the decision was made in an informed and traceable way.
What NIS2 adds
For companies that fall under NIS2, the responsibility of management is expressly regulated. Senior management must approve the risk management measures, oversee their implementation and undergo training in cybersecurity. In Germany, this is implemented by the NIS2UmsuCG (NIS2 Implementation and Cybersecurity Strengthening Act, a German law). Whether your company is affected and which obligations apply in detail, you can find in the BSI's information. A general overview is given in NIS2 and web server security.
Obligations from data protection are added to this. Under the GDPR, a company must take suitable technical and organizational measures and assess, document and, where applicable, report personal data breaches under Art. 33.
What a situation like PHP2Shell demands of management
PHP2Shell covers two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2). The BSI (German Federal Office for Information Security) has declared warning level 3 (orange) and recommends an immediate update and, if that is not possible, taking the web servers off the network temporarily. This creates a typical trade-off for management: revenue and availability against a high, publicly known risk.
Nobody demands that managing directors patch servers themselves. But it can be expected that they take note of the situation, clarify responsibilities, have themselves briefed and make a decision. Questions management should ask itself:
- Which of our systems use PHP, and who is responsible for them, internally or at the service provider?
- Have the updates been applied and the processes restarted, and is there evidence for it?
- If not: why not, which interim measures are running, and are we taking the system offline?
- Are there indications of a break-in, and who assesses possible reporting obligations?
Documenting decisions
Record the situation picture, options, decision and reasoning briefly in writing, with date and time. Such a record does not have to be long. It shows later that management was informed and weighed the options. This expressly also applies to the decision to keep operating a system for a limited time despite the risk.
| Content | Example |
|---|---|
| Situation picture | BSI warning level 3, patches available since 21 October 2026 |
| Affected systems | Shop, customer portal, internal wiki installation |
| Options | patch immediately, interim measures, take offline |
| Decision | Shop patched, wiki offline until the update |
| Reasoning and responsible persons | Evidence by service provider, verification by head of IT |
A patch does not remove malware that has already been planted. The decision on whether to search for traces also belongs in the record.
Organizing for the long term instead of improvising in an emergency
The best precaution is a clear organization: a named person responsible for information security, a procedure for security updates, regular reports to management, a tested IT emergency plan and an independent review at sensible intervals. The BSI's IT-Grundschutz is suitable as a methodological framework.
Part of the organization is also designing reports so that management understands them. A short, regular report with a few key figures is often enough: how many systems are up to date, where are there exceptions and why, which incidents or near-incidents occurred, which decisions are pending. Whoever receives such reports, asks follow-up questions and records the results can later show that oversight actually took place. This applies regardless of whether the technology is in-house or at a service provider.
How does PHP SOS help?
- We prepare an understandable situation picture of your web servers for senior management, with clear options.
- We implement the chosen option and provide written technical evidence.
- Through a security audit or penetration test, we create an independent basis for your decisions.
- With a security maintenance contract, we settle updates and reports on a permanent basis.
Frequently asked questions
Is a managing director personally liable for a hacker attack?
An attack alone does not establish personal liability. Liability is discussed mainly when duties of care were breached, for example when known risks were ignored or responsibilities were not settled. Whether that is the case in an individual instance can only be assessed by legal advice.
Can I hand IT security over completely to IT or a service provider?
Tasks can be delegated, but responsibility for selection, resources and oversight stays with management. Have yourself briefed regularly and record which decisions were made on what basis.
What does NIS2 change about the responsibility of senior management?
NIS2 requires the management of affected companies to approve risk management measures, oversee their implementation and attend training. Details come from the German implementing act and the BSI's information.
Does D&O insurance help?
Directors and officers liability insurance can cover certain liability risks of management, but the terms differ greatly. Clarify the scope with your broker or insurer.