PHP2Shell incident in Germany:
which costs your company can claim for tax purposes.

Your German company runs a website or online shop on PHP, and head office has just released an emergency budget. The next question follows soon enough: who bears the costs, what will the German tax office accept, and what needs to be considered if group IT steps in itself? We handle the case-by-case tax review together with our partner tax firm TABAK Steuerberatung.

The background in two sentences

On 21 October 2026, Germany's Federal Office for Information Security (BSI) warned of two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”. According to the warning, attackers could execute malicious code on web servers remotely, without logging in and without any user interaction. The BSI is not yet aware of any confirmed exploitation; security firms are reporting the first attack attempts. What needs to be done technically is explained by DAVINCI in the article PHP2Shell: what you need to do today (in German).

Ground rule: the German GmbH bears its own costs

A GmbH is a separate legal entity and, for the tax office, a taxpayer in its own right, even if it is 100 per cent owned by your parent company. It is treated as a commercial company and keeps its books under German commercial law. It therefore always determines its profit through the balance sheet, never through a simple cash-basis income statement.

For corporation tax, the rules of the Income Tax Act apply (§ 8 Abs. 1 KStG, German Corporation Tax Act). Under these, business expenses are all expenditure incurred for business purposes (§ 4 Abs. 4 EStG, German Income Tax Act). Fending off and remedying an attack falls within this, typically:

• the emergency update by the hosting provider or IT service provider,
• the forensic investigation into whether attackers got in,
• clean-up, restoration and new passwords and access keys,
• the assessment of whether a reportable data protection incident has occurred.

In the balance sheet, an expense counts in the financial year to which it relates, not on the day of payment (§ 252 Abs. 1 Nr. 5 HGB, German Commercial Code). An invoice for work carried out in October 2026 that only arrives in January therefore belongs in the 2026 financial statements.

The GmbH can reclaim the VAT on invoices from German service providers from the tax office as input tax (§ 15 Abs. 1 UStG, German VAT Act). To do so, it needs a proper invoice stating the type and scope of the service and the date of supply (§ 14 Abs. 4 UStG).

“In an emergency, group IT, the hosting provider and an external forensic specialist are often working on the same server at the same time. From day one, we record who did what and when. That log is needed later by the insurer, by the accounting team and, if group services are recharged, by the tax auditors as well.”

Metehan Kurt, IT consultant · DAVINCI Rechenzentrum

Repair, rebuild, new equipment

For tax purposes, what matters is not the size of the invoice but what the money is spent on. If the existing website is merely cleaned up and returned to its previous state, nothing new is created. Under § 255 Abs. 2 HGB, production costs require something to be produced, extended or substantially improved. The repair is a current expense.

Three points deserve a second look. First: software and websites are intangible assets. For tax purposes, they are only capitalised if they were acquired for consideration (§ 5 Abs. 2 EStG). Check before signing whether an agency contract covers a service or an acquisition. Second: the Federal Ministry of Finance (BMF) circular on the one-year useful life mentions ERP and inventory management software, but neither websites nor web shops. Whether it applies to purchased shop software is not expressly settled. Third: declining-balance depreciation applies only to movable assets, i.e. physical items, not to software (R 7.1 Abs. 2 EStR). How it works is explained in our article on the investment booster. If the old website was capitalised and is abandoned, an extraordinary write-down of the remaining book value may be possible (§ 7 Abs. 1 Satz 7 EStG).

When the parent company helps

Group IT often handles the emergency itself and later recharges the costs to the German subsidiary. That is permissible, but for the tax office it is a transaction between related parties. The arm's length principle applies (§ 1 Abs. 1 AStG, German Foreign Tax Act): the GmbH may not pay more than it would have paid independent third parties under comparable conditions. Otherwise, the tax office can adjust its income.

“The services must actually have been rendered and needed. The mere offer within a multinational group of companies is not sufficient.” (translation)

Federal Ministry of Finance, Administrative Principles on Transfer Pricing 2024, Rn. 3.67

Three practical rules follow from the administrative principles:

• Evidence: What group IT actually did for the German company must be documented. For services, the tax authorities generally expect the cost plus method, i.e. costs plus a mark-up (Rn. 3.72, margin number).
• Cost allocation: If costs can only be attributed directly with disproportionate effort, a group cost allocation using an appropriate key is possible, for example based on the number of computer workstations (Rn. 3.78).
• Limit: Costs arising from the shareholder role, such as for managing and monitoring the investment, cannot be recharged (Rn. 3.69).

Which records the GmbH must keep for this is described in our article on Transfer pricing documentation. We clarify the view from your parent company's home country through partner firms in more than 20 countries.

Invoices from abroad: the GmbH owes the VAT

If the parent company or a foreign forensic service provider without a German establishment invoices the work, the invoice usually shows no German VAT. That does not mean none is due. A service supplied to a business is deemed to be performed where the recipient runs its business (§ 3a Abs. 2 UStG), in this case Germany. The GmbH, as the recipient, then owes the tax (§ 13b Abs. 5 UStG), known as the reverse charge. For suppliers from another EU member state, § 13b Abs. 1 applies; for suppliers outside the EU, § 13b Abs. 2 Nr. 1 UStG. The GmbH reports the tax in its advance VAT return and can, as a rule, deduct it as input tax at the same time (§ 15 Abs. 1 Satz 1 Nr. 4 UStG). This usually costs nothing, but it must be declared.

Insurance and data protection

If a cyber insurance policy pays for the GmbH's forensics or restoration, that is business income: this covers all business-related inflows in money or money's worth (H 4.7 EStH). In the balance sheet, a gain only counts once it has been realised at the reporting date (§ 252 Abs. 1 Nr. 4 HGB). Whether an outstanding claim already belongs in the 2026 financial statements depends on how far the claim has been settled.

If personal data has been exfiltrated, two kinds of payment must be kept strictly apart. A fine from the data protection supervisory authority (Art. 83 GDPR) does not reduce taxable profit:

“Fines, administrative penalties and warning fines imposed by a court or an authority within the territorial scope of this Act, or by a Member State or by institutions of the European Union, as well as related expenses.” (translation)

§ 4 Abs. 5 Satz 1 Nr. 8 Satz 1 EStG

Damages paid to affected individuals under Art. 82 GDPR, by contrast, are not a fine. They are, in principle, a deductible business expense. For claims that have been asserted but remain uncertain, the GmbH sets up a provision (§ 249 Abs. 1 HGB).

“For the tax office, the German GmbH remains a taxpayer in its own right, even in an emergency. It is right for head office to help. But it should invoice the way an outside service provider would: with an agreement, evidence and a transparent price.”

Fatma Tabak, tax advisor · TABAK Steuerberatung

What management should initiate now

The cost centre will then also appear in the monthly report to head office. Whether the accounting data itself is affected is covered in PHP2Shell and your German subsidiary's accounting. Questions about invoices and VAT in an online shop are answered in Selling online in Germany after PHP2Shell.

We advise you in English — directly, without intermediaries.

Frequently Asked Questions

Sources

• BSI cybersecurity warning of 21.10.2026 on CVE-2026-109618 and CVE-2026-109619
• § 4 EStG – Business expenses, non-deductibility of fines
• § 5 EStG – Profit of merchants, intangible assets
• § 7 EStG – depreciation for wear and tear
• BMF circular of 22.02.2022 – Useful life of computer hardware and software (Official EStH 2025)
• § 1 AStG – Adjustment of income (arm's length principle)
• BMF circular of 12.12.2024 – Administrative Principles on Transfer Pricing 2024 (copy: IHK München)
• § 13b UStG – Recipient of the supply as the person liable for tax
• § 15 UStG – Input tax deduction
• Regulation (EU) 2016/679 (GDPR), Art. 82 and 83