Do you manufacture goods abroad and sell them to customers in Germany through your own online shop? Then your shop very probably runs on PHP, for example with WooCommerce, Shopware or Magento. Since 21.10.2026, Germany's Federal Office for Information Security (BSI) has been warning of two critical vulnerabilities in PHP, known as “PHP2Shell”. What does this mean for your VAT, your invoices and your customer data?
What is known about PHP2Shell
According to the BSI's assessment, attackers could execute malicious code remotely on web servers running PHP applications, without logging in and without any user interaction. The flaw lies in PHP itself, i.e. in the foundation the shop is built on. Clean shop code offers no protection; only the PHP update helps. As of today, the BSI reports no confirmed exploitation. Security firms, however, are reporting the first attack attempts.
Anyone who can execute code on the server can read and alter orders, tax settings, invoice templates and customer data. The technical check is explained by DAVINCI in the article Checking WordPress, TYPO3 or Magento after PHP2Shell (in German). This article covers the tax and legal consequences.
Your route into the German market determines who has to act
Umsatzsteuer is Germany's VAT, administered by a Finanzamt (local tax office). Which one, and who has to act, depends on your structure:
| Structure | Competent tax office | Who has to act |
|---|---|---|
| German sales GmbH operates the shop | The tax office for the district from which the GmbH runs its business (§ 21 Abs. 1 Satz 1 AO) | The GmbH's management, even if they live abroad |
| Foreign company sells directly, with a German VAT registration | One central tax office per country of origin, e.g. Bonn-Innenstadt for the USA, Dortmund-Unna for Türkiye; for countries not listed, such as China, Berlin International (§ 1 UStZustV) | Management of the foreign company |
The rules on invoices and records discussed here apply in both cases. Which structure suits your sales operation is described in the article Produce Abroad, Sell in Germany.
Invoices: origin and content must be right
A shop generates invoices automatically from templates, tax rates and number ranges. After an attack, this requirement becomes decisive:
“The authenticity of the origin of the invoice, the integrity of its content and its legibility must be ensured. … Integrity of content means that the particulars required under this Act have not been altered.” (translation)
§ 14 Abs. 3 Satz 1 and 3 UStG (German VAT Act)
For this, the Act refers to internal control procedures that create a reliable audit trail between invoice and supply. In practice, this means that invoice, payment and dispatch of goods must match. An incorrect invoice is corrected with a document that refers unambiguously to the original invoice (§ 31 Abs. 5 UStDV).
If the tax rate was altered
If an invoice shows too much VAT, you generally owe the excess amount as well (§ 14c Abs. 1 UStG). For private customers, the tax authorities make an exception if the supply was actually made (Abschnitt 14c.1 Abs. 1a of the Umsatzsteuer-Anwendungserlass, the German VAT Application Decree). You must, however, credibly demonstrate which invoices went to private customers; an estimate is not accepted. Without complete order data, that becomes difficult. If the tax rate is too low, the statutory tax is calculated out of the price received (§ 10 Abs. 1 Satz 2 UStG). You bear the difference.
“With foreign retailers, the shop is often hosted by a provider in Germany, the orders flow into the parent company's ERP and the payments go through a third-party provider. After an incident, this distribution is an advantage: we reconcile the three data sets and see exactly where the shop no longer matches reality.”
Metehan Kurt, IT consultant · DAVINCI Rechenzentrum
Fake invoices in your name
Stolen customer data and templates can be used to send deceptively genuine invoices. Anyone who shows VAT on an invoice without being entitled to do so owes that amount (§ 14c Abs. 2 UStG). For forgeries, however, the tax authorities draw a line: if the company named as the issuer was not involved in any way, it will not be held liable (Abschnitt 14c.2 Abs. 4 Satz 4 UStAE). The rules on agency must still be taken into account, including apparent authority and authority by acquiescence. A company that tolerates others acting in its name, or could have prevented it by exercising due care, may in certain circumstances have that conduct attributed to it.
Document, therefore, when you learned of the forgeries and what you did about them: customer warnings, a criminal complaint, blocking of access. If the attacker generates invoices using your own shop system, attribution is a matter of the individual case and the technical logs.
Evidencing sales when shop data is missing
For VAT purposes, your records must show the consideration received, broken down by tax rate (§ 22 Abs. 2 Nr. 1 UStG). If orders have been deleted or altered, data from outside the shop helps:
- Payment service providers: payments, refunds and fees per transaction, but without items or tax rate.
- Marketplaces: sales and refunds per order, but only for sales made through the marketplace.
- Parent company's ERP or warehouse system: goods dispatched and delivery addresses, if orders are transferred there.
- Backup from before the attack: complete orders up to the time of the backup.
What gaps mean for your German company's accounting is explained in the article PHP2Shell and your German subsidiary's accounting.
“For the tax office, what counts is the voucher, not the assumption. That is why we first secure the statements from payment service providers and marketplaces. From these, we rebuild sales by tax rate before correcting an advance VAT return or an OSS return.”
Fatma Tabak, tax advisor · TABAK Steuerberatung
One-Stop-Shop: your data also goes to other EU member states
Many retailers also deliver from Germany to private customers in other EU member states. They report the VAT on these sales centrally through the One-Stop-Shop (OSS) at the Federal Central Tax Office (BZSt) (§ 18j UStG); for consignments from non-EU countries up to 150 euros, there is a similar procedure (§ 18k UStG). The records must then be kept for ten years and made available electronically on request, including to the authorities of the other EU member states (§ 22 Abs. 1 Satz 4 UStG). Missing data is therefore not a purely German matter. Anyone who repeatedly fails to meet their record-keeping obligations is excluded from the scheme (§ 18j Abs. 6 UStG). Errors are corrected within three years in a subsequent return (§ 18j Abs. 4 Satz 5 UStG).
If you refund customers because an order was cancelled, not delivered or returned, the VAT is adjusted (§ 17 Abs. 1 and 2 UStG). Match every refund to the original order.
Customer data: check notification within 72 hours
The EU General Data Protection Regulation (GDPR) requires a personal data breach to be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the individuals concerned (Art. 33 Abs. 1 GDPR). Where the risk is high, customers must also be notified (Art. 34 Abs. 1 GDPR). Every incident must be documented (Art. 33 Abs. 5 GDPR). With PHP2Shell, this assessment must be taken seriously: according to security researchers, one of the vulnerabilities can additionally expose memory contents such as passwords and access keys.
Which authority is competent depends on where you are established. In Germany, each federal state has its own supervisory authority for businesses (§ 40 Abs. 1 BDSG, Federal Data Protection Act); for a sales GmbH in Mannheim, it is the State Commissioner for Data Protection of Baden-Württemberg. Without an establishment in the EU, the GDPR still applies if you offer goods to customers in the EU (Art. 3 Abs. 2 GDPR). You must then designate in writing a representative in the Union who acts as a point of contact for authorities and customers (Art. 27 GDPR). On transferring customer data to the parent company, read Data between China and Germany. The legal assessment of the individual case is a matter for your data protection officer or a lawyer.
What your management should initiate now
- Get the update confirmed: If a hosting provider runs your server, it must update PHP. Updating the shop alone is not enough.
- Secure the current state: Have tax settings, invoice templates and bank details in the shop compared against a backup from before the possible attack.
- Secure statements: Download exports from payment service providers and marketplaces.
- Check data protection: The 72-hour deadline starts as soon as you become aware of the data breach.
- Clarify tax consequences: Agree invoice corrections, advance VAT returns and OSS returns with your tax advisor.
We combine these steps into a single process: IT review, accounting and, together with our partner tax firm TABAK Steuerberatung, the tax assessment. We advise you in English — directly, without intermediaries.
Frequently Asked Questions
We sell from abroad through a German shop. Does PHP2Shell affect us for tax purposes?
Yes, if your shop runs on PHP. An attacker could alter invoices, tax rates and orders. You remain responsible for your German VAT obligations, whether through a German GmbH or with your own registration at the competent tax office.
Do we have to pay VAT on fake invoices sent in our name after PHP2Shell?
If you were not involved in creating them in any way, the tax authorities will not hold you liable (Abschnitt 14c.2 Abs. 4 UStAE). The rules on apparent authority and authority by acquiescence still apply, however. Document when you learned of it and what you did about it.
Order data is missing after PHP2Shell. What does this mean for the One-Stop-Shop?
OSS records must be kept for ten years and made available electronically on request, including to authorities in other EU member states (§ 22 Abs. 1 Satz 4 UStG). Reconstruct sales from payment and marketplace statements and correct returns within three years.
We have no establishment in the EU. To whom do we report a PHP2Shell data breach?
The GDPR also applies to you if you offer goods to customers in the EU. You must have designated a representative in the Union who acts as the point of contact for the supervisory authorities (Art. 27 GDPR). Clarify with them and your data protection advisor which authority the notification goes to.
Sources
- BSI: Cybersecurity warning PHP – critical vulnerabilities threaten web applications worldwide (21.10.2026)
- php.net: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- § 14 UStG – Issuing invoices
- § 14c UStG – Incorrect or unauthorised statement of tax
- BMF: Umsatzsteuer-Anwendungserlass (VAT Application Decree, as of 2 June 2026), Abschnitte 14c.1 and 14c.2
- § 22 UStG – Record-keeping obligations
- § 1 Umsatzsteuerzuständigkeitsverordnung (UStZustV, VAT Jurisdiction Ordinance)
- BZSt: One-Stop-Shop, EU scheme
- Regulation (EU) 2016/679 (GDPR), Art. 3, 27, 33 and 34
- § 40 BDSG – Supervisory authorities of the federal states
Shop affected, or not sure?
We review your shop, invoices and sales data with you and agree the corrections with our partner tax firm TABAK Steuerberatung, including with your group IT abroad.