22.10.2026 10:31
A cyberattack alarm continues following two critical PHP security vulnerabilities threatening millions of websites worldwide. While a national security scan has been launched in Turkey, it has been reported that attackers are developing new methods to bypass security measures. Due to the risk of remote access to systems without a password, an urgent update call was made to institutions. A warning was issued that websites that are not updated may remain vulnerable to attacks.
New developments have occurred regarding two critical security vulnerabilities in the PHP software infrastructure that threaten millions of websites worldwide. After Turkey's Presidential Cybersecurity Directorate launched a national security scan, international technology companies announced that attack attempts targeting the vulnerabilities had been detected. Data shared by Amazon revealed that the attacks began four days before the vulnerabilities were disclosed to the public.
AMAZON DETECTED THAT THE ATTACKS BEGAN ON OCTOBER 17
Amazon's cyber threat intelligence team announced that the first attack attempt targeting the critical security vulnerabilities in the PHP infrastructure was recorded on October 17. The attempt, detected by the company's cyber threat monitoring system called MadPot, was determined to have been carried out through a commercial network intended for anonymization.
While the details of the security vulnerabilities were disclosed to the public on October 21, it has not yet become clear how the attackers obtained this information four days earlier.
ATTACK ATTEMPTS INCREASED AFTER WARNINGS
According to Amazon's statement, new attack attempts were recorded via different IP addresses on October 21. The fact that the methods and connection infrastructures used in the attacks were different from one another indicated that multiple attacker groups may have taken action.
It was stated that attack attempts continued after security updates were released. Amazon reported that the vulnerabilities are now widely used in real attack attempts on the internet.
CLOUDFLARE ALSO CONFIRMED ATTACK TRAFFIC
Internet security company Cloudflare also announced that it had detected attack traffic targeting the PHP security vulnerabilities.
The company stated that attackers were trying to change the methods they use to bypass firewalls. Cloudflare reported that it had put the protection measures it developed into effect before the official disclosure of the vulnerabilities and that it was monitoring attack attempts against its customers.
RISK OF ACCESSING SYSTEMS WITHOUT A PASSWORD
It was stated that the two security vulnerabilities tracked under the codes CVE-2026-109618 and CVE-2026-109619 may allow attackers to execute code remotely on vulnerable servers without the need for a username or password.
While the risk level of both vulnerabilities was assessed as 9.2 out of 10, it was noted that websites using PHP-based systems such as WordPress, Drupal, and Joomla could also be affected.
CYBERSECURITY ALARM IN TURKEY
Within the scope of the national security scan launched by Turkey's Presidential Cybersecurity Directorate, institutions were asked to check their systems and take the necessary measures.
International security organizations also emphasized that PHP servers accessible over the internet should be updated as a priority. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which close the security vulnerabilities, have been released.
IT HAS NOT YET BEEN CONFIRMED THAT SYSTEMS WERE COMPROMISED
Although cybersecurity companies confirm that attack attempts have begun, it has not yet been determined which institutions' systems these attempts succeeded in compromising.
Experts draw attention to the need not to delay security updates and to examine server logs for suspicious activity starting from October 17.