22.10.2026 11:50
Following the detection of two critical security vulnerabilities in the PHP infrastructure used worldwide, preventive efforts have been initiated in Turkey. The Cybersecurity Presidency stated that nationwide scanning and security measures against possible attacks are ongoing, and made the statement "There is no disruption in public services." Institutions were called upon to apply security updates without delay.
Preventive efforts initiated in Türkiye over critical security vulnerabilities that have emerged in the PHP software used in the infrastructure of millions of websites worldwide are continuing. The Presidential Cybersecurity Directorate announced that necessary measures against the risks have been taken and that work is ongoing. As a nationwide scan was launched due to the possibility of remote attacks, it came to the agenda that Amazon and Cloudflare also detected attack attempts.
NEW STATEMENT FROM THE CYBERSECURITY DIRECTORATE
The Presidential Cybersecurity Directorate, regarding the security vulnerabilities identified in the PHP infrastructure used worldwide, stated that preventive efforts are continuing and made the statement 'There is no disruption in public services.'
The Directorate's statement came after critical security warnings that came to the agenda in the morning hours. Within the scope of efforts carried out to protect the systems of public institutions and relevant organizations in Türkiye, identifying potentially risky infrastructures and applying necessary security updates are important.
EMERGENCY SCAN LAUNCHED ACROSS TÜRKİYE
The Cybersecurity Directorate launched a national scanning process against the vulnerabilities identified in the PHP infrastructure that carry serious security risks.
An urgent security notice was published through the Computer Emergency Response Teams (SOME), and relevant institutions were asked to check the PHP versions they use and to apply security measures without delay.
The purpose of the scanning efforts is to prevent possible cyberattacks by identifying in advance the systems that attackers could exploit.
TWO CRITICAL SECURITY VULNERABILITIES DETECTED
Two critical security vulnerabilities called 'PHP2Shell' have been discovered in the PHP software used worldwide for developing websites and enterprise applications.
Each of the vulnerabilities tracked under the codes CVE-2026-109618 and CVE-2026-109619 received a score of 9.2 out of 10 on CVSS, the international security rating system.
This level shows that the vulnerabilities are of a nature that could have extremely serious consequences. According to security experts, under certain conditions these weaknesses can allow attackers to run malicious code remotely without needing a username or password.
THEY CAN INTERVENE IN THE SYSTEM WITHOUT KNOWING A PASSWORD
The most important feature that makes the PHP2Shell vulnerabilities dangerous is that, in some systems, the attack can be carried out without passing the authentication stage.
Under normal conditions, authorized access is required to intervene in a server, while attackers exploiting these security vulnerabilities can run code on vulnerable servers through specially crafted internet requests.
A successful attack could cause sensitive information in the system to be exposed, unauthorized actions to be performed on the server, or internet services to be disrupted.
Moreover, because the vulnerability is located directly in the core components of the PHP software, it concerns not only a specific website but also different applications using the vulnerable PHP version.
USERS OF WORDPRESS, DRUPAL AND JOOMLA ARE ALSO AT RISK
The security warnings also drew attention to common content management systems such as WordPress, Drupal and Joomla that use PHP infrastructure.
Researchers carried out technical studies showing that the security vulnerabilities can be exploited in applications using PHP.
However, this does not mean that all websites using these platforms have been compromised. The risk varies depending on the PHP version running on the server, the configuration, and whether security updates have been applied.
Experts note that updating only the website's plugins or content management system may not be sufficient, and that the PHP software on the server must also be upgraded to a secure version.
ATTACK ACTIVITY ON THE AMAZON AND CLOUDFLARE SIDE
With the announcement of the security vulnerabilities, possible attack attempts worldwide also came to the agenda.
According to information reported in the morning hours, it was stated that Amazon recorded attack attempts on October 17, and that Cloudflare also detected attack traffic linked to the PHP vulnerabilities.
However, seeing attack attempts does not mean that these companies' systems have been compromised. There is no verified information indicating that a successful breach occurred as a result of these attempts.
Security researchers, meanwhile, point out that the fact that attack methods for the two critical vulnerabilities have been technically demonstrated makes it even more important to update vulnerable systems quickly.
CRITICAL SECURITY UPDATES RELEASED
PHP developers made new versions available on October 21 that close the two critical security vulnerabilities.
The versions in which the security vulnerabilities were fixed were announced as PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12.
In PHP's official security notice, it was emphasized that PHP systems accessible over the internet must be updated.
It was stated that the risk is especially higher in Apache mod_php infrastructure, while systems using PHP-FPM, php-cgi, FrankenPHP and LiteSpeed may also be affected by the vulnerabilities.
Because the official support period for PHP 8.1 and older versions has ended, systems using these versions need to be migrated to supported current versions.
URGENT CALL TO PUBLIC INSTITUTIONS AND THE PRIVATE SECTOR
The Cybersecurity Directorate sent urgent notifications to public institutions, critical infrastructure operators and private sector organizations to reduce risks.
Institutions were asked to check their internet-facing systems, apply security updates and limit unnecessary external access.
In particular, it is important to limit access to management panels and critical services only to authorized users and systems, review firewall rules and, where necessary, put additional protection measures in place.
The Directorate reported that work continues in coordination with relevant institutions to ensure the security of Türkiye's digital infrastructures and the uninterrupted continuation of critical services.
ARE CITIZENS' DATA AT RISK?
The PHP2Shell vulnerabilities directly concern the server infrastructures of websites and applications.
Therefore, the first parties concerned by the risk are institutions, companies and website administrators that operate systems using PHP. However, as a result of a successful cyberattack, the security of user information stored in these systems may also be endangered.
However, the detection of the vulnerability does not mean that citizens' personal information has been stolen or that public systems in Türkiye have been breached.
Until now, in the statement by the Cybersecurity Presidency, no information has been shared indicating that a data breach has occurred across Türkiye or that public systems have been compromised.
PREVENTIVE EFFORTS CONTINUE IN TÜRKİYE
With the latest statement by the Cybersecurity Presidency, it was once again emphasized that national scanning and coordination efforts carried out against critical security vulnerabilities in Türkiye are continuing.
Authorities aim to detect early the risks that security vulnerabilities may pose, limit the effects of possible attacks, and preserve the continuity of critical digital services.
Institutions and organizations implementing security updates without delay is cited as one of the most important measures against possible cyber attacks.
.