PHP Vulnerability Alarm in Turkey and Preventive Measures
The Presidency's Cyber Security Directorate has launched nationwide scans against PHP2Shell vulnerabilities detected in the PHP software infrastructure.
The Presidency's Cyber Security Directorate has launched nationwide preventive security measures against critical vulnerabilities detected in the PHP software infrastructure, which is widely used in websites and corporate applications. The vulnerabilities, named 'PHP2Shell' and tracked under the codes CVE-2026-109618 and CVE-2026-109619, are assessed as potentially allowing attackers to execute remote code.
According to the statement made by the Directorate, security scans have been activated in IT systems throughout the country, primarily in public institutions. High-risk vulnerabilities in PHP, used in the backend of websites and online applications, pose dangers such as unauthorized access, data security breaches, and disruptions in the continuity of digital services.
The Cyber Security Directorate sent an urgent security notice to all institutions, organizations, and critical infrastructure operators via the SOME Communication Platform. System administrators were asked to check their internet-facing IT infrastructures, apply security updates without delay, and restrict external access to management interfaces and critical PHP services.