PHP2Shell Vulnerability Detected in PHP Triggers Global Alarm
While two critical vulnerabilities discovered in PHP software have increased precautions worldwide, it was reported that e-Government controls have been completed in Turkey.
Two critical vulnerabilities discovered in the PHP software infrastructure, referred to as PHP2Shell, have led to widespread security measures internationally.
The two critical vulnerabilities detected in PHP, tracked under the codes CVE-2026-109618 and CVE-2026-109619, can allow attackers to execute code on servers without requiring authentication under certain conditions. Following these vulnerabilities, which scored 9.2 out of 10 in the CVSS v4.0 evaluation, the PHP development team released PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21.
Following these developments, some public websites in countries such as the Netherlands, Finland, France, Germany, and Belgium were temporarily closed to access as a precaution. In Turkey, while the Presidency's Directorate of Cybersecurity announced that preventive efforts have been initiated at the national level, it was reported that security checks on the e-Government Gateway have been completed and services continue uninterrupted.
Sources
- milliyet.com.tr · Link