Türkiye has activated nationwide safeguards after critical vulnerabilities were disclosed in PHP, the programming language that underpins a large share of web infrastructure. In its TR-26-1372 bulletin dated October 21, the Turkish Cybersecurity Presidency warned that CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” could allow unauthenticated remote code execution. The authority called on public bodies, critical-infrastructure operators and private companies to identify affected PHP systems and move to secure releases without delay.
PHP is a server-side component that generates dynamic content for many websites and enterprise applications. The issue is therefore not limited to a particular website plugin. It has to be assessed across software and services that depend on the PHP runtime itself. Because the flaws concern such a broad ecosystem, an accurate asset inventory and verification of installed versions are the first steps in an effective response.
According to the official bulletin, successful exploitation could let an attacker access system resources within the permissions granted to the vulnerable application. That creates risks for the confidentiality and integrity of application data as well as the continuity of digital services. The Presidency also told organisations to restrict external access to administration interfaces and critical PHP services through firewall or access-control rules limited to trusted IP addresses. Systems that do not require access from abroad should be closed to international traffic.
TRT Haber reported that national network scanning and technical monitoring were launched under the Presidency’s coordination, with Computer Emergency Response Teams maintaining round-the-clock cooperation. The same account said technical checks found no issue affecting the security or continuity of services on the e-Government Gateway, which serves more than 69 million users. That finding does not remove the broader risk: institutions are still being urged to locate outdated PHP components and complete required updates promptly.
International technical assessments confirm the severity. CERT-EU assigned both vulnerabilities a score of 9.2 out of 10 and said PHP installations serving web requests may be exposed. CVE-2026-109618 concerns memory corruption during out-of-memory handling, while CVE-2026-109619 involves stale global state surviving one request and being reused by a later request. The advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the affected ways of running PHP.
The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix the two flaws. CERT-EU noted that PHP 8.1 and older branches no longer receive routine upstream updates, so operators using them must check whether their distribution or long-term-support vendor provides backported patches. If an internet-facing asset cannot be patched immediately, CERT-EU recommends isolating it from public networks until the update has been installed and verified. Temporary configuration changes can reduce exposure to particular attack paths, but the advisory says only an update fully addresses the vulnerabilities.
A CERT-EU update on October 23 also flagged a third remote-code-execution risk, CVE-2026-115560, affecting web applications configured in an unusual way. PHP does not plan an out-of-band release for that issue. Until the next regular release, organisations are advised to disable session upload progress and restart all workers. This newly disclosed issue is separate from the two critical vulnerabilities covered by Türkiye’s initial bulletin and should be handled as an additional mitigation item.
Cybersecurity professionals interviewed by Reuters agreed that artificial-intelligence tools are shortening the time needed both to discover vulnerabilities and to weaponise public technical information. After the PHP disclosures, some government websites around the world were temporarily taken offline while administrators patched their systems. For organisations in Türkiye, the immediate priorities are to complete an inventory of internet-facing PHP assets, deploy secure releases or vendor patches, restart services, and verify both versions and configurations afterward. This is primarily an infrastructure and hosting-provider response rather than an action individual citizens can perform on their own.
