Two critical flaws in the PHP core allow unauthenticated remote code execution. Turkey's Cyber Security Presidency issued a nationwide alert on 22 October.
The PHP development team shipped emergency releases on 21 October 2026, closing two critical flaws in the language core. Nicknamed PHP2Shell by researchers, CVE-2026-109618 and CVE-2026-109619 both carry a CVSS score of 9.2 according to CERT-EU, and both allow unauthenticated remote code execution.
What happened
Both issues sit in how PHP manages memory across the request lifecycle. Per CERT-EU's advisory, CVE-2026-109618 allows uninitialised memory to be freed when a request is aborted after hitting the memory limit, and that memory may hold attacker-controlled data. CVE-2026-109619 lets request-owned internal state survive after its memory has been released following a fatal error, so a later request handled by the same worker can pick up that stale state.
The detail that matters most: the attack fires before any of your application code runs. How well your site is written, which CMS or framework sits on top, none of it changes the exposure. CERT-EU states that every PHP installation serving web requests is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with the PHP team flagging mod_php as the highest-risk configuration.
Why it matters
The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are end-of-life and received only minimal source backports. Help Net Security reports that Amazon's MadPot honeypot network logged an exploitation attempt on 17 October 2026, four days before public disclosure, meaning at least one threat actor held working details ahead of the announcement.
What this means for businesses in Turkey
Turkey's Cyber Security Presidency issued a nationwide alert on 22 October 2026, announcing that it had begun security scans across systems in the country, sent urgent notices to public bodies, and stressed that public institutions, critical infrastructure operators and private companies alike should apply the updates without delay.
For small and mid-sized companies, the real risk is that PHP tends to be invisible. Your corporate website, a customer portal, an ageing accounting interface, the web panel on your camera recorder or the management screen on your NAS may all run on PHP, and none of them are likely to appear on your patch calendar. Many smaller firms are also still running end-of-life PHP 7.4 or 8.0 on shared hosting.
What we recommend
- Inventory first, then plan the patch. List the PHP version running on every internet-facing system. Include staging environments, old campaign sites, device management panels and third-party products that embed PHP, not just the main corporate site.
- Take the fix from your distribution's package repository. Linux distributions and long-term support vendors received patches ahead of disclosure, so upgrade servers through your own distribution's current packages. For hosted sites, get written confirmation of the PHP version from your provider.
- Do not leave an unpatched system exposed. CERT-EU advises isolating internet-facing applications from public networks until the fix is applied and verified. Restrict management interfaces to known IP addresses with firewall rules, and block international traffic to systems that have no need for access from abroad.
If you would like us to inventory the PHP footprint across your servers and web infrastructure, verify patch status, or review your firewall rules, whether at your office on Istanbul's Anatolian side or through remote support, you can reach us via our contact page.
Source: CERT-EU Security Advisory 2026-018, Help Net Security, Turkish Cyber Security Presidency announcement (Ekonomist, Sabah).
Source: CERT-EU