Türkiye's Cyber Security Directorate has issued a nationwide alert over two critical PHP vulnerabilities. Rated CVSS 9.2, they allow remote code execution without authentication.
Türkiye's Cyber Security Directorate issued a nationwide security alert on 21 October 2026 over two critical vulnerabilities in PHP. The advisory, referenced TR-26-1372, asks organisations to review their internet-facing infrastructure and apply the published security updates without delay. The directorate also said it had sent urgent notices to institutions and critical infrastructure operators through its SOME incident response network, and that national-scale security scans were under way.
What the flaws actually are
Tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, both bugs carry a CVSS score of 9.2 according to CERT-EU figures cited by SecurityWeek. Both stem from memory handling errors. In one case, request data left half-initialised when memory runs out is later treated as valid. In the other, state belonging to one request survives after its memory is freed and gets reused by the next request on the same worker. Either path leads to the same outcome: remote code execution with no authentication required.
As Help Net Security reports, every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php setups facing the greatest exposure. Fixes shipped as emergency releases in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are no longer supported upstream, and only limited source-level backports exist for them.
Why the urgency
Technical details leaked online ahead of the planned coordinated disclosure. SecurityWeek reports that security firms observed exploitation attempts even before the patches were published. A single unauthenticated request can trigger the bug before any application code runs, which means a clean codebase of your own offers no protection. The UK's NCSC advises taking offline any system that cannot be patched immediately.
What this means for businesses in Türkiye
PHP sits underneath corporate websites, e-commerce platforms, dealer and customer portals, intranet applications and content management systems such as WordPress. On shared hosting the patching duty usually sits with the provider; on a company-operated server it sits with the business. Where that line has never been drawn clearly, systems can sit unpatched because each side assumed the other would act.
There is a compliance dimension too. If unauthorised access occurs through a web application that processes personal data, Article 12 of Law No. 6698 triggers a notification duty towards the Personal Data Protection Board and the affected individuals. Under the board's established practice, that notification is due within 72 hours of discovering the breach.
What we recommend at Kamer Bilişim
- Build the inventory first, then patch. Put every site, portal and application into one list showing which server it runs on and which PHP version it uses. Record the php -v output and the installation type (mod_php, PHP-FPM, LiteSpeed) for each, and move mod_php systems to the front of the queue.
- Get written confirmation from your hosting provider. If you use shared hosting or an externally managed server, ask by email whether the update has been applied and which version is now running. A verbal assurance will not help you in an audit; a record will.
- Narrow the attack surface and review your logs. Take admin panels, staging environments and unused subdomains off the public internet. Then check the last week of web server access logs for unusual POST requests and unexpected file creation.
Kamer Bilişim supports corporate clients across the Anatolian side of Istanbul and remotely with server inventory work, PHP version upgrades, hosting provider coordination and log review. To have your infrastructure checked against these vulnerabilities, reach us through our contact page.
Source: Cyber Security Directorate of Türkiye (TR-26-1372), Help Net Security, SecurityWeek
Source: Help Net Security