OMM Newsroom
Two critical vulnerabilities in the widely used PHP programming language could affect digital infrastructure worldwide, prompting organizations to update their systems, Anadolu Agency reported.
The “PHP2Shell” vulnerability stems from errors in code and memory management. It can allow remote code execution on affected systems without a username or password.
The US Federal Bureau of Investigation and National Security Agency have both warned the public about the newly discovered vulnerabilities.
Websites providing citizenship services were taken offline in the Netherlands, while similar measures for prefectural websites were considered in France.
Denmark, Norway, Finland, Japan and South Korea issued cyber crisis alerts and implemented immediate updates.
Türkiye’s Cybersecurity Directorate instructed public institutions and private organizations to migrate their PHP infrastructure to secure versions. Nationwide security scans and technical monitoring are also underway.
Authorities said investigations into Türkiye’s e-Government Portal found no issues compromising the security of its digital services.
The vulnerabilities pose a theoretical risk to websites containing sensitive information, but their existence does not necessarily mean personal data has been compromised.
Experts urged internet and online application users to remain vigilant and follow basic digital security practices. They also advised businesses and institutions to identify internal systems using PHP and determine which versions are active.
An official security patch has been released. Organizations are responsible for identifying affected systems and updating their PHP installations to a secure version.
Experts also recommended blocking international web traffic to domestic systems and enterprise applications that do not require global access, and allowing connections only from trusted and authorized IP addresses.
