The key facts

  • The PHP2Shell vulnerability allows remote code execution without a login or password due to errors in code and memory management
  • The FBI and the US NSA warned about the new vulnerabilities; the Netherlands and France took some government websites offline
  • An official patch has been released, but organizations must locate affected systems and update PHP themselves

Critical vulnerabilities in PHP

Two critical vulnerabilities have been discovered in the widely used programming language PHP, affecting digital infrastructure worldwide, prompting organizations in various countries to install updates. The vulnerability, named PHP2Shell, is related to errors in code and memory management and allows code to be executed remotely on compromised systems without entering a username or password.

Reactions from governments in different countries

The Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) of the United States warned the public about the newly discovered vulnerabilities. In the Netherlands, websites providing services on citizenship matters were taken offline, while in France similar measures concerning prefecture websites came onto the agenda. Denmark, Norway, Finland, Japan and South Korea declared cyber alerts and carried out immediate updates.

Measures in Turkey

Turkey's Directorate of Cybersecurity instructed government institutions and private organizations to move their PHP infrastructure to secure versions; security checks and technical monitoring are underway across the country. According to the authorities, an inspection of the e-Government state portal found no problems that would jeopardize the security of the digital services provided.

Risk assessment and recommendations

These vulnerabilities pose a theoretical risk to websites containing sensitive information, and their mere presence does not necessarily mean that personal data has been compromised. Experts urged ordinary users to follow basic digital security measures, and businesses and institutions to determine which internal systems use PHP and which version is active. An official patch has already been released, but identifying affected systems and updating PHP to a secure version remain the task of the organizations themselves. Experts also recommended blocking all international web traffic to internal systems and corporate applications that do not require global access, and allowing traffic only from trusted and authorized IP addresses.