The National Cybersecurity Agency (MKA) under the Ministry of Digital Development and Transport warns about two critical security vulnerabilities discovered in the “PHP” programming language, named “PHP2Shell”.
According to information provided to elchi from the Agency, “PHP” is one of the most widely used programming languages that ensures the functioning of websites and web applications. A large portion of websites on the internet operate based on this language. This includes popular content management systems (CMS) like “WordPress”, “Joomla”, “Drupal”, online stores, e-learning platforms, and hosting control panels. Therefore, the discovered vulnerabilities do not end with a single resource and pose a simultaneous risk to all information systems using this language.
The discovered vulnerabilities (CVE–2026-109618, CVE–2026-109619) have been rated 9.2 (critical) on a 10-point scale. The vulnerabilities allow an attacker to remotely execute any command on the server by sending a specially crafted request. To carry out the process, a username, password, or any other security vulnerability on the website itself is not required. This allows for simple and widespread execution of attacks.
An entity that successfully exploits the vulnerabilities can take over the server and place a malicious file that provides permanent remote access. Thus, login credentials for databases and other services, as well as users’ personal data, can be stolen. Furthermore, the website’s content can be altered, malicious software, including ransomware, can be spread, and the compromised server can be used to infiltrate the organization’s internal network and attack other systems.
In this regard, MKA urges website owners, hosting providers, and organizations managing information systems to take the following measures without delay:
Update “PHP” to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35;
Website owners whose websites are hosted on a hosting provider’s server and do not have direct access to the server should contact their provider to take necessary measures to eliminate security vulnerabilities;
Check for the execution of suspicious operations on the server;
If a compromise of the server is suspected, isolate the system from the network and preserve the logs.
Additionally, it is recommended to immediately report cyber incidents to the National CERT, apply software security updates in a timely manner, regularly check the security status of information systems, and strengthen monitoring. According to international statistics, approximately 70 percent of websites with identifiable server technology among the most visited sites worldwide operate based on this language. The “WordPress” platform, used on about 40 percent of those sites, is also built on “PHP”. In other words, approximately two-thirds of the most visited sites are potentially related to these vulnerabilities, meaning they are at risk.