Cybersecurity alert in Turkey: They are attacking from all sides
Turkey and the world are on alert over cyber attacks. The reason for this is a security vulnerability in PHP. The infrastructure on which websites are built is in danger. Here is what happened in the latest developments.
The world has been discussing the PHP vulnerability experienced on websites for the past two days. From news sites to artificial intelligence (AI) platforms, almost everything the internet reaches passes through PHP. However, a serious security vulnerability was recently detected in PHP, and a cybersecurity warning was issued.
Amazon's cyber threat intelligence team announced that the first attack attempt targeting two critical security vulnerabilities in the PHP infrastructure was recorded on October 17. The vulnerabilities were announced to the public on October 21. In other words, the attacks appear to have started four days before the details of the vulnerabilities were published.
According to Amazon, the attempt was detected by the company's cyber threat monitoring system called MadPot and was made through a commercial anonymizing network. How the attackers obtained information about the vulnerability prior to this date remains unclear.
What do the vulnerabilities mean?
The two tracked vulnerabilities are known by the codes CVE-2026-109618 and CVE-2026-109619. According to the text, these vulnerabilities can allow attackers to execute code remotely on vulnerable servers without a username or password. The risk level of both vulnerabilities was assessed as 9.2 out of 10.
The vulnerabilities can affect PHP-based systems. Platforms such as WordPress, Drupal, and Joomla are cited as examples in the text. Therefore, site owners using these systems need to be particularly careful.
How did the attacks progress?
- October 17: Amazon recorded the first attack attempt.
- October 21: Details of the vulnerabilities were announced. According to Amazon, new attempts were observed from different IP addresses on the same day.
- Afterwards: Attempts were reported to continue even after the release of security updates.
In addition, Amazon stated that the methods and connection infrastructures used in the attacks were different from each other. This indicates that multiple attacker groups may have sprung into action.
Internet security company Cloudflare also announced that it detected attack traffic targeting PHP vulnerabilities. The company reported that attackers were trying to change their methods to bypass firewalls. Cloudflare added that it deployed protection measures before the vulnerabilities were officially announced.
What should site owners do?
PHP versions fixing the security vulnerabilities have been released: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Be sure to perform the latest PHP updates on your sites to prevent a potential attack. In addition, it is recommended to inspect server logs for suspicious activity starting from October 17.
Although it has been confirmed that attack attempts have begun, it is not yet clear which systems these attempts were successful on. Therefore, it is important for organizations whose systems may have been affected to check their logs.
If you do not have much knowledge about PHP software, it is advisable to seek help from someone who manages your website or can provide you with professional support in these matters.
How does this affect you?
If you operate a website, forum, or content management system using PHP, these vulnerabilities may directly concern you. Checking your site's version and updating it stands out as the most concrete step against this risk.
This article was translated from Turkish. Read the original article in Turkish.
