Cyber Security Directorate Launches National Scan for Critical PHP Vulnerabilities

The Presidency's Cyber Security Directorate launched a national-scale security scan on October 21 in response to two critical software vulnerabilities known as "PHP2Shell"; public institutions, private sector organizations, and critical infrastructure operators were alerted via notification TR-26-1372.

In a notice transmitted through the Cyber Incident Response Teams Communication Platform, operators were instructed to examine internet-facing PHP systems, apply security updates without delay, restrict external access to administrative interfaces, and block international traffic to systems that should not require overseas access.

Both vulnerabilities, registered with codes "CVE-2024-109618" and "CVE-2024-109619", each scored 9.2 out of 10 on the international security rating system. According to PHP developers' explanation, the vulnerabilities arise in the software's memory management and memory cleanup operations after errors. Attackers can execute code on the server with specially crafted requests without entering a username and password under certain conditions. The PHP security team reported that the threat is higher especially in Apache's mod_php configuration and that the attack can be triggered before application code begins running.

The Directorate's statement did not share any figures regarding verified breach incidents or data loss in Turkey.

According to security firm Wiz, approximately 70 percent of websites globally utilize PHP.

According to Reuters' October 21 compilation, public websites and hospitals in numerous European countries were temporarily taken offline. In Germany, federal IT services provider ITZBund took some public websites offline while the German Ministry of Digitalization stated the measure was precautionary and that there was no known security incident. In France, the Interior Ministry temporarily shut down regional prefectures' websites. In the Netherlands, the government's Overheid.nl portal, Rotterdam Port, numerous hospitals and other organizations' websites were taken down as a precaution. In Finland, state IT center Valtori suspended public internet services while the Czech government cut access to its official website for security updates. Following reports of attacks exploiting the vulnerabilities, Belgium's Foreign Ministry temporarily closed its websites; however, Belgium's Cyber Security Center reported that it had not recorded any attacks on the country's websites. The Wikimedia Foundation also announced it had shut down some of its PHP-using systems until security updates were completed.

The majority of outages were not the result of verified attacks but rather temporary measures taken against the possibility of attack. Conversely, internet security company Cloudflare announced that it observed attack traffic directed at the systems it protects and activated firewall rules. Observation of these efforts does not mean that targeted systems were successfully compromised.