PHP, one of the world's most widely used server-side programming languages and a backbone of the modern web, is at the center of a new security scare. Two critical vulnerabilities discovered in the language have triggered official action in Turkey, where the Cybersecurity Presidency has issued a nationwide alert.

The authority said the flaws in PHP-based infrastructure pose a global risk, and that it has launched comprehensive security scans across Turkey to detect potential impacts early and limit any damage.

How the warning was issued

In a statement shared on the Presidency's official social media account, it was announced that urgent-priority security notifications had been sent to all relevant institutions and organizations. Public agencies, operators of critical infrastructure and private sector representatives were called on to review their systems without delay.

The announcement stressed that applying security updates released by vendors immediately is of vital importance for the integrity of digital infrastructure and the uninterrupted continuation of critical services.

Three key steps for organizations

The Presidency listed three basic measures that organizations running PHP-based applications should implement to protect their infrastructure:

  1. Rapid migration to secure versions: Once the vendor's official security update is released, affected systems must be identified one by one and upgraded to secure versions as a matter of urgency.
  2. Restricting access: Administrative interfaces and critical PHP services should be hardened against external access using firewall or ACL rules, with access limited to authorized and trusted IP addresses only.
  3. Cutting off international traffic: Systems that do not need to be reachable from abroad should be closed off to international traffic immediately to protect them from global attack waves.

The Presidency said its national-level preventive work and coordination efforts are continuing without interruption, and urged organizations to regularly audit the security of their own systems as well.