Critical PHP vulnerabilities trigger alert across 70% of websites

Two critical vulnerabilities in PHP, which powers most websites, led to the closure of some government websites in Japan and Europe. While U.S. agencies CISA and the FBI called for urgent updates, a nationwide scan was also launched in Türkiye.

Scraper SystemOctober 22, 2026, 07:19 PM

Critical PHP vulnerabilities trigger alert across 70% of websites

Two critical security vulnerabilities known as "PHP2Shell" were identified in the PHP programming language, which runs behind most websites. The vulnerabilities may allow attackers to execute commands remotely on vulnerable servers without needing a username or password. According to W3Techs, 69.3% of websites with a known server-side language use PHP.

After the vulnerabilities became known, Japan's Ministry of Health, Labour and Welfare temporarily shut down the website of an information system; some public institutions in Denmark, Norway, Finland and the Netherlands also restricted access to their websites.

What should be done?

Washington'daki FBI genel merkezi

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) called for an inventory of all systems using PHP and urged organizations to immediately upgrade internet-facing systems as a priority to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35. It recommended taking systems offline until they are patched if an immediate update is not possible or if unsupported versions 8.1 and earlier are in use, while providing limited protection with a web application firewall during that period. The FBI advised monitoring PHP processes for unexpectedly launching command shells.

Nationwide scan launched in Türkiye

Türkiye's Cybersecurity Presidency also launched a nationwide scan, prioritizing public institutions. The Presidency announced that checks on the e-Government Gateway, which provides services to more than 69 million users, found no issue affecting the security of services and that they continued without interruption.

Source: Anadolu Ajansı

Have a story, event or announcement of your own?Send us your news on WhatsApp

Spotted an error in this story?Report it on WhatsApp

Share on all social platforms