Türkiye's Cyber Security Presidency launches nationwide scan for PHP2Shell flaws in PHP
Türkiye's Cyber Security Presidency began nationwide scans for high-risk PHP2Shell flaws in PHP and urged system administrators to apply updates at once.
According to an Anadolu Agency report dated 21 October 2026, Türkiye's Presidency of Cyber Security started a nationwide security scan for the PHP2Shell flaws found in PHP, which it rated high risk. It asked system administrators in both the public and private sectors to review internet-facing systems and apply updates immediately.
Anadolu Agency (AA) reported on 21 October 2026 that Türkiye's Presidency of Cyber Security has started nationwide preventive work against critical flaws in PHP, a software platform widely used for websites and enterprise applications. The Presidency said the flaws, called "PHP2Shell", carry a high risk.
- Under certain conditions, the flaws could let attackers run code remotely without authentication.
- The Presidency listed unauthorized access to internet-facing systems, data breaches and disruption of digital services as possible outcomes.
- Public institutions get priority in the nationwide scans; through the SOME communication platform, the Presidency sent urgent alerts to all institutions and to critical infrastructure, along with the technical and administrative measures to take.
- Institutions were advised to put the measures in the official advisory tr-26-1372 on the Presidency's website into practice without delay. The report gave no CVE numbers and no count of affected systems.
Why it matters
Because PHP can also sit behind company websites, online stores and dealer portals, the impact of these flaws may not be limited to the public sector. The call is addressed to system administrators in the private sector as well as public bodies. For companies that run PHP applications on their own servers or on shared hosting, a practical first step could be to list which systems face the internet, check their PHP versions and confirm the update status with their hosting provider.
- Build an inventory of internet-facing PHP applications and their versions.
- Apply security updates without delay, or get confirmation from your hosting provider.
- Close external access that is not needed and add protection for services that must stay open.
- Follow the Presidency's advisory tr-26-1372 for the detailed measures.
Sources
More articles
Microsoft to process Claude models in Copilot inside the EU Data Boundary by the end of 2026
Microsoft says Anthropic's Claude models in Copilot will move into the EU Data Boundary. The target is the end of 2026, and the Claude setting is off by default in the EU and EFTA.
November 5, 2026 · Source: MicrosoftGoogle makes Gemini Omni 1.2 Flash video model generally available with clips up to 15 seconds
Google made its video generation and editing model Gemini Omni 1.2 Flash generally available on 5 November 2026. It is rolling out to the Gemini API, Google Cloud, Flow, Google Vids, the Gemini app and Google Ads.
November 5, 2026 · Source: Google BlogShopify's third-quarter revenue rises 32 percent to 3.74 billion dollars
In third-quarter results published on 3 November 2026, Shopify reported revenue up 32 percent and gross merchandise volume (GMV) up 29 percent. The company expects revenue growth in the low thirties percent again in the fourth quarter.
November 3, 2026 · Source: Shopify (SEC 8-K)