PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities

The widely used PHP programming language was found to have two critical security vulnerabilities affecting digital infrastructure worldwide, prompting organizations across the globe to implement updates.

The “PHP2Shell” vulnerability stems from errors in code and memory management, which allow remote code execution on compromised systems without entering a username or password.

The US Federal Bureau of Investigation and the National Security Agency both warned the public about these newly discovered vulnerabilities.

Websites providing citizenship services were taken down in the Netherlands, while similar measures for prefectural websites came to the fore in France.

Countries including Denmark, Norway, Finland, Japan and South Korea issued cyber crisis alerts and implemented immediate updates.

Türkiye’s Cybersecurity Directorate instructed public institutions and private organizations to migrate their PHP infrastructure to secure versions, while nationwide security scans and technical monitoring are underway.

Probes into Türkiye’s e-Government Portal yielded no issues compromising the security of the digital services offered, authorities said.

These security vulnerabilities pose a theoretical risk to websites that contain sensitive information, and the mere existence of these security flaws does not necessarily mean personal data has been compromised.

Everyday users of the internet and online applications are urged to stay vigilant and practice basic digital security measures, while businesses and institutions are urged to determine which internal systems use PHP and identify which version is active, experts said.

An official security patch has already been released, but it is up to organizations to identify affected systems and update their PHP installations to a secure version.

Experts also advised blocking all international web traffic to domestic systems and enterprise applications that do not need global access and allowing traffic only from trusted and authorized IP addresses.