Critical security vulnerabilities detected in PHP software, widely used in the infrastructure of websites and web applications, have caused concern for the security of personal data and the continuity of digital services.
Prof. Burhan Pektaş, Head of the Computer Engineering Master's Program Department, stating that PHP-based applications are used in many areas from banking to e-commerce, health services to universities and public institutions, said, “Taking over a server can lead to an attacker accessing personal data, changing the content of the website, or disrupting services, depending on the privileges obtained.”
Prof. Burhan Pektaş stated that individual users should also be careful about digital security, particularly recommending regular checks of account activities and the use of multi-factor authentication.
Critical security vulnerabilities announced on October 21, 2026, in PHP software, widely used in internet infrastructure, and referred to as PHP2Shell, have brought cybersecurity measures for institutions back to the agenda. These vulnerabilities, which can allow attackers to execute remote code on servers without authentication under certain conditions, pose a particular risk for systems that process personal data.
Prof. Burhan Pektaş, Head of the Computer Engineering Master's Program Department at Üsküdar University Faculty of Engineering and Natural Sciences, evaluated the potential effects of the security vulnerabilities detected in PHP software and the measures that institutions and individual users should take.
“Numerous applications using the same technology can be affected"
Prof. Burhan Pektaş pointed out that critical software vulnerabilities can affect not only a single website but also numerous applications using the same infrastructure, stating, “The most important feature of such vulnerabilities is their potential to affect not just a single website, but many applications using the same technology. However, it is not correct to say that all sites using PHP are vulnerable or compromised. The risk depends on the software version used, server configuration, and whether security updates have been applied.”
“Sensitive data such as patient information and student records may be at risk”
Prof. Pektaş stated that PHP-based applications are used in many areas, from banking to e-commerce, health services to universities and public institutions, adding that institutions should control not only their own software but also the systems from which they receive external services.
Referring to the consequences of a possible attack, Prof. Pektaş said, “Taking over a server can lead to an attacker accessing personal data, changing the content of the website, or disrupting services, depending on the privileges obtained. Security measures are particularly important in systems processing sensitive data such as patient information, student records, customer accounts, and order details.”
Prof. Pektaş also emphasized that the detection of a security vulnerability does not necessarily mean that data theft has occurred, stating, “The discovery of a security vulnerability does not mean that the institution in question has been attacked or that all user data has been stolen. To reach such a conclusion, system logs must be examined and potential attacks technically verified.”
“The attacker may not need to take over a user account”
Prof. Pektaş pointed out that attacks that can be carried out without the need for a username and password are particularly dangerous, explaining that such vulnerabilities can allow systems to be interfered with by bypassing authentication mechanisms.
Prof. Pektaş said, “Attackers being able to run code on a system without needing a username and password poses a serious security risk. This is because the attacker may not need to first take over a user account; a specially crafted request sent to the vulnerable system can initiate the attack.”
Pektaş stated that a successful attack could bring about various security issues, adding, “When an attack is successful, depending on the system's configuration, consequences such as access to databases, modification of files, persistence of unauthorized access, or lateral movement to other systems may arise. This situation can indirectly affect not only institutions but also citizens who use the services provided by those institutions. Whether credit card information, passwords, or personal data will be stolen depends on how the application is designed, where the data is stored, and what access privileges the attacker obtains.”
“Updating does not mean the system has not been previously attacked”
Prof. Pektaş emphasized that software updates released to close security vulnerabilities should not be delayed, adding that the infrastructures of internet-facing applications and third-party service providers should be checked in particular.
Referring to the importance of regular updates for small businesses, hospitals, and universities, Prof. Pektaş said, “Regular software updates, restriction of access privileges, secure backups, and monitoring of server logs are among the fundamental measures. In cases where an update cannot be made immediately, temporary measures should be taken to prevent vulnerable systems from remaining exposed to the internet.”
Prof. Pektaş pointed out that merely performing a software update may not be sufficient, cautioning, “Updating does not mean the system has not been previously attacked. Therefore, if a suspicious situation is detected, a technical investigation should be conducted, necessary access information should be renewed, and the scope of the incident determined.”
“Internet users should not panic, but enhance account security”
Prof. Burhan Pektaş stated that individual users should also be careful about digital security, particularly recommending regular checks of account activities and the use of multi-factor authentication.
Prof. Pektaş said, “Internet users do not need to panic in the face of such news. However, it would be beneficial for them to follow the security announcements of the institutions they use, check their account activities, use different passwords for different platforms, and enable multi-factor authentication wherever possible.”
Prof. Pektaş concluded by noting that digital security is a shared responsibility, saying, “Timely application of security updates, investigation of potential attacks, and protection of personal data are among the fundamental conditions for the reliable continuation of digital services.”
