Following news of "serious security vulnerabilities" in PHP, a programming language, access to many websites around the world, including government sites, has been partially or fully suspended as a precaution.
While new measures were taken worldwide against two critical security vulnerabilities detected in the PHP programming language used in websites and corporate applications, institutions and organizations focused on updates to eliminate the vulnerabilities.
These two critical vulnerabilities reported by security researchers can allow malicious actors to gain unauthorized remote access to servers, run malicious code (malware) and capture sensitive user data. These vulnerabilities in PHP, which is used in a wide range of applications, from e-commerce sites to corporate web pages, from personal blogs to huge databases, once again reveal how vital software updates and proactive cyber security measures are. Experts urge all server administrators to urgently update their PHP versions with the latest released patches.
WHAT IS PHP AND WHAT DOES IT DO?
PHP (Hypertext Preprocessor) is a server-side and widely used open source scripting language designed especially for web development processes, which can be embedded into HTML codes. PHP is an open-source basic programming language that powers millions of websites around the world. First developed in the 1990s, PHP is used on approximately 70 percent of websites today.
It is one of the basic building blocks of the internet world. Today, the world's most popular content management systems (CMS) and e-commerce infrastructures such as WordPress, Joomla, Drupal, Magento run on PHP.
PHP works on the server side, establishing database connections (MySQL, PostgreSQL, etc.), processing user registration forms, managing cookies and providing instant creation of dynamic, interactive web pages. In short, PHP is the basic engine that runs silently behind many sites that you interact with and enter data into while surfing the internet and ensures that the system survives.
WHAT DOES A VULNERABILITY MEAN IN PHP?
A vulnerability in PHP means that there is a weakness or bug in the code architecture, operating logic, or default configuration of this language that can be exploited by cyber attackers. In cases like these two recently identified critical vulnerabilities, the extent of the danger is very high. These last two discovered critical vulnerabilities basically fall into the "Remote Code Execution (RCE) class. Thanks to this vulnerability, attackers can send specially prepared malicious scripts (payload) to a server that they do not have access to under normal conditions and gain the authority to perform any action they wish on the server.
HOW CAN I PROTECT MY SITE FROM PHP SECURITY Vulnerabilities?
Although security vulnerabilities pose a risk to websites and online services that contain citizens' personal data, this does not mean that personal data has been compromised.
IT experts state that it is important for citizens to implement basic digital security measures instead of panicking in this process.
The most effective and primary way to protect against such critical risks is to update. It is imperative that the PHP version of the hosting server where your website is hosted is always kept at the most up-to-date and patched version. You should contact your hosting provider to confirm that your server has been upgraded to the secure version. Additionally, placing a Web Application Firewall (WAF) in front of your site will create an extra shield by filtering suspicious traffic and malicious code injections (SQLi, XSS) before they reach the server.
WHAT PRECAUTIONS DID COUNTRIES TAKE AGAINST THE SECURITY Vulnerability?
With the publication of security warnings on an international scale, many countries focused on various measures.
In this context, the US Federal Bureau of Investigation (FBI) and the US National Security Agency (NSA) warned that two critical security vulnerabilities were detected.
The Netherlands has blocked access to sites that provide citizenship services.
France has implemented similar decisions for the websites of governorates.
Denmark, Norway and Finland issued warnings to system users.
Japanese Prime Minister Takaiçi Sanae called for updates to websites using PHP to fix the vulnerability.
While South Korea increased the cyber crisis alert level, it warned public institutions and companies to secure their systems and make the necessary updates to fix vulnerabilities.
WHAT MEASURES WERE TAKEN FOR PHP CRISIS IN Türkiye?
In order to prevent risks in Türkiye, the Presidency Cyber Security Directorate informed the relevant institutions and organizations. Public institutions and private sector organizations were called to check their PHP infrastructures, apply security updates released by the manufacturer and switch to secure versions.
Security scans and technical monitoring efforts continue on a national scale.
In the investigations carried out regarding the critical security vulnerabilities detected in the PHP infrastructure of the e-Government Gateway, no problems were detected that negatively affected the security of the services.
