Following two critical security vulnerabilities detected in the PHP infrastructure, scanning was launched on a national scale in Turkey. While it was announced that no problems were detected in the checks made for the e-Government Gateway, the status of other systems was also a matter of curiosity. In this period when critical vulnerabilities are on the agenda, the studies we carried out on secure software development, project production and testing of security components in the first lecture I gave with students at Istanbul Technical University also revealed remarkable results.
Why did two critical vulnerabilities in PHP come to the fore?
A lot of software runs in the background of the services we use on the internet, of which we are often unaware. Many components, from servers to programming languages, need to work together in order to open a website, submit an application or complete a transaction.
PHP is one of the important parts of this infrastructure. PHP is widely used in websites and web applications around the world; It is used in many areas, from corporate portals to content management systems, from e-commerce platforms to specially developed applications.
Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, announced in PHP, therefore came to the fore on the international cyber security agenda. Both deficits were classified with a score of 9.2 in the CVSS assessment. According to international technical alerts, under certain conditions, these vulnerabilities pose risks that could allow attackers to execute code remotely without authentication.
This means that if the system using an affected PHP version has not received the necessary security fixes, the risk may not be limited to the appearance of the website. Depending on the configuration of the system and the circumstances of the attack, data, files, and services on the server may also be affected.
Of course, this does not mean that every website using PHP is hacked. The fact that a vulnerability is at a critical level indicates the seriousness of the risk. It is necessary to further examine which systems are truly vulnerable.
Why did Türkiye launch screening on a national scale?
In the announcement published on October 21, 2026, the Presidency's Cyber Security Directorate announced that security scans were initiated on a national scale in order to identify the risks that PHP vulnerabilities may pose and limit their possible effects.
Security notifications were sent to relevant institutions and organizations. Institutions were asked to review the systems they use and apply the necessary security updates.
This development is important. Because different institutions using the same software may have independent systems. Just because one institution has taken the necessary security measures does not mean that another institution is in the same situation.
The most important question for Türkiye here is what is encountered as a result of the scans.
Currently, there are no comprehensive numbers in public announcements showing how many systems have been examined throughout Türkiye, how many systems have been identified as vulnerable, or to what extent updates have been completed.
For this reason, it would not be right to say that all public sites in Turkey are at risk, nor to assume that all systems are safe. The real picture can be revealed by examining the software and versions used by institutions.
How many systems are at risk in Turkey?
There is no definitive answer to this question today. However, it is enough to look at the usage area of PHP to understand why the risk should be taken seriously.
PHP is not only used on the websites of public institutions. Private companies, e-commerce platforms, educational institutions, media organizations and businesses of different sizes can also benefit from this infrastructure.
Moreover, it is not necessary for an organization's own team to develop every software it uses. PHP components may also be included in an outsourced service or third-party product. Therefore, simply checking the institution's main website may not be enough to reveal all risks.
To understand the real risk in Turkey, three issues need to be considered.
First, it must be determined which systems are using the affected PHP versions. Secondly, it should be examined whether these systems are accessible over the internet. Finally, it should be verified whether security updates have been applied.
For example, a server that is running an affected version and is accessible over the internet but has not yet been updated should be treated as a priority. On the other hand, a system using a version not affected by these vulnerabilities cannot be said to be vulnerable just because it uses PHP.
The main point here is not to declare all systems using PHP risky; to be able to identify truly affected systems in a timely manner.
Verified screening results to be shared with the public may help us understand more clearly the extent of the risk in Turkey.
What does the result announced for e-Government mean?
One of the questions that came to the minds of citizens after this development was the status of the e-Government Gateway.
In the news of Anadolu Agency dated October 22, 2026, it was stated that the security checks at the e-Government Gateway were completed and no problems were detected.
This is an important statement in the context of e-Government. However, it is necessary to interpret this correctly. Not detecting a problem on a platform does not mean that the systems of all public institutions in Turkey are examined in the same context or that all systems are safe in terms of these vulnerabilities.
The applications, software components and technical infrastructure used by each institution may be different. Therefore, the status of other systems should be determined by their own technical investigations.
In short, the result announced for e-Government is a positive development; but it does not replace the results of all studies carried out on a national scale.
Institutions should not be satisfied with just making updates
The PHP team has released security fixes for the affected release branches. Institutions need to check the versions they use and switch to appropriate secure versions.
However, the security work does not completely end with installing the update.
First of all, it should be known in which applications of the institution PHP is used. Then the version used must be verified, the update applied and checked that the system is actually running the corrected version.
Another important issue is the examination of possible attacks. If a system was exploited before it was updated, simply updating it will not eliminate a breach that may have occurred in the past. When necessary, system records should be examined and suspicious activities should be investigated.
For this reason, it is important for institutions to both close security gaps and examine possible signs of breach when needed.
Finding a vulnerability does not prove that an attack has occurred. Likewise, applying the update does not alone prove that no attacks have occurred in the past.
While PHP vulnerabilities are on the agenda, a remarkable study from ITU: How ready is the new generation for cyber security?
During this period when critical security vulnerabilities were being discussed in Turkey, the focus of the first course I gave at the Istanbul Technical University Informatics Institute campus was secure software development, project production and testing of security components.
In this respect, the timing of the lesson was also meaningful. While, on the one hand, institutions take precautions against security vulnerabilities to protect their existing systems, on the other hand, we practically addressed similar security issues with students who will develop these systems in the future.
We did not content ourselves with just conveying theoretical information within the scope of the course. We organized a mini hackathon in the classroom, we worked on different projects, and I closely followed how the students implemented the solutions they developed.
Students evaluated the software components they used while developing their projects in terms of security. We focused on selecting reliable libraries, considering OWASP sources, and incorporating security controls into the development process.
Then, students tested each other's projects in a controlled environment. They evaluated the points they identified, reported their findings, and explained the applications they developed through presentations and live demos. I also evaluated the projects by listening to the presentations and gave technical feedback.
The most striking aspect of these studies for me was that the students did not just focus on creating a working application. In addition to how a software is developed, they also had to think about how to test it for security, how to detect potential problems, and how to report these problems.
The studies that emerged within the scope of the first lesson revealed beautiful and sometimes surprising results in terms of observing the students' approach in this field. Of course, a single lesson or hackathon is not enough to accurately measure the readiness of a student group or the new generation in Turkey in the field of cyber security. However, applied studies provide an important opportunity to see how students can transfer their knowledge to real problems and think about security.
The question here is not just whether students recognize a vulnerability. At the same time, can they choose the right software components, test the applications they have developed in a controlled manner, can they understand and report a problem when they encounter it, and do they know what precautions to take when moving the software to the production stage?
The topics we focused on in the study at ITU were exactly related to these questions. Because developing secure software in the real world requires more than just being able to write code. It is also necessary to question the reliability of the developed system, follow the components used, evaluate the test results and consider security measures from the beginning of the process.
Students presenting their projects, performing live demos and explaining the testing processes were important stages where theoretical knowledge meets practice. A software not only needs to work, but also needs to be understandable how it works and what security assessments it has passed.
This study alone does not provide an accurate measurement to understand how ready the new generation is for cybersecurity. However, it shows how valuable it is for students to encounter realistic scenarios, test the systems they have developed, and defend their technical findings.
Security should not be considered after the software is completed
Critical vulnerabilities emerging in PHP remind us why this approach is important.
A failure in a software component can affect multiple systems that use that component. Therefore, developers need to know the libraries and dependencies they use, follow updates, and consider security from the beginning of the development process.
We also addressed this perspective practically in our studies with students at ITU. Safe component selection, controlled testing, reporting of findings and pre-production evaluation are not independent tasks; Complementary stages of the software development process.
Of course, one lecture or hackathon alone cannot solve all security problems. However, if young people gain these experiences during the training phase, it may help them to address security more consciously in the projects they will develop in the future.
Training experts who will protect Turkey's digital infrastructure is as important as keeping existing systems up to date.
What should be done for Turkey's digital future?
The priority for today is to identify affected systems and implement the necessary security updates in a timely manner. Verifying the results of screenings initiated on a national scale can also provide a clearer understanding of the risk in Turkey.
In addition, organizations need to keep their software inventories up to date, reduce out-of-support versions, and evaluate the software services they outsource in terms of security.
In the long term, it is important to spread a secure software development culture. Conducting applied studies at universities, testing students' projects, reporting security findings and explaining technical decisions can contribute to the development of this culture.
For me, the most important aspect of the work we carried out with the students in my first course at ITU was not to leave security only as a theoretical issue. By bringing together project development, testing, evaluation and presentation processes, we aimed for students to address the security issue through practice.
Because cyber security is not just about intervening when a vulnerability emerges. Thinking about risks in advance, tracking the components used, testing and reporting problems accurately are integral parts of this job.
In order for Turkey to have a safer digital future, protecting today's systems and training tomorrow's experts should be considered together. On the one hand, there should be institutions that close critical vulnerabilities in a timely manner, and on the other hand, there should be software developers who consider security from the beginning of the development process.
While the vulnerabilities in PHP remind us of today's security responsibility, applied studies carried out at universities also raise the question of who and how will develop the digital infrastructure of tomorrow.
