Critical warning in PHP2Shell alarm Critical warning in PHP2Shell alarm

Two vulnerabilities detected in the PHP programming language, which is widely used around the world, have become among the priority issues of the global cyber security agenda. The vulnerabilities, which have a criticality score of 9.2 out of 10, pose the risk of executing unauthorized code on affected systems and accessing sensitive data. While PHP developers are releasing security updates, experts point out that especially systems open to the internet should be checked without delay.

“Proper operation of the system is as critical as security”

Virgosol Co-Founder and Co-CEO Miraç Emektar made the following assessment on the subject: "Critical security vulnerabilities such as PHP2Shell pose a wide risk area for companies, from data security to business continuity. Even a short-term outage, especially in finance, e-commerce and digital service platforms, can lead to transaction losses, operational disruptions and damage to customer trust. Therefore, the rapid implementation of security updates is the first priority. However, while closing a security vulnerability, you can pave the way for new errors at other points of the application. Correct updates." "It also needs to be verified that critical functions are working smoothly and that there are no traces of possible attacks on the systems. Re-opening a system does not mean that all risks are eliminated."

Veteran summarized what needs to be done before, during and after the intervention against the PHP2Shell vulnerability under the following headings:

“Risky systems should be determined before intervention

Security and business continuity should be managed together during the intervention

"After the intervention, it should be verified that the system is truly safe."

“Self-confidence should not be an alternative to systematic quality processes”

Veteran stated that security vulnerabilities should not be considered only as a technical problem and made the following assessment regarding the quality approach of institutions: "Of course, it is important for technology teams to trust their knowledge and competencies. However, sometimes this self-confidence can cause security, testing and quality processes to be put on the back burner. The cost of an underestimated risk or a missed control to companies can be very high. Self-confidence should not be an alternative to systematic work. Institutions should base their processes on measurable and sustainable quality standards, not on the experiences or initiatives of individuals. When closing a security gap, You may pave the way for new errors at other points in the application. Therefore, it is necessary to focus not only on the elimination of the vulnerability but also on the impact of the change on the entire system. At this point, the speed of code development has increased more than ever. It is becoming increasingly difficult to ensure the quality of constantly changing and updated software using only traditional methods. While security updates are closing existing vulnerabilities, systematic testing and quality engineering processes are no longer an alternative. "It helps us ensure the reliability and business continuity of the changes made."