Türkiye's Cyber Security Presidency (Siber Güvenlik Başkanlığı) has launched nationwide security scans over two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) in its notice TR-26-1372 of 21 October 2026. The flaws may allow unauthenticated code execution on the server. PHP released fixes the same day in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Measures listed in the notice

  • Identify affected systems and upgrade to the patched versions without delay
  • Restrict external access to admin interfaces and critical PHP services to authorised IP addresses
  • Close systems with no need for access from abroad to international traffic

Under the Turkish Personal Data Protection Law (KVKK)

  • For systems processing personal data, these steps form part of the technical measures required by Article 12(1). Written confirmation from the hosting provider helps document the measures taken; it does not remove the obligation to ensure that those measures are implemented and audited.
  • A hosting provider's unilateral statement disclaiming liability does not remove statutory obligations. Under Article 12(2), the data controller is jointly responsible with the party processing personal data on its behalf for taking the measures required by Article 12(1).
  • Where the data controller becomes aware that personal data have been obtained unlawfully by others, it must notify the Board without delay and no later than 72 hours after becoming aware of the breach (Article 12(5) and Board Decision 2019/10). Affected individuals must also be notified as soon as reasonably possible after they have been identified.

Patching does not undo a compromise that occurred before the update. Access logs should be reviewed as well.

#DataProtection #Cybersecurity #KVKK

Sources