{"id":90233,"date":"2026-10-22T10:54:39","date_gmt":"2026-10-22T07:54:39","guid":{"rendered":"https:\/\/www.indir.com\/haber\/?p=90233"},"modified":"2026-10-22T10:54:39","modified_gmt":"2026-10-22T07:54:39","slug":"php-guvenlik-acigi-siteler-kapatildi","status":"publish","type":"post","link":"https:\/\/www.indir.com\/haber\/php-guvenlik-acigi-siteler-kapatildi\/","title":{"rendered":"PHP G\u00fcvenlik A\u00e7\u0131\u011f\u0131 D\u00fcnyay\u0131 Alarma Ge\u00e7irdi: Binlerce Site Kapat\u0131ld\u0131"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Web sitelerinin b\u00fcy\u00fck b\u00f6l\u00fcm\u00fcn\u00fcn arka plan\u0131nda \u00e7al\u0131\u015fan programlama dili PHP&#8217;de ortaya \u00e7\u0131kan iki kritik <strong>PHP g\u00fcvenlik a\u00e7\u0131\u011f\u0131<\/strong>, internet d\u00fcnyas\u0131n\u0131 son y\u0131llar\u0131n en ciddi alarm\u0131na soktu. Yamalar\u0131n yay\u0131mlanmas\u0131n\u0131n ard\u0131ndan bir\u00e7ok \u00fclkede h\u00fck\u00fcmet, hastane, okul ve kamu hizmeti siteleri \u00f6nlem amac\u0131yla ge\u00e7ici olarak eri\u015fime kapat\u0131ld\u0131. T\u00fcrkiye&#8217;de de Siber G\u00fcvenlik Ba\u015fkanl\u0131\u011f\u0131 \u00fclke genelinde uyar\u0131 yay\u0131mlad\u0131.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PHP g\u00fcvenlik a\u00e7\u0131\u011f\u0131 neden bu kadar tehlikeli?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP geli\u015ftirme ekibi 20 Ekim&#8217;de yapt\u0131\u011f\u0131 duyuruda, iki kritik a\u00e7\u0131\u011f\u0131 kapatan acil yamalar\u0131n yay\u0131mland\u0131\u011f\u0131n\u0131 bildirdi. CVE-2026-109618 ve CVE-2026-109619 kodlar\u0131yla takip edilen a\u00e7\u0131klar, resmi de\u011ferlendirmede CVSS v4.0 \u00f6l\u00e7e\u011finde 10 \u00fczerinden 9,2 puan ald\u0131. Siber g\u00fcvenlik \u015firketi watchTowr ise riski 10 \u00fczerinden 10 olarak tan\u0131mlad\u0131.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A\u00e7\u0131klar\u0131n en korkutucu yan\u0131, sald\u0131rgan\u0131n oturum a\u00e7mas\u0131na gerek kalmadan sunucuda uzaktan kod \u00e7al\u0131\u015ft\u0131rabilmesine imk\u00e2n tan\u0131mas\u0131. Bu, bir sald\u0131rgan\u0131n do\u011frudan sunucu dosya sistemine ya da veri taban\u0131na ula\u015fabilmesi, hatta zararl\u0131 yaz\u0131l\u0131m y\u00fckleyebilmesi anlam\u0131na geliyor. PHP&#8217;nin internetteki sitelerin yakla\u015f\u0131k y\u00fczde 70&#8217;inde kullan\u0131ld\u0131\u011f\u0131 d\u00fc\u015f\u00fcn\u00fcld\u00fc\u011f\u00fcnde etki alan\u0131n\u0131n ne kadar geni\u015f oldu\u011fu daha iyi anla\u015f\u0131l\u0131yor.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"675\" src=\"https:\/\/www.indir.com\/haber\/wp-content\/uploads\/2026\/10\/php-kodu-kritik-guvenlik-acigi.webp\" alt=\"PHP kodu ve kritik g\u00fcvenlik a\u00e7\u0131\u011f\u0131\" class=\"wp-image-90222\" title=\"\"><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">A\u00e7\u0131klar\u0131 yapay zek\u00e2 buldu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Olay\u0131n dikkat \u00e7eken bir di\u011fer taraf\u0131 ke\u015fif s\u00fcreci. Calif b\u00fcnyesindeki ara\u015ft\u0131rmac\u0131lar a\u00e7\u0131klar\u0131 OpenAI&#8217;\u0131n GPT-5.6 Sol modeliyle tespit etti, Google \u00e7at\u0131s\u0131ndaki Wiz de kendi yapay zek\u00e2 ara\u00e7lar\u0131yla bulgular\u0131 ba\u011f\u0131ms\u0131z olarak do\u011frulad\u0131. Uzmanlara g\u00f6re bu t\u00fcr mant\u0131k hatalar\u0131 klasik kod incelemesiyle y\u0131llarca g\u00f6zden ka\u00e7abiliyor; yapay zek\u00e2 ise hem tespiti hem de istismar senaryolar\u0131n\u0131n \u00fcretilmesini ciddi \u015fekilde h\u0131zland\u0131r\u0131yor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S\u0131zd\u0131r\u0131lan bir videoda &#8220;PHP2Shell&#8221; adl\u0131 istismar arac\u0131n\u0131n WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal ve WHMCS gibi pop\u00fcler platformlarda kod \u00e7al\u0131\u015ft\u0131rabildi\u011fi iddia ediliyor. watchTowr, a\u00e7\u0131klardan en az birini kendi laboratuvar\u0131nda yeniden \u00fcretebildi\u011fini a\u00e7\u0131klad\u0131. G\u00fcvenlik \u015firketi Sansec ise yamalar\u0131n ard\u0131ndan ilk kitlesel sald\u0131r\u0131 dalgas\u0131n\u0131n 15 dakika i\u00e7inde ba\u015flayabilece\u011fi uyar\u0131s\u0131nda bulundu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hangi kurumlar sitelerini kapatt\u0131?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ABD Ulusal G\u00fcvenlik Ajans\u0131 (NSA), Birle\u015fik Krall\u0131k Ulusal Siber G\u00fcvenlik Merkezi (NCSC), Avustralya ve AB yetkilileri, yama uygulanamayan sistemlerin \u00e7evrim d\u0131\u015f\u0131 tutulmas\u0131n\u0131 tavsiye etti. Bu \u00e7a\u011fr\u0131n\u0131n ard\u0131ndan kapatma kararlar\u0131 art arda geldi:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Almanya Dijital Bakanl\u0131\u011f\u0131 baz\u0131 kamu sitelerini \u00f6nleyici olarak kapatt\u0131.<\/li>\n\n<li>Fransa \u0130\u00e7i\u015fleri Bakanl\u0131\u011f\u0131 valilik sitelerini ge\u00e7ici olarak eri\u015fime kapatt\u0131.<\/li>\n\n<li>Hollanda&#8217;da Rotterdam Liman\u0131, Overheid.nl, futbol federasyonu KNVB ve \u00e7ok say\u0131da hastanenin siteleri \u00e7evrim d\u0131\u015f\u0131 kald\u0131.<\/li>\n\n<li>Finlandiya&#8217;da devletin IT merkezi Valtori kamu web hizmetlerini durdurdu.<\/li>\n\n<li>Wikimedia Foundation, PHP kullanan baz\u0131 sistemlerini yamalar tamamlanana kadar kapatt\u0131.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Japonya Ba\u015fbakan\u0131 Sanae Takaichi de kamuya a\u00e7\u0131k sitelerin PHP \u00e7al\u0131\u015ft\u0131r\u0131p \u00e7al\u0131\u015ft\u0131rmad\u0131\u011f\u0131n\u0131n acilen kontrol edilmesini istedi. Cloudflare y\u00f6neticisi Dane Knecht ise ilk sald\u0131r\u0131 giri\u015fimlerinin g\u00f6r\u00fclmeye ba\u015fland\u0131\u011f\u0131n\u0131 ve yeni koruma katmanlar\u0131n\u0131n devreye al\u0131nd\u0131\u011f\u0131n\u0131 a\u00e7\u0131klad\u0131.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Site sahipleri ne yapmal\u0131?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CERT-EU&#8217;ya g\u00f6re a\u00e7\u0131klar 2004&#8217;te \u00e7\u0131kan PHP 5&#8217;e kadar uzanan s\u00fcr\u00fcmleri etkileyebiliyor. Ancak PHP Foundation yamalar\u0131 yaln\u0131zca g\u00fcncel s\u00fcr\u00fcmler i\u00e7in yay\u0131mlad\u0131. Bu nedenle PHP 8.1 ve daha eski s\u00fcr\u00fcmleri kullanan sistemlerin vakit kaybetmeden y\u00fckseltilmesi gerekiyor. G\u00fcncelleme hemen yap\u0131lam\u0131yorsa uzmanlar\u0131n \u00f6nerisi siteyi ge\u00e7ici olarak kapatmak. G\u00fcncel s\u00fcr\u00fcmler ve g\u00fcvenlik duyurular\u0131 i\u00e7in <a href=\"https:\/\/www.php.net\/\" target=\"_blank\" rel=\"noopener\">PHP&#8217;nin resmi sitesi<\/a> takip edilebilir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kendi sitesini y\u00f6netenler i\u00e7in hosting firmas\u0131yla ileti\u015fime ge\u00e7mek de \u00f6nemli. Payla\u015f\u0131ml\u0131 bar\u0131nd\u0131rma kullananlar i\u00e7in <a href=\"https:\/\/www.indir.com\/haber\/web-hosting-secerken-nelere-dikkat-edilmeli\/\">web hosting se\u00e7erken nelere dikkat edilmesi gerekti\u011fini<\/a> anlatt\u0131\u011f\u0131m\u0131z rehber, g\u00fcvenlik g\u00fcncellemelerini h\u0131zl\u0131 yapan bir sa\u011flay\u0131c\u0131 se\u00e7menin \u00f6nemini bir kez daha g\u00f6steriyor. WordPress taraf\u0131ndaki son geli\u015fmeler i\u00e7in <a href=\"https:\/\/www.indir.com\/haber\/wordpresse-kalici-yapay-zeka-asistani-geliyor\/\">WordPress&#8217;e gelen yapay zek\u00e2 asistan\u0131<\/a> haberimize de g\u00f6z atabilirsiniz.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">S\u0131k\u00e7a Sorulan Sorular<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">PHP g\u00fcvenlik a\u00e7\u0131\u011f\u0131 hangi s\u00fcr\u00fcmleri etkiliyor?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CERT-EU&#8217;ya g\u00f6re PHP 5&#8217;e kadar uzanan s\u00fcr\u00fcmler risk alt\u0131nda olabilir. Yamalar yaln\u0131zca g\u00fcncel s\u00fcr\u00fcmler i\u00e7in yay\u0131mland\u0131\u011f\u0131ndan PHP 8.1 ve \u00f6ncesini kullananlar\u0131n y\u00fckseltme yapmas\u0131 gerekiyor.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WordPress sitem etkilenir mi?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress PHP ile \u00e7al\u0131\u015ft\u0131\u011f\u0131 i\u00e7in risk alt\u0131nda. Sunucudaki PHP s\u00fcr\u00fcm\u00fcn\u00fcn g\u00fcncellenmesi ve WordPress ile eklentilerin son s\u00fcr\u00fcmde tutulmas\u0131 gerekiyor.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A\u00e7\u0131\u011f\u0131n istismar edildi\u011fi bir sald\u0131r\u0131 var m\u0131?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare ilk sald\u0131r\u0131 giri\u015fimlerinin g\u00f6r\u00fcld\u00fc\u011f\u00fcn\u00fc a\u00e7\u0131klad\u0131. B\u00fcy\u00fck \u00e7apl\u0131 ba\u015far\u0131l\u0131 bir sald\u0131r\u0131 hen\u00fcz bildirilmedi ancak risk s\u00fcr\u00fcyor.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Web sitelerinin b\u00fcy\u00fck b\u00f6l\u00fcm\u00fcn\u00fcn arka plan\u0131nda \u00e7al\u0131\u015fan programlama dili PHP&#8217;de ortaya \u00e7\u0131kan iki kritik PHP g\u00fcvenlik a\u00e7\u0131\u011f\u0131, internet d\u00fcnyas\u0131n\u0131 son y\u0131llar\u0131n en ciddi alarm\u0131na soktu. Yamalar\u0131n yay\u0131mlanmas\u0131n\u0131n ard\u0131ndan bir\u00e7ok \u00fclkede h\u00fck\u00fcmet, hastane, okul ve kamu hizmeti siteleri \u00f6nlem amac\u0131yla ge\u00e7ici olarak eri\u015fime kapat\u0131ld\u0131. T\u00fcrkiye&#8217;de de Siber G\u00fcvenlik Ba\u015fkanl\u0131\u011f\u0131 \u00fclke genelinde uyar\u0131 yay\u0131mlad\u0131. PHP g\u00fcvenlik a\u00e7\u0131\u011f\u0131 [&hellip;]<\/p>\n","protected":false},"author":100,"featured_media":90221,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,48],"tags":[],"class_list":["post-90233","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji","category-yazilim"],"_links":{"self":[{"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/posts\/90233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/users\/100"}],"replies":[{"embeddable":true,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/comments?post=90233"}],"version-history":[{"count":1,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/posts\/90233\/revisions"}],"predecessor-version":[{"id":90239,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/posts\/90233\/revisions\/90239"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/media\/90221"}],"wp:attachment":[{"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/media?parent=90233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/categories?post=90233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.indir.com\/haber\/wp-json\/wp\/v2\/tags?post=90233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}