Short answer: on 21 October 2026 Turkey’s Cyber Security Directorate announced a nationwide scan for two critical PHP vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) and sent urgent notices to organisations. In large companies the risk rarely sits on the main website. It hides in forgotten campaign sites, dealer portals, old subdomains and internal applications. 360 Soft builds an inventory of all your PHP assets, patches them in order of priority, checks them for traces of compromise and delivers a closing report you can present to management and auditors.
This service is designed for groups, regulated companies and organisations with many brands, countries or agencies. If you only need to fix a single site quickly, see PHP vulnerability remediation instead.
Enterprise PHP2Shell response process
- External inventory (0 to 48 hours): domains, subdomains, certificate transparency records and IP ranges are scanned. The PHP version and server signature of every internet-facing PHP system is identified.
- Risk ranking: every system is scored by internet exposure, the data it processes (personal, financial, health), PHP version and patch status.
- Immediate mitigation: where patching will be delayed, the session.upload_progress setting, memory-limit hardening, WAF rules and external access restrictions are applied.
- Patching and version upgrade: vendor patches are verified, and for out-of-support versions (7.x, 8.0, 8.1) a move to 8.3 or 8.4 is planned.
- Compromise and intrusion check: server logs, file integrity, unexpected users and scheduled tasks are reviewed; credentials are rotated where needed.
- Closing report: per-system status, actions taken, remaining risks and a timeline, delivered as an executive summary plus a technical annex.
Obligations by sector
The team operates from Turkey, so the Turkish rules below are part of our standard checklist. The laws and supervisory requirements of your own country and sector apply in addition, for example GDPR, NIS2, DORA or local data protection laws, and we align the deliverables with them together with your compliance team.
| Sector | Why it is critical | What to watch |
|---|---|---|
| Banking, payments, insurance | Customer and transaction data, continuous audits | BDDK and SPK information-systems rules in Turkey, internal audit evidence file, penetration test follow-up |
| Healthcare | Patient data is special-category personal data | KVKK and GDPR, access logs, appointment and patient portals |
| Public sector and municipalities | The Cyber Security Directorate notice applies directly | Information and Communication Security Guide in Turkey, citizen portals, e-services |
| E-commerce and retail | Checkout pages, customer accounts, campaign traffic | Payment security, patching without downtime, WAF and CDN rules |
| Groups and multi-brand organisations | Many domains, different agencies, old sites | Central inventory, responsibility matrix, a single report |
| Education, media, tourism | High traffic, many WordPress installations | Bulk version upgrades, plugin clean-up |
If a personal data breach occurs, KVKK expects the data controller to notify the Turkish Personal Data Protection Board within 72 hours of becoming aware of it, and the GDPR sets a similar 72-hour window. Leaving a known vulnerability unpatched can weigh against you when negligence is assessed. We work alongside your own legal team for the legal assessment.
Deliverables
- An inventory table of all PHP assets (domain, server, version, owner, risk score)
- A log of patches and temporary mitigations applied
- Findings of the compromise and intrusion check and a list of rotated credentials
- A roadmap for version upgrades or platform changes for unsupported versions
- A one-page risk summary for the board
Engagement models
| Model | How it works | Best fit |
|---|---|---|
| One-off audit and response | Fixed scope: inventory, patching, compromise check and closing report | Organisations that need to close PHP2Shell quickly and prove it |
| Audit plus upgrade programme | The audit is followed by a planned upgrade or migration track for unsupported systems | Estates with many 7.x, 8.0 or 8.1 applications |
| Ongoing managed service | Continuous scanning, monthly reporting and patch coordination as part of vulnerability management | Companies that want a standing process for the next critical CVE |
| Dedicated team | Engineers join your security or platform team, remote, on-site or hybrid | Large groups with their own SOC or platform organisation |
Roles in the team
- Engagement lead: scope, priorities, communication with management and auditors.
- Security engineers: external inventory, scanning, compromise check, log review.
- PHP and DevOps engineers: patching, version upgrades, configuration hardening, CI/CD changes.
- Reporting analyst: inventory table, evidence file and executive summary.
Teams range from one or two people for a mid-sized estate up to larger groups for hundreds of applications; we can scale from 1 to 200+ people. Work is remote, on-site or hybrid, and 24/7 shifts can be arranged during the incident phase.
KPIs we report on
| KPI | What it shows |
|---|---|
| Inventory coverage | Share of discovered PHP assets with a confirmed version and owner |
| Time to mitigation | Time from discovery to patch or temporary mitigation for each risk class |
| Unsupported versions remaining | Number of systems still on 7.x, 8.0 or 8.1, with target dates |
| Compromise check status | Systems reviewed, findings, credentials rotated |
| Open exceptions | Systems that cannot be patched yet, with compensating controls and owner |
What drives the effort (no fixed prices)
- Number of domains, subdomains and servers in scope
- Share of systems without a known owner or documentation
- Number of unsupported PHP versions and custom code bases
- Required access model (VPN, jump host, on-site)
- Reporting depth required by your auditors or regulator
- Need for out-of-hours work or 24/7 shifts
Selection checklist for a response partner
- Can they find assets you do not know about, not only the ones on your list?
- Do they verify vendor patches instead of trusting version numbers alone?
- Do they check for traces of compromise, not only patch status?
- Is access granted under an NDA and permission matrix and closed at the end?
- Does the report work for both the technical team and the board?
- Can they continue with upgrades or migration for unsupported systems?
Contract, NDA and data protection
We work under a B2B service agreement with a defined statement of work. The NDA is signed before the first call. Reports, scripts and configurations produced for you are assigned to you. Where personal data is processed we sign a GDPR data processing agreement with Standard Contractual Clauses (UK IDTA for UK data), and our processing in Turkey follows KVKK.
Related services: PHP version upgrade and PHP to.NET migration for legacy systems, vulnerability management outsourcing for continuous scanning and SOC and security monitoring for detection.
Frequently asked questions
We have dozens of domains and sites built by different agencies. Where do you start?
We first map every externally visible asset: domains, subdomains, IP ranges and certificate records. We collect the PHP version, hosting type and owner of each system in one table. Then the priority order is set by risk score: internet exposure, data sensitivity and version.
Do we have to give you access to our servers?
External inventory and version detection can be done without access. Patching, log review and the compromise check need limited, time-boxed access. Access is granted under an NDA and a permission matrix, closed when the work is done and documented in the report.
Do you provide a report for auditors and the board?
Yes. The technical team gets a per-system list of findings and actions, and management gets a one-page risk summary and completion status. The report is structured so it can serve as an evidence file for KVKK, BDDK, SPK, GDPR or internal audit processes.
What do you do if we have already been attacked?
We first isolate the affected system and review logs and files while preserving evidence. Credentials, API keys and session keys are rotated. If personal data is affected, we prepare the technical information your legal team needs for the 72-hour notification under KVKK or GDPR.
Do you work outside office hours?
Yes. For enterprise incident requests, weekend and night work is planned. Patches and restarts are carried out in low-traffic hours to reduce the risk of downtime, and 24/7 shifts can be arranged.
Which regulations do you cover?
The team operates in Turkey, so KVKK and, where relevant, BDDK and SPK rules are part of our checklist. The rules of your own country and sector also apply, and we align the report with your compliance team.
How long does an enterprise audit take?
The external inventory is completed in the first 48 hours. The total duration depends on the number of systems, access arrangements and how many unsupported versions are found; we share a timeline after the inventory.
Can you continue after the audit?
Yes. Unsupported systems can move into a version upgrade or platform change track, and the estate can be kept under continuous vulnerability management.
Do you work with our existing security provider or SOC?
Yes. We can work under the coordination of your SOC, MSSP or internal security team and feed our findings into their tools and ticketing process.
Request an enterprise response
Tell us your company name, the approximate number of domains and servers and the technical contact we should speak to. Enterprise requests are called back on the same day by a senior team member, and the NDA is signed before the first call. Phone and WhatsApp: +90 850 335 10 87, WhatsApp, email info@360-soft.com, or our contact page. 360 Soft Marketing Yazılım ve Danışmanlık Ltd. Şti., Nidakule Ataşehir Batı, Barbaros Mah. Begonya Sk. No:1 D:2, 34746 Ataşehir/İstanbul.
Sources: statement of Turkey’s Cyber Security Directorate (21 October 2026), PHP security announcement, technical notes from Tenable and Wiz. Updated: 22 October 2026.
