PHP security alert (TR-26-1372): is your site affected?
On 21 October 2026, Türkiye's national cybersecurity authority (T.C. Siber Güvenlik Başkanlığı) published an official alert about critical security vulnerabilities affecting the PHP programming language. This page briefly explains what the alert means, how to tell whether your site is affected and what you can do.
Last updated: 24 October 2026
What does the alert say?
The alert points to critical security vulnerabilities affecting PHP and advises moving systems that run on old, unsupported PHP versions to current versions.
PHP versions that have reached end of life no longer receive security updates. Vulnerabilities found in them are not fixed; the site keeps running, but the risk grows.
Which sites are at risk?
Sites that run on PHP and have not been updated for a long time: corporate sites built years ago and never maintained, WordPress sites with old themes and plugins, and custom software tied to an old PHP version.
How do you find your PHP version?
Log in to your hosting panel; most panels show the PHP version in the settings. If you don't have access, ask the company that built your site or your hosting provider.
You can check whether that version is still supported on the supported versions page of PHP's official site.
PHP supported versions (php.net) →What should you do?
If your version is unsupported, the first step is moving to a current version. If the old code doesn't run on the new version, rebuilding the site on a modern stack is often safer and longer-lasting than patching it piece by piece.
Which option fits depends on how your site is built; it would not be right to say without looking at it.
What we do
We review your site on its old stack and rebuild it on a current, maintained one. We move your content and take over updates and maintenance after launch.
The sites we build don't use PHP; we write them in TypeScript with React and Next.js.
Source: Türkiye's national cybersecurity authority, security notice TR-26-1372
FAQ
Frequently asked questions
What is TR-26-1372?
It is the number of the official security notice published on 21 October 2026 by Türkiye's national cybersecurity authority about critical vulnerabilities affecting PHP.
Is my WordPress site affected?
WordPress runs on PHP. If your site runs on an unsupported PHP version, the alert applies to you too; check the version in your hosting panel.
Do I have to rebuild my site?
Not necessarily. If your code runs on a current PHP version, an upgrade may be enough. If it doesn't, a rebuild is the healthier option; we can assess it together in the call.