{"id":20,"date":"2026-10-23T08:09:26","date_gmt":"2026-10-23T08:09:26","guid":{"rendered":"https:\/\/adnancanturk.com\/blog\/nodejs-bind-java-ekim-2026-guvenlik-surumleri-sunucu-tarafi\/"},"modified":"2026-10-23T09:50:32","modified_gmt":"2026-10-23T09:50:32","slug":"nodejs-bind-java-ekim-2026-guvenlik-surumleri-sunucu-tarafi","status":"publish","type":"post","link":"https:\/\/adnancanturk.com\/blog\/nodejs-bind-java-ekim-2026-guvenlik-surumleri-sunucu-tarafi\/","title":{"rendered":"Tek haftada Node.js, BIND ve Java: Ekim 2026 g\u00fcvenlik s\u00fcr\u00fcmlerine sunucu taraf\u0131ndan bak\u0131\u015f"},"content":{"rendered":"<p class=\"lead\">G\u00fcvenlik s\u00fcr\u00fcmleri nadiren bu kadar \u00fcst \u00fcste gelir. Tek haftada ISC BIND 9&#8217;u yamalad\u0131, Oracle \u00fc\u00e7 ayl\u0131k Critical Patch Update&#8217;ini ve ard\u0131ndan acil bir Java uyar\u0131s\u0131n\u0131 yay\u0131mlad\u0131, Node.js on d\u00fczeltme \u00e7\u0131kard\u0131 ve taray\u0131c\u0131lar, \u00f6zel anahtarlar\u0131n\u0131n zay\u0131f oldu\u011fu anla\u015f\u0131lan sekiz ara sertifika otoritesini engelledi. Her biri tek ba\u015f\u0131na y\u00f6netilebilir. Birlikte ise DNS&#8217;e, TLS g\u00fcven zincirine ve sunucudaki en yayg\u0131n iki uygulama \u00e7al\u0131\u015fma ortam\u0131na dokunuyorlar; bu y\u00fczden tek bir i\u015f olarak ele almak mant\u0131kl\u0131.<\/p>\n<div class=\"tldr\">\n<p class=\"tldr-label\">TL;DR<\/p>\n<ul>\n<li>ISC, 21 Ekim 2026&#8217;da d\u00f6rt y\u00fcksek \u00f6nem dereceli BIND 9 hatas\u0131n\u0131 d\u00fczeltti; d\u00fczeltilmi\u015f s\u00fcr\u00fcmler 9.20.30 ve 9.21.27, 9.18 ise GSS-TSIG d\u00fczeltmesi alm\u0131yor.<\/li>\n<li>Sekiz eMudhra ara CA&#8217;s\u0131 anahtarlar\u0131 ele ge\u00e7irildi\u011fi i\u00e7in engellendi; taray\u0131c\u0131lar 17 Ekim&#8217;den itibaren, Node.js ve Java 21 Ekim&#8217;de harekete ge\u00e7ti.<\/li>\n<li>Node.js 22.23.4, 24.22.1 ve 26.12.1 g\u00f6m\u00fcl\u00fc CA listesini g\u00fcncelledi; Java&#8217;da hem Ekim CPU&#8217;su hem de CVE-2026-91403 g\u00fcvenlik uyar\u0131s\u0131 gerekiyor.<\/li>\n<li>\u0130\u015fletim sistemi paketi, her JDK&#8217;n\u0131n <code>cacerts<\/code> dosyas\u0131 ve Node.js&#8217;in yerle\u015fik k\u00f6k sertifikalar\u0131 ayr\u0131 depolard\u0131r ve ayr\u0131 ayr\u0131 g\u00fcncellenir.<\/li>\n<li>Acil bir BIND y\u00fckseltmesi planlamadan \u00f6nce <code>named<\/code>&#8216;in ger\u00e7ekten \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 kontrol edin.<\/li>\n<\/ul>\n<\/div>\n<h2>Bir bak\u0131\u015fta hafta<\/h2>\n<figure class=\"wp-block-image size-full gitm-figure\"><svg role=\"img\" aria-label=\"14-21 Ekim 2026 zaman \u00e7izelgesi: BIND, eMudhra, Oracle, Node.js ve Java\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 1600 560\"><rect width=\"1600\" height=\"560\" fill=\"#fff\"\/><text x=\"80\" y=\"80\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"40\" font-weight=\"700\" letter-spacing=\"-1.5\" fill=\"#171717\" text-anchor=\"start\">Yedi g\u00fcn, d\u00f6rt \u00fcretici<\/text><text x=\"80\" y=\"122\" font-family=\"Menlo, monospace\" font-size=\"18\" font-weight=\"400\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"start\">14-21 EK\u0130M 2026 ARASINDA YAYIMLANANLAR<\/text><path d=\"M80 250H1520\" stroke=\"#e8e5df\" stroke-width=\"3\"\/><circle cx=\"90\" cy=\"250\" r=\"12\" fill=\"#fff\" stroke=\"#f05a28\" stroke-width=\"5\"\/><text x=\"80\" y=\"205\" font-family=\"Menlo, monospace\" font-size=\"22\" font-weight=\"700\" letter-spacing=\"2\" fill=\"#171717\" text-anchor=\"start\">14 EK\u0130<\/text><text x=\"80\" y=\"320\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">ISC, BIND 9 i\u00e7in<\/text><text x=\"80\" y=\"352\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">erken bildirim<\/text><circle cx=\"380\" cy=\"250\" r=\"12\" fill=\"#fff\" stroke=\"#f05a28\" stroke-width=\"5\"\/><text x=\"370\" y=\"205\" font-family=\"Menlo, monospace\" font-size=\"22\" font-weight=\"700\" letter-spacing=\"2\" fill=\"#171717\" text-anchor=\"start\">17 EK\u0130<\/text><text x=\"370\" y=\"320\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">eMudhra anahtar olay\u0131<\/text><text x=\"370\" y=\"352\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">bildirildi, Chrome<\/text><text x=\"370\" y=\"384\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">engelledi<\/text><circle cx=\"670\" cy=\"250\" r=\"12\" fill=\"#fff\" stroke=\"#f05a28\" stroke-width=\"5\"\/><text x=\"660\" y=\"205\" font-family=\"Menlo, monospace\" font-size=\"22\" font-weight=\"700\" letter-spacing=\"2\" fill=\"#171717\" text-anchor=\"start\">19 EK\u0130<\/text><text x=\"660\" y=\"320\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Apple eMudhra ara<\/text><text x=\"660\" y=\"352\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">sertifikalar\u0131n\u0131 engelledi<\/text><circle cx=\"960\" cy=\"250\" r=\"12\" fill=\"#fff\" stroke=\"#f05a28\" stroke-width=\"5\"\/><text x=\"950\" y=\"205\" font-family=\"Menlo, monospace\" font-size=\"22\" font-weight=\"700\" letter-spacing=\"2\" fill=\"#171717\" text-anchor=\"start\">20 EK\u0130<\/text><text x=\"950\" y=\"320\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Oracle Ekim CPU,<\/text><text x=\"950\" y=\"352\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Microsoft eMudhra&#x27;y\u0131<\/text><text x=\"950\" y=\"384\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">engelledi<\/text><circle cx=\"1250\" cy=\"250\" r=\"16\" fill=\"#f05a28\" stroke=\"#f05a28\" stroke-width=\"5\"\/><text x=\"1240\" y=\"205\" font-family=\"Menlo, monospace\" font-size=\"22\" font-weight=\"700\" letter-spacing=\"2\" fill=\"#f05a28\" text-anchor=\"start\">21 EK\u0130<\/text><text x=\"1240\" y=\"320\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">BIND 9.20.30<\/text><text x=\"1240\" y=\"352\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Node.js 22.23.4,<\/text><text x=\"1240\" y=\"384\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">24.22.1, 26.12.1<\/text><text x=\"1240\" y=\"416\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Java CVE-2026-91403<\/text><path d=\"M1250 250H1520\" stroke=\"#f05a28\" stroke-width=\"7\"\/><text x=\"80\" y=\"520\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"400\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"start\">KAYNAK: ISC, MOZILLA, NODEJS.ORG, ORACLE<\/text><\/svg><figcaption>14-21 Ekim 2026 zaman \u00e7izelgesi: BIND, eMudhra, Oracle, Node.js ve Java<\/figcaption><\/figure>\n<p>ISC, BIND sorunlar\u0131n\u0131 14 Ekim&#8217;de m\u00fc\u015fterilerine erken bildirimle iletti. 17 Ekim&#8217;de bir ara\u015ft\u0131rmac\u0131 Mozilla&#8217;ya sekiz eMudhra ara CA anahtar\u0131n\u0131n ele ge\u00e7irildi\u011fini bildirdi; Chrome ayn\u0131 g\u00fcn engelledi, Apple 19&#8217;unda, Microsoft 20&#8217;sinde onu izledi. Oracle, Ekim Critical Patch Update&#8217;ini 20 Ekim&#8217;de yay\u0131mlad\u0131. 21 Ekim&#8217;de ISC BIND bildirimlerini yay\u0131mlad\u0131, Node.js 22.23.4, 24.22.1 ve 26.12.1&#8217;i \u00e7\u0131kard\u0131, Oracle Java i\u00e7in CVE-2026-91403 g\u00fcvenlik uyar\u0131s\u0131n\u0131 yay\u0131mlad\u0131 ve eMudhra zay\u0131f anahtarlarla ilgili a\u00e7\u0131klamas\u0131n\u0131 yapt\u0131.<\/p>\n<h2>BIND 9: d\u00f6rt y\u00fcksek \u00f6nem dereceli d\u00fczeltme<\/h2>\n<div class=\"table-wrap\">\n<table>\n<thead>\n<tr>\n<th>CVE<\/th>\n<th>Sorun<\/th>\n<th>Puan<\/th>\n<th>Kim a\u00e7\u0131kta<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>CVE-2026-94300<\/td>\n<td>E\u015fzamanl\u0131 GSS-TSIG mesajlar\u0131 belle\u011fi bozuyor; \u00e7\u00f6kme ya da olas\u0131 uzaktan kod \u00e7al\u0131\u015ft\u0131rma<\/td>\n<td>8.1<\/td>\n<td>GSS-TSIG kabul eden sunucular; genellikle Active Directory ya da Kerberos ile entegre dinamik g\u00fcncellemeler<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-19630<\/td>\n<td>\u00d6zel haz\u0131rlanm\u0131\u015f gelen mesajlar orant\u0131s\u0131z CPU ve bellek t\u00fcketimine yol a\u00e7\u0131yor<\/td>\n<td>7.5<\/td>\n<td>\u00c7\u00f6z\u00fcmleyiciler (resolver)<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-97313<\/td>\n<td>Baz\u0131 RPZ yap\u0131land\u0131rmalar\u0131 ve sorgu kal\u0131plar\u0131 assertion hatas\u0131n\u0131 tetikliyor<\/td>\n<td>Y\u00fcksek<\/td>\n<td>RPZ kullanan \u00f6zyinelemeli sunucular<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-96888<\/td>\n<td>Kat\u0131 QNAME minimizasyonu ile redirect b\u00f6lgesi \u00e7\u00f6kmeye yol a\u00e7abiliyor<\/td>\n<td>Y\u00fcksek<\/td>\n<td>Bu yap\u0131land\u0131rmaya sahip \u00e7\u00f6z\u00fcmleyiciler<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Puanlanan iki sorun i\u00e7in etkilenen aral\u0131klar 9.11.0 ile 9.18.50, 9.20.0 ile 9.20.29 ve 9.21.0 ile 9.21.26 aras\u0131. D\u00fczeltilmi\u015f s\u00fcr\u00fcmler 9.20.30 ve 9.21.27; ISC, GSS-TSIG hatas\u0131 i\u00e7in ge\u00e7ici \u00e7\u00f6z\u00fcm listelemiyor. 9.18 dal\u0131n\u0131n \u00f6mr\u00fc doldu, yani ana yol 9.20&#8217;ye ge\u00e7mek. ISC aktif bir istismardan haberdar olmad\u0131\u011f\u0131n\u0131 belirtti.<\/p>\n<p>Kurumsal da\u011f\u0131t\u0131mlar eski BIND s\u00fcr\u00fcmlerini kendi geriye ta\u015f\u0131d\u0131klar\u0131 yamalarla da\u011f\u0131t\u0131r; bu y\u00fczden ana s\u00fcr\u00fcm numaras\u0131 \u00f6l\u00e7\u00fct de\u011fildir. Bu CVE numaralar\u0131 i\u00e7in da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n errata kay\u0131tlar\u0131na ve paket de\u011fi\u015fiklik g\u00fcnl\u00fc\u011f\u00fcne bak\u0131n.<\/p>\n<h2>Node.js ve Java: g\u00fcven zinciri de de\u011fi\u015fti<\/h2>\n<p>Node.js s\u00fcr\u00fcm\u00fc d\u00f6rd\u00fc y\u00fcksek \u00f6nem dereceli on CVE&#8217;yi kapatt\u0131 ve g\u00f6m\u00fcl\u00fc c-ares, OpenSSL, Undici ve CA sertifika deposunu g\u00fcncelledi. CA de\u011fi\u015fikli\u011fi ele ge\u00e7irilen eMudhra ara sertifikalar\u0131n\u0131 kald\u0131r\u0131yor; bu \u00f6nemli, \u00e7\u00fcnk\u00fc Node.js varsay\u0131lan olarak i\u015fletim sisteminin de\u011fil, kendi g\u00f6m\u00fcl\u00fc k\u00f6k sertifikalar\u0131n\u0131 kullan\u0131r.<\/p>\n<p>Java&#8217;da da durum ayn\u0131. Oracle&#8217;\u0131n Ekim Critical Patch Update&#8217;i 55 Java SE d\u00fczeltmesi i\u00e7eriyordu ve bunlar\u0131n 49&#8217;u kimlik do\u011frulamas\u0131 olmadan uzaktan istismar edilebilir nitelikteydi. Bir g\u00fcn sonra Oracle, JSSE bile\u015feni i\u00e7in 9.1 puanl\u0131 CVE-2026-91403 g\u00fcvenlik uyar\u0131s\u0131n\u0131 yay\u0131mlad\u0131; bu bile\u015fen, ele ge\u00e7irilen eMudhra ara sertifikalar\u0131ndan gelen sertifikalar\u0131 kabul etmeye devam edebiliyordu. Haberlerde Ekim g\u00fcncellemesiyle gelen derlemeler de etkilenenler aras\u0131nda say\u0131l\u0131yor; yani \u00fc\u00e7 ayl\u0131k g\u00fcncellemeyi 20 Ekim&#8217;de kurmu\u015f bir sunucunun uyar\u0131 d\u00fczeltmesine de ihtiyac\u0131 var.<\/p>\n<p>Bir BIND s\u00fcr\u00fcm\u00fcn\u00fc bildirimlerle kar\u015f\u0131la\u015ft\u0131r\u0131n:<\/p>\n<div class=\"gitm-widget\" data-widget=\"bind\"><\/div>\n<h2>Bir BIND sunucusunun hangi rol\u00fc \u00fcstlendi\u011fi nas\u0131l anla\u015f\u0131l\u0131r?<\/h2>\n<p>BIND bildirimleri role g\u00f6re ayr\u0131\u015f\u0131yor, bu y\u00fczden her sunucu i\u00e7in ilk soru ne i\u015f yapt\u0131\u011f\u0131. <code>named-checkconf -p<\/code> etkin yap\u0131land\u0131rmay\u0131 yazd\u0131r\u0131r: <code>allow-recursion<\/code> listesiyle birlikte bir <code>recursion yes;<\/code> sunucunun istemciler i\u00e7in ad \u00e7\u00f6z\u00fcmledi\u011fi anlam\u0131na gelir, <code>primary<\/code> ya da <code>secondary<\/code> t\u00fcr\u00fcndeki zone tan\u0131mlar\u0131 sunucunun yetkili oldu\u011funu g\u00f6sterir ve bir\u00e7ok sunucu ikisini birden yapar. GSS-TSIG, <code>tkey-gssapi-keytab<\/code> ya da <code>tkey-gssapi-credential<\/code> se\u00e7ene\u011fi olarak g\u00f6r\u00fcn\u00fcr; genellikle yan\u0131nda Kerberos principal&#8217;lar\u0131na kay\u0131t g\u00fcncelleme hakk\u0131 veren bir <code>update-policy<\/code> bulunur.<\/p>\n<p><code>allow-recursion<\/code> ayar\u0131 a\u00e7\u0131k b\u0131rak\u0131lm\u0131\u015f bir \u00e7\u00f6z\u00fcmleyici, CVE-2026-19630 i\u00e7in en k\u00f6t\u00fc durumdur, \u00e7\u00fcnk\u00fc ona sorgu g\u00f6nderebilen herkes kaynak t\u00fcketimini tetikleyebilir. \u00d6zyinelemeyi kendi a\u011flar\u0131n\u0131zla s\u0131n\u0131rlamak hatay\u0131 d\u00fczeltmez, ama y\u00fckseltme tamamlanana kadar ona ula\u015fabilecek ki\u015filerin say\u0131s\u0131n\u0131 daralt\u0131r.<\/p>\n<h2>Her g\u00fcven deposunda eMudhra ara sertifikalar\u0131 nas\u0131l kontrol edilir?<\/h2>\n<p>Her depo farkl\u0131 bir komuta yan\u0131t verir. \u0130\u015fletim sistemi paketi, Red Hat ailesi sistemlerde <code>trust list | grep -i emsign<\/code> ile listelenebilir. Bir JDK&#8217;n\u0131n kendi deposu <code>keytool -list -cacerts<\/code> ile okunur ve ayn\u0131 \u015fekilde filtrelenir. Node.js k\u00f6k sertifikalar\u0131n\u0131 ikili dosyan\u0131n i\u00e7inde tutar, bu y\u00fczden en h\u0131zl\u0131 kontrol \u00e7al\u0131\u015fma ortam\u0131n\u0131n 22.23.4, 24.22.1 ya da 26.12.1 s\u00fcr\u00fcm\u00fcnde oldu\u011funu do\u011frulamakt\u0131r; g\u00f6m\u00fcl\u00fc deposu g\u00fcncellenen derlemeler bunlard\u0131r.<\/p>\n<p>\u0130ki uyar\u0131. Listede emSign adl\u0131 bir k\u00f6k kayd\u0131n bulunmas\u0131, ele ge\u00e7irilmi\u015f bir ara sertifikayla ayn\u0131 \u015fey de\u011fildir; engellenen sertifikalar ara sertifikalard\u0131 ve bir\u00e7ok proje bunlar\u0131 yeni bir k\u00f6k listesi yay\u0131mlayarak de\u011fil, g\u00fcvenini kald\u0131rarak ya da silerek ele ald\u0131. Bu y\u00fczden elle bir \u015fey silmeden \u00f6nce sa\u011flay\u0131c\u0131n\u0131z\u0131n duyurusunu okuyun. Ayr\u0131ca bir servis, de\u011fi\u015fen depoyu ancak yeniden ba\u015flad\u0131\u011f\u0131nda devreye al\u0131r.<\/p>\n<h2>Bir cPanel sunucusundan saha notu<\/h2>\n<p>cPanel sunucular\u0131m\u0131zdan birinde <code>bind<\/code> paketi kurulu; s\u00fcr\u00fcm\u00fc 9.11.36&#8217;n\u0131n Red Hat geriye ta\u015f\u0131mal\u0131 bir derlemesi. Ama sunucu bu BIND a\u00e7\u0131klar\u0131na a\u00e7\u0131k de\u011fil: cPanel PowerDNS kullanacak \u015fekilde yap\u0131land\u0131r\u0131lm\u0131\u015f ve <code>named<\/code> \u00e7al\u0131\u015fm\u0131yor. Paket, ara\u00e7lar\u0131 i\u00e7in orada. Ders \u015fu: acil bir y\u00fckseltme planlamadan \u00f6nce paket listesine de\u011fil servise bak\u0131n, paketi de yine g\u00fcncel tutun ki bir g\u00fcn a\u00e7\u0131kta kalan o olmas\u0131n.<\/p>\n<h2>\u00dc\u00e7 s\u00fcr\u00fcm birbirine nas\u0131l ba\u011flan\u0131yor?<\/h2>\n<p>Her sa\u011flay\u0131c\u0131n\u0131n s\u00fcr\u00fcm\u00fcn\u00fc ayr\u0131 bir ticket olarak ele almak cazip gelir. Pratikte ise ortak bir ba\u011f\u0131ml\u0131l\u0131klar\u0131 (TLS g\u00fcven zinciri) ve ortak bir k\u0131s\u0131tlar\u0131 (yeniden ba\u015flatmalar) var. BIND, DNS taraf\u0131nda ayr\u0131 duruyor; ama Java ve Node.js servisleriyle ayn\u0131 bak\u0131m penceresinde y\u00fckseltilip yeniden ba\u015flat\u0131lan bir \u00e7\u00f6z\u00fcmleyici, ikinci bir de\u011fi\u015fiklik onay\u0131 turundan ve panelleri izleyerek ge\u00e7en ikinci bir geceden kurtar\u0131r.<\/p>\n<p>Bizim izledi\u011fimiz s\u0131ra \u015f\u00f6yle: \u00f6nce DNS, \u00e7\u00fcnk\u00fc di\u011fer t\u00fcm servisler ad \u00e7\u00f6z\u00fcmlemeye ba\u011fl\u0131d\u0131r ve bozuk bir \u00e7\u00f6z\u00fcmleyici sonraki her sorunu gizler; ard\u0131ndan i\u015fletim sistemi g\u00fcven paketi; sonra \u00e7al\u0131\u015fma ortamlar\u0131, her birinin ard\u0131ndan onu kullanan servislerin yeniden ba\u015flat\u0131lmas\u0131yla; en son da sunucular\u0131n kendilerinin sundu\u011fu sertifikalar\u0131n kontrol\u00fc. Her ad\u0131m\u0131n kendi do\u011frulamas\u0131 vard\u0131r ve bir sonraki ad\u0131m ancak \u00f6nceki temiz \u00e7\u0131kt\u0131\u011f\u0131nda ba\u015flar.<\/p>\n<h2>Java, uygulamalar\u0131 bozmadan nas\u0131l g\u00fcncellenir?<\/h2>\n<p>Java, belirli bir derlemeye en s\u0131k sabitlenen \u00e7al\u0131\u015fma ortam\u0131d\u0131r; ya tek bir s\u00fcr\u00fcm\u00fc sertifikaland\u0131ran bir sa\u011flay\u0131c\u0131 y\u00fcz\u00fcnden ya da kendi JRE&#8217;siyle paketlenmi\u015f bir uygulama y\u00fcz\u00fcnden. Bu da envanteri i\u015fin zor k\u0131sm\u0131 yapar. Uygulama dizinlerinin alt\u0131ndaki kopyalar dahil sunucudaki her <code>java<\/code> ikili dosyas\u0131n\u0131 aray\u0131n ve hangilerinin i\u015fletim sistemi taraf\u0131ndan y\u00f6netildi\u011fini, hangilerinin bir \u00fcr\u00fcn\u00fcn i\u00e7inde geldi\u011fini not edin.<\/p>\n<p>Y\u00f6netilen kopyalarda Ekim g\u00fcncellemesini ve CVE-2026-91403 d\u00fczeltmesini uygulay\u0131n, servisleri yeniden ba\u015flat\u0131n ve ilk bir saat boyunca g\u00fcnl\u00fcklerinde TLS el s\u0131k\u0131\u015fma hatalar\u0131n\u0131 izleyin; g\u00fcven deposu de\u011fi\u015fikli\u011fi ilk orada kendini g\u00f6sterir. \u00dcr\u00fcnle birlikte gelen kopyalarda ise \u00e7al\u0131\u015fma ortam\u0131n\u0131 \u00fcr\u00fcn\u00fcn alt\u0131ndan de\u011fi\u015ftirmek yerine sa\u011flay\u0131c\u0131dan uyar\u0131 d\u00fczeltmesini i\u00e7eren bir derleme isteyin, \u00e7\u00fcnk\u00fc bu de\u011fi\u015fiklik \u00fcr\u00fcn\u00fcn deste\u011fini ge\u00e7ersiz k\u0131labilir. Sa\u011flay\u0131c\u0131n\u0131n yan\u0131t\u0131n\u0131 ve tarihini kaydedin ki istisnan\u0131n bir sahibi ve bir biti\u015fi olsun.<\/p>\n<h2>Sunucular\u0131n\u0131zda yapman\u0131z gerekenler<\/h2>\n<ol class=\"checklist\">\n<li><strong>Her named&#8217;i bulun.<\/strong> Her sunucuda <code>systemctl is-active named<\/code> ve <code>named -v<\/code> \u00e7al\u0131\u015ft\u0131r\u0131n; yetkili sunucu mu, \u00e7\u00f6z\u00fcmleyici mi, ikisi birden mi oldu\u011funu ve GSS-TSIG kabul edip etmedi\u011fini not edin.<\/li>\n<li><strong>BIND&#8217;i y\u00fckseltin.<\/strong> 9.20.30 ya da 9.21.27&#8217;ye ya da da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n d\u00fczeltilmi\u015f paketine ge\u00e7in ve <code>named<\/code>&#8216;i yeniden ba\u015flat\u0131n. \u00d6nceli\u011fi \u00e7\u00f6z\u00fcmleyicilere ve GSS-TSIG dinamik g\u00fcncellemelerini kabul eden sunuculara verin.<\/li>\n<li><strong>9.18 ve \u00f6ncesini emekliye ay\u0131r\u0131n.<\/strong> Bunlar ISC&#8217;den GSS-TSIG d\u00fczeltmesini almayacak.<\/li>\n<li><strong>Her g\u00fcven deposunu g\u00fcncelleyin.<\/strong> \u0130\u015fletim sistemi paketi (<code>ca-certificates<\/code>), kurulu her JDK&#8217;n\u0131n <code>cacerts<\/code> dosyas\u0131 ve Node.js&#8217;in g\u00f6m\u00fcl\u00fc k\u00f6k sertifikalar\u0131 birbirinden ayr\u0131. Birini g\u00fcncellemek di\u011ferlerini g\u00fcncellemez.<\/li>\n<li><strong>Java envanteri \u00e7\u0131kar\u0131n.<\/strong> Uygulamalarla birlikte gelen kopyalar dahil sunucudaki her JDK ve JRE&#8217;yi listeleyin; hem Ekim g\u00fcncellemesini hem de CVE-2026-91403 uyar\u0131 d\u00fczeltmesini uygulay\u0131n.<\/li>\n<li><strong>Node.js&#8217;i g\u00fcncelleyin.<\/strong> 22.23.4, 24.22.1 ya da 26.12.1; paneller, derleme ara\u00e7lar\u0131 ve s\u00fcre\u00e7 y\u00f6neticilerinin kulland\u0131\u011f\u0131 kopyalar dahil.<\/li>\n<li><strong>Servisleri yeniden ba\u015flat\u0131n.<\/strong> Java ve Node.js s\u00fcre\u00e7leri yeniden ba\u015flayana kadar eski \u00e7al\u0131\u015fma ortam\u0131n\u0131 ve g\u00fcven deposunu bellekte tutar.<\/li>\n<li><strong>Kendi sertifikalar\u0131n\u0131z\u0131 kontrol edin.<\/strong> Sundu\u011funuz herhangi bir sertifika bir eMudhra ara sertifikas\u0131na ba\u011flan\u0131yorsa, istemciler ona g\u00fcvenmeyi b\u0131rakmadan \u00f6nce ba\u015fka bir CA&#8217;dan yeniden ald\u0131r\u0131n.<\/li>\n<\/ol>\n<p>Ayn\u0131 ay\u0131n ba\u015f\u0131nda PHP, acil PHP2Shell s\u00fcr\u00fcm\u00fcn\u00fc yay\u0131mlam\u0131\u015ft\u0131; bunu <a href=\"\/blog\/php2shell-yama-gunu-php-nodejs-cloudlinux-cpanel-rehberi\/\">PHP2Shell yama g\u00fcn\u00fc rehberinde<\/a> ele ald\u0131k. Sunucu s\u0131k\u0131la\u015ft\u0131rman\u0131n \u00e7ekirdek taraf\u0131 ise <a href=\"\/blog\/paylasimli-linux-sunucu-cekirdek-sikilastirma-bes-ayar\/\">payla\u015f\u0131ml\u0131 bir Linux sunucu i\u00e7in be\u015f \u00e7ekirdek ayar\u0131<\/a> yaz\u0131s\u0131nda.<\/p>\n<h2>K\u0131saca<\/h2>\n<p>Haftan\u0131n s\u00fcr\u00fcmleri birbiriyle ilgisiz \u00fc\u00e7 ticket gibi g\u00f6r\u00fcn\u00fcyordu, ama g\u00fcven ve yeniden ba\u015flatmalarla ilgili tek bir i\u015f oldu\u011fu ortaya \u00e7\u0131kt\u0131. \u00d6nce DNS&#8217;i, sonra g\u00fcven paketlerini, sonra \u00e7al\u0131\u015fma ortamlar\u0131n\u0131 ele al\u0131n, her birini kendi do\u011frulamas\u0131yla; en sonda da kendi sunucular\u0131n\u0131z\u0131n sundu\u011fu sertifikalar\u0131 kontrol ederek bitirin. Eme\u011fin b\u00fcy\u00fck k\u0131sm\u0131 envanterdir: hangi sunucularda <code>named<\/code> \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, hangi JDK&#8217;lar\u0131n nerede bulundu\u011funu ve hangi s\u00fcre\u00e7lerin h\u00e2l\u00e2 bellekte eski bir \u00e7al\u0131\u015fma ortam\u0131 tuttu\u011funu bilmek. Bir sonraki b\u00f6yle haftay\u0131 k\u0131saltan da yine bu envanterdir.<\/p>\n<h2 id=\"faq-nodejs-bind-java-ekim-2026\">SSS: Node.js, BIND ve Java g\u00fcvenlik s\u00fcr\u00fcmleri, Ekim 2026<\/h2>\n<h3 id=\"faq-bind-cve-2026-94300-kimler-etkileniyor\">Ekim 2026&#8217;da duyurulan CVE-2026-94300 a\u00e7\u0131\u011f\u0131 hangi BIND sunucular\u0131n\u0131 etkiliyor?<\/h3>\n<p>BIND 9.11.0 ile 9.18.50, 9.20.0 ile 9.20.29 ya da 9.21.0 ile 9.21.26 aras\u0131 bir s\u00fcr\u00fcm \u00e7al\u0131\u015ft\u0131ran ve GSS-TSIG mesajlar\u0131n\u0131 kabul eden sunucular; bu genellikle Kerberos ya da Active Directory dinamik g\u00fcncellemeleri i\u00e7indir. ISC ge\u00e7ici \u00e7\u00f6z\u00fcm listelemiyor, dolay\u0131s\u0131yla \u00e7\u00f6z\u00fcm 9.20.30, 9.21.27 ya da yamal\u0131 bir sa\u011flay\u0131c\u0131 paketidir.<\/p>\n<h3 id=\"faq-bind-918-omur-sonu-duzeltme\">BIND 9.18, Ekim 2026 GSS-TSIG d\u00fczeltmesini ISC&#8217;den alacak m\u0131?<\/h3>\n<p>Hay\u0131r. 9.18 dal\u0131n\u0131n \u00f6mr\u00fc doldu ve GSS-TSIG d\u00fczeltmesini ana projeden alm\u0131yor. 9.20&#8217;ye ge\u00e7in ya da d\u00fczeltmeyi kendi BIND paketine geriye ta\u015f\u0131yan ve bunu errata kay\u0131tlar\u0131nda belirten bir da\u011f\u0131t\u0131m kullan\u0131n.<\/p>\n<h3 id=\"faq-bind-cozumleyici-ile-yetkili-sunucu-riski\">BIND \u00e7\u00f6z\u00fcmleyici mi yetkili sunucu mu: Ekim 2026 d\u00fczeltmelerinde hangisi daha fazla risk ta\u015f\u0131yor?<\/h3>\n<p>Riskin b\u00fcy\u00fck k\u0131sm\u0131n\u0131 \u00e7\u00f6z\u00fcmleyiciler ta\u015f\u0131yor. CVE-2026-19630 ile RPZ ve redirect b\u00f6lgesi \u00e7\u00f6kmeleri \u00f6zyinelemeli sunucular\u0131 ilgilendiriyor, CVE-2026-94300 ise role de\u011fil GSS-TSIG&#8217;e ba\u011fl\u0131. \u0130kisini birden yapan bir sunucu \u00f6nce y\u00fckseltilmeli.<\/p>\n<h3 id=\"faq-bind-paketi-kurulu-named-calismiyor\">bind paketi kurulu ama named \u00e7al\u0131\u015fm\u0131yorsa sunucu a\u00e7\u0131kta m\u0131?<\/h3>\n<p>Bu a\u011f hatalar\u0131na kar\u015f\u0131 de\u011fil, \u00e7\u00fcnk\u00fc dinleyen bir \u015fey yok. <code>systemctl is-active named<\/code> ile kontrol edin. Paketi yine de g\u00fcncel tutun, \u00e7\u00fcnk\u00fc ileride yap\u0131lacak bir yap\u0131land\u0131rma de\u011fi\u015fikli\u011fi servisi eski bir derlemeyle ba\u015flatabilir.<\/p>\n<h3 id=\"faq-emudhra-ne-oldu-2026\">Ekim 2026&#8217;da eMudhra ara sertifika otoritelerinin sertifikalar\u0131na ne oldu?<\/h3>\n<p>Bir ara\u015ft\u0131rmac\u0131 17 Ekim&#8217;de sekiz eMudhra ara CA&#8217;s\u0131n\u0131n \u00f6zel anahtarlar\u0131n\u0131n ele ge\u00e7irildi\u011fini bildirdi. eMudhra, bir anahtar \u00fcretme kusurunun zay\u0131f anahtarlar \u00fcretti\u011fini a\u00e7\u0131klad\u0131. Taray\u0131c\u0131lar ara sertifikalar\u0131 17 ile 20 Ekim aras\u0131nda engelledi, Node.js ve Java da g\u00fcncellemelerle onlar\u0131 izledi.<\/p>\n<h3 id=\"faq-java-cpu-ile-guvenlik-uyarisi\">Java Ekim CPU mu CVE-2026-91403 g\u00fcvenlik uyar\u0131s\u0131 m\u0131: sunucular\u0131n ikisine de ihtiyac\u0131 var m\u0131?<\/h3>\n<p>Evet. 20 Ekim tarihli Critical Patch Update 55 Java SE d\u00fczeltmesi i\u00e7eriyordu, 21 Ekim tarihli uyar\u0131 ise JSSE&#8217;deki eMudhra g\u00fcven sorununu ele ald\u0131. Haberlerde Ekim g\u00fcncellemesindeki derlemeler de etkilenenler aras\u0131nda say\u0131l\u0131yor, bu y\u00fczden uyar\u0131n\u0131n belirtti\u011fi derlemeyi kurun.<\/p>\n<h3 id=\"faq-node-sistem-ca-deposu\">Node.js, bir Linux sunucuda i\u015fletim sisteminin sertifika deposunu kullan\u0131r m\u0131?<\/h3>\n<p>Varsay\u0131lan olarak hay\u0131r. Node.js, <code>--use-system-ca<\/code> ile ba\u015flat\u0131lmad\u0131k\u00e7a ya da kendisine ek sertifikalar verilmedik\u00e7e ikili dosyaya derlenmi\u015f bir CA listesine g\u00fcvenir; bu y\u00fczden yaln\u0131zca <code>ca-certificates<\/code> paketini g\u00fcncellemek bir Node.js servisinin neye g\u00fcvendi\u011fini de\u011fi\u015ftirmez.<\/p>\n<h3 id=\"faq-node-ekim-2026-duzeltilmis-surumler\">Ekim 2026 g\u00fcvenlik d\u00fczeltmeleri hangi Node.js s\u00fcr\u00fcmlerinde bulunuyor?<\/h3>\n<p>21 Ekim 2026&#8217;da yay\u0131mlanan Node.js 22.23.4, 24.22.1 ve 26.12.1. Bu s\u00fcr\u00fcmler d\u00f6rd\u00fc y\u00fcksek \u00f6nem dereceli on CVE&#8217;yi d\u00fczeltiyor ve g\u00f6m\u00fcl\u00fc c-ares, OpenSSL, Undici ve CA deposunu g\u00fcncelliyor. Node.js 20 ve \u00f6ncesi bunlar\u0131n hi\u00e7birini alm\u0131yor.<\/p>\n<h3 id=\"faq-emudhra-sertifikasi-yeniden-alma\">eMudhra ara sertifikas\u0131 alt\u0131nda verilmi\u015f bir web sitesi sertifikas\u0131n\u0131 yeniden ald\u0131rmak gerekir mi?<\/h3>\n<p>Evet, etkilenen ara sertifikalardan birine ba\u011flan\u0131yorsa. Bunlar\u0131 zaten engellemi\u015f istemciler sertifikay\u0131 reddedecektir; bu y\u00fczden daha fazla istemci g\u00fcncellenip ziyaret\u00e7iler hata g\u00f6rmeye ba\u015flamadan \u00f6nce sertifikay\u0131 ba\u015fka bir CA&#8217;dan al\u0131nm\u0131\u015f bir sertifikayla de\u011fi\u015ftirin.<\/p>\n<h3 id=\"faq-guven-deposu-sonrasi-yeniden-baslatma\">ca-certificates ya da bir JDK g\u00fcncellendikten sonra \u00e7al\u0131\u015fan servisler yeni g\u00fcven deposunu al\u0131r m\u0131?<\/h3>\n<p>Hay\u0131r. Java ve Node.js s\u00fcre\u00e7leri g\u00fcven depolar\u0131n\u0131 ba\u015flang\u0131\u00e7ta y\u00fckler ve yeniden ba\u015flayana kadar tutar; uzun s\u00fcre \u00e7al\u0131\u015fan bir\u00e7ok servis de ayn\u0131 \u015fekilde davran\u0131r. G\u00fcncellemeden sonra onlar\u0131 yeniden ba\u015flat\u0131n, yoksa eski g\u00fcven kararlar\u0131 ge\u00e7erli kalmaya devam eder.<\/p>\n<h2>Kaynaklar<\/h2>\n<ul class=\"sources\">\n<li><a href=\"https:\/\/kb.isc.org\/docs\/cve-2026-94300\" rel=\"noopener\" target=\"_blank\">CVE-2026-94300<\/a> ve <a href=\"https:\/\/kb.isc.org\/docs\/cve-2026-19630\" rel=\"noopener\" target=\"_blank\">CVE-2026-19630<\/a>, ISC Knowledge Base<\/li>\n<li><a href=\"https:\/\/kb.isc.org\/docs\/cve-2026-97313\" rel=\"noopener\" target=\"_blank\">CVE-2026-97313<\/a>, ISC Knowledge Base<\/li>\n<li><a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" rel=\"noopener\" target=\"_blank\">Ekim 2026 g\u00fcvenlik s\u00fcr\u00fcmleri<\/a>, nodejs.org<\/li>\n<li><a href=\"https:\/\/www.tenable.com\/blog\/oracle-october-2026-critical-patch-update-addresses-1209-cves\" rel=\"noopener\" target=\"_blank\">Oracle Ekim 2026 Critical Patch Update<\/a>, Tenable<\/li>\n<li><a href=\"https:\/\/www.csoonline.com\/article\/4238338\/google-mozilla-revoke-emudhra-intermediates-after-private-key-compromise.html\" rel=\"noopener\" target=\"_blank\">Google ve Mozilla eMudhra ara sertifikalar\u0131n\u0131 iptal etti<\/a>, CSO Online<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>14 ile 21 Ekim 2026 aras\u0131nda ISC d\u00f6rt y\u00fcksek \u00f6nem dereceli BIND 9 a\u00e7\u0131\u011f\u0131n\u0131 kapatt\u0131, Oracle \u00fc\u00e7 ayl\u0131k Java g\u00fcncellemesini ve ola\u011fan d\u0131\u015f\u0131 bir uyar\u0131y\u0131 yay\u0131mlad\u0131, Node.js on d\u00fczeltme \u00e7\u0131kard\u0131 ve sekiz eMudhra ara sertifika otoritesi anahtarlar\u0131 ele ge\u00e7irildi\u011fi i\u00e7in engellendi. Nelerin de\u011fi\u015fti\u011fi ve bunlar\u0131 \u00e7al\u0131\u015ft\u0131ran sunucularda yap\u0131lmas\u0131 gerekenler.<\/p>\n","protected":false},"author":0,"featured_media":41,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[14,31,15,19,17,16,3,32,30],"class_list":["post-20","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-bind-9","tag-ca-sertifikalari","tag-cve-2026-94300","tag-dns","tag-emudhra","tag-java","tag-node-js","tag-sunucu-guvenligi","tag-yama-yonetimi"],"_links":{"self":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/20","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/comments?post=20"}],"version-history":[{"count":2,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/20\/revisions"}],"predecessor-version":[{"id":49,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/20\/revisions\/49"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/media\/41"}],"wp:attachment":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/media?parent=20"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/categories?post=20"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/tags?post=20"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}