{"id":54,"date":"2026-10-29T09:18:06","date_gmt":"2026-10-29T09:18:06","guid":{"rendered":"https:\/\/adnancanturk.com\/blog\/ekim-2026-aciklari-bir-hafta-sonra-durum-raporu\/"},"modified":"2026-10-29T09:18:06","modified_gmt":"2026-10-29T09:18:06","slug":"ekim-2026-aciklari-bir-hafta-sonra-durum-raporu","status":"publish","type":"post","link":"https:\/\/adnancanturk.com\/blog\/ekim-2026-aciklari-bir-hafta-sonra-durum-raporu\/","title":{"rendered":"Ekim 2026 a\u00e7\u0131klar\u0131 bir hafta sonra: neler istismar edildi, kim yamalad\u0131 ve h\u00e2l\u00e2 ne a\u00e7\u0131k"},"content":{"rendered":"<p class=\"lead\">20 Ekim 2026 haftas\u0131, \u00e7o\u011fu \u00e7eyre\u011fin toplam\u0131ndan daha fazla g\u00fcvenlik i\u015fi \u00e7\u0131kard\u0131: acil bir PHP s\u00fcr\u00fcm\u00fc, bir Node.js s\u00fcr\u00fcm\u00fc, d\u00f6rt BIND d\u00fczeltmesi, Java i\u00e7in bir Oracle g\u00fcncellemesi ve uyar\u0131s\u0131, ele ge\u00e7irilmi\u015f bir sertifika otoritesi ve d\u00fczeltmeleri \u00e7\u0131kmadan kamuya a\u00e7\u0131lan bir dizi Linux \u00e7ekirde\u011fi raporu. Bir hafta sonra tablo de\u011fi\u015fti. Bunlardan birinin istismar edildi\u011fi art\u0131k do\u011fruland\u0131, birka\u00e7 \u00fcretici yamas\u0131 yay\u0131mland\u0131 ve birka\u00e7 bo\u015fluk h\u00e2l\u00e2 a\u00e7\u0131k. Bu yaz\u0131 29 Ekim 2026 itibar\u0131yla durumu a\u00e7\u0131k a\u00e7\u0131k ele al\u0131yor: her birinin ne yapt\u0131\u011f\u0131, d\u00fczeltmelerin bar\u0131nd\u0131rma altyap\u0131s\u0131n\u0131n her katman\u0131nda nerede oldu\u011fu ve hem sunucu hem uygulama taraf\u0131nda ne yap\u0131lmas\u0131 gerekti\u011fi.<\/p>\n<div class=\"tldr\">\n<p class=\"tldr-label\">TL;DR<\/p>\n<ul>\n<li>PHP2Shell, 26 Ekim&#8217;den beri CISA&#8217;n\u0131n Bilinen \u0130stismar Edilmi\u015f A\u00e7\u0131klar listesinde; mod_php kullanan bir kuruluma kar\u015f\u0131 istismar bildirildi. B\u00fcy\u00fck bar\u0131nd\u0131rma \u00fcreticilerinin hepsi d\u00fczeltme yay\u0131mlad\u0131; dikkat \u00e7eken bo\u015fluk RHEL 9&#8217;un php:8.4 mod\u00fcl\u00fc.<\/li>\n<li>Ayr\u0131 ve h\u00e2l\u00e2 yamalanmam\u0131\u015f bir PHP sorunu olan CVE-2026-115560 nedeniyle, yamal\u0131 sunucularda bile <code>session.upload_progress.enabled = 0<\/code> ayar\u0131n\u0131 korumak mant\u0131kl\u0131.<\/li>\n<li>BIND 9.20.30 Ekim sorunlar\u0131n\u0131 ana projede d\u00fczeltiyor, ancak RHEL, AlmaLinux ve Ubuntu paketleri 29 Ekim&#8217;de h\u00e2l\u00e2 d\u00fczeltilmemi\u015fti.<\/li>\n<li>Node.js 28 Ekim&#8217;de 24.22.2 ve 26.13.0 takip s\u00fcr\u00fcmlerini yay\u0131mlad\u0131; Docker imajlar\u0131 yeniden derlendi ve cPanel&#8217;in ea-nodejs22 paketi 22.23.4&#8217;te.<\/li>\n<li>S\u0131zan \u00e7ekirdek raporlar\u0131n\u0131n h\u00e2l\u00e2 CVE numaras\u0131 yok. AlmaLinux 28 Ekim&#8217;de yamal\u0131 \u00e7ekirdekleri yay\u0131mlad\u0131, KernelCare canl\u0131 yamalar\u0131 EL10 ve EL9 i\u00e7in \u00e7\u0131kt\u0131, s\u0131rada EL8 var.<\/li>\n<\/ul>\n<\/div>\n<h2>Her sorun \u015fu anda ne durumda?<\/h2>\n<figure class=\"wp-block-image size-full gitm-figure\"><svg role=\"img\" aria-label=\"29 Ekim 2026 itibar\u0131yla Ekim 2026 a\u00e7\u0131klar\u0131n\u0131n durum matrisi: istismar, ana proje d\u00fczeltmesi, bar\u0131nd\u0131rma \u00fcreticileri ve da\u011f\u0131t\u0131mlar\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 1600 800\"><rect width=\"1600\" height=\"800\" fill=\"#fff\"\/><text x=\"80\" y=\"80\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"40\" font-weight=\"700\" letter-spacing=\"-1.5\" fill=\"#171717\" text-anchor=\"start\">Ekim 2026 a\u00e7\u0131klar\u0131, bir hafta sonra<\/text><text x=\"80\" y=\"122\" font-family=\"Menlo, monospace\" font-size=\"18\" font-weight=\"400\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"start\">29 EK\u0130M 2026 \u0130T\u0130BARIYLA DURUM<\/text><text x=\"560\" y=\"190\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"600\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"middle\">\u0130ST\u0130SMAR?<\/text><text x=\"820\" y=\"190\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"600\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"middle\">ANA PROJE<\/text><text x=\"1080\" y=\"190\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"600\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"middle\">BARINDIRMA<\/text><text x=\"1340\" y=\"190\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"600\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"middle\">DA\u011eITIMLAR<\/text><line x1=\"80\" y1=\"214\" x2=\"1520\" y2=\"214\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"80\" y=\"268\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">PHP2Shell<\/text><rect x=\"486.5\" y=\"240\" width=\"147\" height=\"36\" rx=\"18\" fill=\"#c62828\" fill-opacity=\"0.12\" stroke=\"#c62828\" stroke-width=\"2\"\/><text x=\"560\" y=\"264\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#c62828\" text-anchor=\"middle\">EVET, KEV<\/text><rect x=\"740.0\" y=\"240\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"820\" y=\"264\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><rect x=\"1000.0\" y=\"240\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"1080\" y=\"264\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><rect x=\"1280.0\" y=\"240\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"1340\" y=\"264\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">KISMEN<\/text><line x1=\"80\" y1=\"306\" x2=\"1520\" y2=\"306\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"80\" y=\"360\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Node.js<\/text><rect x=\"486.5\" y=\"332\" width=\"147\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"560\" y=\"356\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">RAPOR YOK<\/text><rect x=\"740.0\" y=\"332\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"820\" y=\"356\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><rect x=\"1000.0\" y=\"332\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"1080\" y=\"356\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><rect x=\"1260.0\" y=\"332\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"1340\" y=\"356\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><line x1=\"80\" y1=\"398\" x2=\"1520\" y2=\"398\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"80\" y=\"452\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">BIND 9<\/text><rect x=\"486.5\" y=\"424\" width=\"147\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"560\" y=\"448\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">RAPOR YOK<\/text><rect x=\"740.0\" y=\"424\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"820\" y=\"448\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><rect x=\"1020.0\" y=\"424\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#9aa3ab\" fill-opacity=\"0.12\" stroke=\"#9aa3ab\" stroke-width=\"2\"\/><text x=\"1080\" y=\"448\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#9aa3ab\" text-anchor=\"middle\">YOK<\/text><rect x=\"1280.0\" y=\"424\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#c62828\" fill-opacity=\"0.12\" stroke=\"#c62828\" stroke-width=\"2\"\/><text x=\"1340\" y=\"448\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#c62828\" text-anchor=\"middle\">A\u00c7IK<\/text><line x1=\"80\" y1=\"490\" x2=\"1520\" y2=\"490\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"80\" y=\"544\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">Java \/ eMudhra<\/text><rect x=\"467.0\" y=\"516\" width=\"186\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"560\" y=\"540\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">\u0130PTAL ED\u0130LD\u0130<\/text><rect x=\"740.0\" y=\"516\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#1f9d55\" fill-opacity=\"0.12\" stroke=\"#1f9d55\" stroke-width=\"2\"\/><text x=\"820\" y=\"540\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#1f9d55\" text-anchor=\"middle\">D\u00dcZELT\u0130LD\u0130<\/text><rect x=\"1020.0\" y=\"516\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"1080\" y=\"540\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">KISMEN<\/text><rect x=\"1280.0\" y=\"516\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"1340\" y=\"540\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">KISMEN<\/text><line x1=\"80\" y1=\"582\" x2=\"1520\" y2=\"582\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"80\" y=\"636\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">\u00c7ekirdek raporlar\u0131<\/text><rect x=\"493.0\" y=\"608\" width=\"134\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"560\" y=\"632\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">A\u00c7IK POC<\/text><rect x=\"740.0\" y=\"608\" width=\"160\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"820\" y=\"632\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">G\u00d6NDER\u0130LD\u0130<\/text><rect x=\"1020.0\" y=\"608\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"1080\" y=\"632\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">KISMEN<\/text><rect x=\"1280.0\" y=\"608\" width=\"120\" height=\"36\" rx=\"18\" fill=\"#d68a00\" fill-opacity=\"0.12\" stroke=\"#d68a00\" stroke-width=\"2\"\/><text x=\"1340\" y=\"632\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"1\" fill=\"#d68a00\" text-anchor=\"middle\">KISMEN<\/text><line x1=\"80\" y1=\"674\" x2=\"1520\" y2=\"674\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"80\" y=\"760\" font-family=\"Menlo, monospace\" font-size=\"14\" font-weight=\"400\" letter-spacing=\"1\" fill=\"#858585\" text-anchor=\"start\">KAYNAK: CISA, PHP.NET, NODEJS.ORG, ISC, ORACLE, CLOUDLINUX, CPANEL, RED HAT, ALMALINUX, TUXCARE<\/text><\/svg><figcaption>29 Ekim 2026 itibar\u0131yla Ekim 2026 a\u00e7\u0131klar\u0131n\u0131n durum matrisi: istismar, ana proje d\u00fczeltmesi, bar\u0131nd\u0131rma \u00fcreticileri ve da\u011f\u0131t\u0131mlar<\/figcaption><\/figure>\n<div class=\"table-wrap\">\n<table>\n<thead>\n<tr>\n<th>Sorun<\/th>\n<th>\u0130stismar edildi mi?<\/th>\n<th>Ana proje d\u00fczeltmesi<\/th>\n<th>Bar\u0131nd\u0131rma \u00fcreticileri<\/th>\n<th>29 Ekim&#8217;de a\u00e7\u0131k kalan bo\u015fluklar<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>PHP2Shell (CVE-2026-109618, CVE-2026-109619)<\/td>\n<td>Evet, 26 Ekim&#8217;den beri CISA KEV&#8217;de<\/td>\n<td>8.2.35, 8.3.36, 8.4.27, 8.5.12<\/td>\n<td>cPanel, CloudLinux, Imunify360, AlmaLinux, Debian, Ubuntu yay\u0131mlad\u0131<\/td>\n<td>RHEL 9 php:8.4, CloudLinux 6 alt-php, CVE-2026-115560<\/td>\n<\/tr>\n<tr>\n<td>Node.js (CVE-2026-111497 ve dokuz tane daha)<\/td>\n<td>Bildirim yok<\/td>\n<td>22.23.4, 24.22.1, 26.12.1; takip s\u00fcr\u00fcmleri 24.22.2, 26.13.0<\/td>\n<td>Docker imajlar\u0131 yeniden derlendi, cPanel ea-nodejs22 g\u00fcncellendi<\/td>\n<td>22.23.4&#8217;ten sonra yeni 22.x yok<\/td>\n<\/tr>\n<tr>\n<td>BIND 9 (CVE-2026-94300 ve \u00fc\u00e7 tane daha)<\/td>\n<td>Bildirim yok<\/td>\n<td>9.20.30, 9.21.27<\/td>\n<td>Debian trixie d\u00fczeltildi<\/td>\n<td>RHEL, AlmaLinux, Ubuntu, Debian bookworm d\u00fczeltilmedi<\/td>\n<\/tr>\n<tr>\n<td>Java (CVE-2026-91403) ve eMudhra<\/td>\n<td>Ara sertifikalar iptal edildi<\/td>\n<td>Oracle, Temurin 17\/21\/25, Corretto derlemeleri<\/td>\n<td>AlmaLinux, Debian, Ubuntu ca-certificates g\u00fcncellendi<\/td>\n<td>RHEL OpenJDK d\u00fczeltmesi ertelendi, Temurin 8 ve 11<\/td>\n<\/tr>\n<tr>\n<td>S\u0131zan \u00e7ekirdek raporlar\u0131<\/td>\n<td>Herkese a\u00e7\u0131k kavram kan\u0131t\u0131 var, ger\u00e7ek ortamda istismar bildirimi yok<\/td>\n<td>Yama netdev&#8217;e g\u00f6nderildi, birle\u015ftirme do\u011frulanmad\u0131<\/td>\n<td>AlmaLinux \u00e7ekirdekleri, KernelCare EL10 ve EL9<\/td>\n<td>CVE numaras\u0131 yok, KernelCare EL8, CloudLinux 8 ve 9 derlemeleri<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2>PHP2Shell: ne yap\u0131yor ve \u015fu anda ne durumda?<\/h2>\n<p>PHP2Shell, PHP&#8217;nin istek i\u015fleme kodundaki iki bellek g\u00fcvenli\u011fi hatas\u0131 olan CVE-2026-109618 ve CVE-2026-109619&#8217;un ad\u0131; ikisi de CVSS v4.0&#8217;da 9.2 puan ald\u0131. Kimlik do\u011frulamas\u0131 gerektirmeyen bir istek, PHP girdiyi hen\u00fcz ayr\u0131\u015ft\u0131r\u0131rken, yani herhangi bir uygulama kodu \u00e7al\u0131\u015fmadan \u00f6nce bu hatalar\u0131 tetikleyebiliyor; sertle\u015ftirilmi\u015f bir WordPress&#8217;in ya da kat\u0131 bir framework&#8217;\u00fcn koruma sa\u011flamamas\u0131n\u0131n nedeni bu. T\u00fcm web SAPI&#8217;leri etkileniyor ve PHP duyurusu en y\u00fcksek riski mod_php kullanan Apache&#8217;ye veriyor.<\/p>\n<p>Durum 26 Ekim&#8217;de de\u011fi\u015fti: CISA iki CVE&#8217;yi de Bilinen \u0130stismar Edilmi\u015f A\u00e7\u0131klar katalo\u011funa ekledi ve ABD federal kurumlar\u0131 i\u00e7in 29 Ekim&#8217;i d\u00fczeltme son tarihi olarak belirledi. Ara\u015ft\u0131rmac\u0131lar, PHP 8.4.26 \u00fczerinde mod_php ile Apache \u00e7al\u0131\u015ft\u0131ran bir tuzak sisteme (honeypot) kar\u015f\u0131 ba\u015far\u0131l\u0131 istismar bildirdi ve herkese a\u00e7\u0131k istismar kodu dola\u015f\u0131mda. PHP projesi 23 Ekim&#8217;de ayr\u0131ca oturum y\u00fckleme ilerlemesi (session upload progress) \u00f6zelli\u011findeki ayr\u0131 bir sorun olan CVE-2026-115560 i\u00e7in bilgilendirme ama\u00e7l\u0131 bir duyuru yay\u0131mlad\u0131; Ekim s\u00fcr\u00fcmleri bu sorunu d\u00fczeltmiyor. Hafifletme y\u00f6ntemi, bir\u00e7ok sunucunun zaten ge\u00e7ici \u00f6nlem olarak kulland\u0131\u011f\u0131 ayar\u0131n ta kendisi: <code>session.upload_progress.enabled = 0<\/code>.<\/p>\n<h3>PHP2Shell i\u00e7in hangi \u00fcretici yamalar\u0131 yay\u0131mland\u0131?<\/h3>\n<p>Bar\u0131nd\u0131rma taraf\u0131nda da\u011f\u0131t\u0131m h\u0131zl\u0131 oldu. cPanel 21 Ekim&#8217;de ea-php74 ile ea-php85 aras\u0131n\u0131 d\u00fczelten EasyApache 4 25.91 s\u00fcr\u00fcm\u00fcn\u00fc yay\u0131mlad\u0131; buna ek olarak kendi dahili PHP&#8217;si i\u00e7in 138.0.18, 136.0.50, 134.0.66 ve 110.0.153 derlemelerinde bir cPanel ve WHM g\u00fcvenlik g\u00fcncellemesi \u00e7\u0131kard\u0131. CloudLinux ayn\u0131 ak\u015fam eski s\u00fcr\u00fcm numaralar\u0131n\u0131 koruyarak geriye ta\u015f\u0131nm\u0131\u015f ea-php52 ile ea-php85 aras\u0131 paketleri yay\u0131mlad\u0131, ard\u0131ndan 23 Ekim&#8217;de ea-php84 8.4.27-1 gibi php.net numaral\u0131 derlemeleri \u00e7\u0131kard\u0131. alt-php paketleri CloudLinux 7, 8 ve 9 i\u00e7in 22 Ekim&#8217;de, Ubuntu 22.04 \u00fczerindeki CloudLinux i\u00e7in 21 Ekim&#8217;de kararl\u0131 depolara ula\u015ft\u0131; CloudLinux 10 bunlar\u0131 TuxCare ELS deposundan al\u0131yor ve CloudLinux 6 do\u011frulanmam\u0131\u015f olarak listeleniyor.<\/p>\n<p>Imunify360, 21 ile 23 Ekim aras\u0131nda 8.83&#8217;ten 8.88&#8217;e kadar be\u015f WAF kural seti g\u00fcncellemesi yay\u0131mlad\u0131 ve 8.84&#8217;ten itibaren bu kurallar LiteSpeed \u00fczerinde de engelleme yap\u0131yor. CloudLinux, CVE-2026-109618&#8217;in bellek yetersizli\u011fi yolunu hi\u00e7bir kural\u0131n kapsamad\u0131\u011f\u0131n\u0131 a\u00e7\u0131k\u00e7a belirtiyor; dolay\u0131s\u0131yla kurallar bir d\u00fczeltme de\u011fil, ge\u00e7ici bir katman. Da\u011f\u0131t\u0131mlar aras\u0131nda Red Hat 21 Ekim&#8217;de RHEL 8, 9 ve 10 PHP ak\u0131\u015flar\u0131 i\u00e7in errata yay\u0131mlad\u0131 ve AlmaLinux bunlar\u0131 ayn\u0131 g\u00fcn aktard\u0131, Debian bookworm ve trixie&#8217;yi d\u00fczeltti, Ubuntu da desteklenen s\u00fcr\u00fcmleri i\u00e7in USN-8948-1&#8217;i yay\u0131mlad\u0131. \u0130stisna RHEL 9&#8217;un php:8.4 mod\u00fcl\u00fc; bu mod\u00fcl 29 Ekim&#8217;de h\u00e2l\u00e2 duyurusu olmadan etkilenen olarak listeleniyordu.<\/p>\n<h3>PHP2Shell i\u00e7in \u015fimdi ne yapmal\u0131s\u0131n\u0131z?<\/h3>\n<ul>\n<li><strong>Sunucu taraf\u0131.<\/strong> Her PHP derlemesini de\u011fi\u015fiklik g\u00fcnl\u00fc\u011f\u00fc ya da paket s\u00fcr\u00fcm\u00fcyle do\u011frulay\u0131n, PHP-FPM&#8217;i ve mod_php kullanan her Apache&#8217;yi yeniden ba\u015flat\u0131n ve CVE-2026-115560 nedeniyle <code>session.upload_progress.enabled = 0<\/code> ayar\u0131n\u0131 koruyun. php:8.4 kullanan RHEL 9&#8217;da yamal\u0131 bir ak\u0131\u015fa ge\u00e7in ya da Red Hat d\u00fczeltme yay\u0131mlayana kadar WAF kurallar\u0131n\u0131 yerinde tutun.<\/li>\n<li><strong>Uygulama taraf\u0131.<\/strong> PHP i\u00e7eren konteyner imajlar\u0131n\u0131 yeniden derleyin, kuyruk i\u015f\u00e7ilerini ve uzun s\u00fcre \u00e7al\u0131\u015fan sunucular\u0131 yeniden ba\u015flat\u0131n ve web k\u00f6k dizinlerinde Ekim ortas\u0131ndan beri olu\u015fturulmu\u015f, hi\u00e7bir da\u011f\u0131t\u0131mla a\u00e7\u0131klanamayan dosyalar\u0131 kontrol edin.<\/li>\n<\/ul>\n<p>Yama g\u00fcn\u00fc prosed\u00fcr\u00fcn\u00fcn tamam\u0131 <a href=\"\/blog\/php2shell-yama-gunu-php-nodejs-cloudlinux-cpanel-rehberi\/\">PHP2Shell yama g\u00fcn\u00fc rehberinde<\/a> yer al\u0131yor.<\/p>\n<h2>Node.js: 21 Ekim s\u00fcr\u00fcm\u00fcn\u00fcn ard\u0131ndan bir \u015fey geldi mi?<\/h2>\n<p>21 Ekim s\u00fcr\u00fcm\u00fc, Brotli \u00e7\u00f6z\u00fcc\u00fcs\u00fcnde uzaktan kod \u00e7al\u0131\u015ft\u0131rmaya izin verebilen bir s\u0131n\u0131r d\u0131\u015f\u0131 yazma hatas\u0131 olan CVE-2026-111497 dahil on CVE&#8217;yi d\u00fczeltti. Herhangi bir istismar bildirilmedi. A\u00e7\u0131klama sonras\u0131nda ortaya \u00e7\u0131kan bir kavram kan\u0131t\u0131n\u0131n, bildirildi\u011fine g\u00f6re yaln\u0131zca bilerek zay\u0131flat\u0131lm\u0131\u015f bir test derlemesinde kod \u00e7al\u0131\u015ft\u0131rmaya ula\u015ft\u0131\u011f\u0131 belirtiliyor. Ayn\u0131 Brotli hatas\u0131, \u00e7\u00f6z\u00fcc\u00fcy\u00fc i\u00e7inde bar\u0131nd\u0131ran ba\u015fka yaz\u0131l\u0131mlar\u0131 da etkiliyor; Microsoft 25 Ekim&#8217;de ola\u011fan takvim d\u0131\u015f\u0131nda .NET g\u00fcncellemeleri yay\u0131mlad\u0131, RHEL ve AlmaLinux&#8217;ta ise sistemdeki <code>brotli<\/code> k\u00fct\u00fcphanesi 26 Ekim&#8217;de errata ald\u0131.<\/p>\n<p>Node.js 28 Ekim&#8217;de iki takip s\u00fcr\u00fcm\u00fc yay\u0131mlad\u0131: V8 geri ta\u015f\u0131malar\u0131 ve bir stream d\u00fczeltmesi i\u00e7eren 24.22.2 ile 26 serisinin Lithium ad\u0131yla LTS d\u00f6nemini ba\u015flatan 26.13.0. 22.23.4&#8217;\u00fcn ard\u0131ndan yeni bir 22.x s\u00fcr\u00fcm\u00fc gelmedi. Docker&#8217;\u0131n resmi node imajlar\u0131 28 Ekim&#8217;de yeniden derlendi ve cPanel&#8217;in EasyApache 4 25.92 s\u00fcr\u00fcm\u00fc ea-nodejs22&#8217;yi 22.23.4&#8217;e ta\u015f\u0131d\u0131.<\/p>\n<ul>\n<li><strong>Sunucu taraf\u0131.<\/strong> cPanel&#8217;in ea-nodejs paketleri ve sistemdeki brotli k\u00fct\u00fcphanesi dahil her Node.js kopyas\u0131n\u0131 g\u00fcncelleyin, ard\u0131ndan servisleri ve s\u00fcre\u00e7 y\u00f6neticilerini yeniden ba\u015flat\u0131n.<\/li>\n<li><strong>Uygulama taraf\u0131.<\/strong> M\u00fcmk\u00fcn olan yerlerde 24.22.2 ya da 26.13.0&#8217;a ge\u00e7in, imajlar\u0131 28 Ekim etiketlerinden yeniden derleyin ve ihtiyac\u0131n\u0131z olmayan Brotli s\u0131k\u0131\u015ft\u0131rmal\u0131 istek g\u00f6vdelerini kabul etmekten ka\u00e7\u0131n\u0131n.<\/li>\n<\/ul>\n<h2>BIND: sunucular\u0131n \u00e7o\u011fu neden h\u00e2l\u00e2 bekliyor?<\/h2>\n<p>ISC&#8217;nin Ekim s\u00fcr\u00fcm\u00fc BIND 9&#8217;daki d\u00f6rt sorunu d\u00fczeltti; ba\u015f\u0131 \u00e7eken CVE-2026-94300, e\u015fzamanl\u0131 GSS-TSIG mesajlar\u0131ndan kaynaklanan, <code>named<\/code> s\u00fcrecini \u00e7\u00f6kertebilen ve potansiyel olarak kod \u00e7al\u0131\u015ft\u0131rmaya izin verebilen bir bellek bozulmas\u0131 ve ge\u00e7ici bir \u00e7\u00f6z\u00fcm\u00fc yok. Ana projedeki d\u00fczeltme 9.20.30 ya da 9.21.27. ISC aktif bir istismar bildirmedi ve o g\u00fcnden beri de bildirilen olmad\u0131.<\/p>\n<p>Bo\u015fluk da\u011f\u0131t\u0131mlarda. 29 Ekim&#8217;de Red Hat bind, bind9.16 ve bind9.18 paketlerini desteklenen her RHEL s\u00fcr\u00fcm\u00fcnde duyurusu olmadan etkilenen olarak listeliyordu, AlmaLinux&#8217;un BIND i\u00e7in bir erratas\u0131 yoktu ve Ubuntu bind9&#8217;u desteklenen t\u00fcm s\u00fcr\u00fcmlerde savunmas\u0131z olarak listeliyordu. Debian trixie&#8217;yi d\u00fczeltti, ancak bookworm&#8217;un 9.18 dal\u0131 h\u00e2l\u00e2 d\u00fczeltilmemi\u015fti. Red Hat&#8217;in \u00f6nerdi\u011fi hafifletme, GSS-TSIG gerekmeyen yerlerde <code>tkey-gssapi-keytab<\/code> ve <code>tkey-gssapi-credential<\/code> se\u00e7eneklerini kald\u0131rmak ya da 53 numaral\u0131 porta eri\u015fimi k\u0131s\u0131tlamak.<\/p>\n<p class=\"bind-widget-lead\">Bir BIND derlemesini ana projedeki s\u00fcr\u00fcm aral\u0131klar\u0131yla kar\u015f\u0131la\u015ft\u0131r\u0131n:<\/p>\n<div class=\"gitm-widget\" data-widget=\"bind\"><\/div>\n<ul>\n<li><strong>Sunucu taraf\u0131.<\/strong> \u00c7al\u0131\u015fan her <code>named<\/code> s\u00fcrecini bulun, kullanmad\u0131\u011f\u0131n\u0131z GSS-TSIG se\u00e7eneklerini kald\u0131r\u0131n, \u00f6zyinelemeyi (recursion) ve 53 numaral\u0131 portu kendi a\u011flar\u0131n\u0131zla s\u0131n\u0131rlay\u0131n ve \u00fcreticinizin errata duyurular\u0131n\u0131 takip edin.<\/li>\n<li><strong>Uygulama taraf\u0131.<\/strong> BIND&#8217;i geli\u015ftirme i\u00e7in ya da yard\u0131mc\u0131 (sidecar) \u00e7\u00f6z\u00fcmleyici olarak bir konteyner i\u00e7inde da\u011f\u0131t\u0131yorsan\u0131z, bir da\u011f\u0131t\u0131m paketini beklemek yerine 9.20.30 \u00fczerinde yeniden derleyin.<\/li>\n<\/ul>\n<h2>Java ve eMudhra: g\u00fcven sorunu kapand\u0131 m\u0131?<\/h2>\n<p>B\u00fcy\u00fck \u00f6l\u00e7\u00fcde. eMudhra ele ge\u00e7irilen sekiz ara sertifikan\u0131n tamam\u0131n\u0131 18 Ekim&#8217;de iptal etti ve Sectigo \u00e7apraz imzal\u0131 kopyalar\u0131n iptalini 19 Ekim&#8217;de tamamlad\u0131. Mozilla daha da ileri giderek emSign ECC Root CA &#8211; G3 k\u00f6k sertifikas\u0131n\u0131 kald\u0131rd\u0131; Chrome&#8217;un k\u00f6k deposundan ayn\u0131 k\u00f6k\u00fcn kald\u0131r\u0131lmas\u0131n\u0131n da 27 Ekim&#8217;e kadar t\u00fcm cihazlara ula\u015fmas\u0131 bekleniyordu. G3&#8217;e zincirlenen baz\u0131 me\u015fru sertifikalar art\u0131k do\u011frulanam\u0131yor ve eMudhra k\u00fcresel genel TLS i\u015finden \u00e7ekildi\u011fini duyurdu; bu nedenle sertifikalar\u0131n\u0131 kullanan sitelerin ba\u015fka bir sertifika otoritesine ge\u00e7mesi gerekiyor.<\/p>\n<p>Oracle&#8217;\u0131n CVE-2026-91403 G\u00fcvenlik Uyar\u0131s\u0131, d\u00fczeltilmi\u015f Java derlemeleri olarak 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 ve 27.0.1&#8217;i listeliyor. Eclipse Temurin 17, 21 ve 25&#8217;i 22 Ekim&#8217;de yay\u0131mlad\u0131, Amazon Corretto 23 Ekim&#8217;de yay\u0131mlad\u0131 ve 26 ile 27 Ekim&#8217;de yeniden derledi. Temurin 8 ve 11 derlemeleri 29 Ekim&#8217;de hen\u00fcz \u00e7\u0131kmam\u0131\u015ft\u0131 ve Red Hat OpenJDK d\u00fczeltmelerini ertelenmi\u015f olarak listeliyor. \u0130\u015fletim sistemi taraf\u0131nda AlmaLinux 22 ve 23 Ekim&#8217;de kritik ca-certificates errata yay\u0131mlad\u0131, Debian ve Ubuntu G3 k\u00f6k\u00fcn\u00fc kald\u0131rd\u0131, certifi de 18 Ekim&#8217;den itibaren birka\u00e7 s\u00fcr\u00fcm \u00e7\u0131kard\u0131.<\/p>\n<ul>\n<li><strong>Sunucu taraf\u0131.<\/strong> ca-certificates errata g\u00fcncellemelerini kurun, her JDK&#8217;y\u0131 g\u00fcncelleyin ve yeni g\u00fcven listelerini y\u00fcklemeleri i\u00e7in Java ve Node.js servislerini yeniden ba\u015flat\u0131n.<\/li>\n<li><strong>Uygulama taraf\u0131.<\/strong> certifi&#8217;yi g\u00fcncelleyin, uyar\u0131 listesinden bir Java derlemesine sabitlenin ve kendi sertifikalar\u0131n\u0131z\u0131n hi\u00e7birinin emSign ECC Root CA &#8211; G3&#8217;e zincirlenmedi\u011fini kontrol edin.<\/li>\n<\/ul>\n<p>G\u00fcven deposuyla ilgili arka plan <a href=\"\/blog\/nodejs-bind-java-ekim-2026-guvenlik-surumleri-sunucu-tarafi\/\">Node.js, BIND ve Java ayn\u0131 haftada<\/a> yaz\u0131s\u0131nda yer al\u0131yor.<\/p>\n<h2>S\u0131zan \u00e7ekirdek raporlar\u0131: neler d\u00fczeltildi?<\/h2>\n<p>20 ve 21 Ekim&#8217;de herkese a\u00e7\u0131k e-posta listelerine ula\u015fan be\u015f Linux \u00e7ekirde\u011fi raporunun 29 Ekim&#8217;de h\u00e2l\u00e2 CVE numaras\u0131 yoktu. Payla\u015f\u0131ml\u0131 sunucular i\u00e7in en \u00f6nemlisi olan, a\u011f kodundaki yerel yetki y\u00fckseltme a\u00e7\u0131\u011f\u0131n\u0131n d\u00fczeltmesi bir incelemeyle birlikte netdev listesine g\u00f6nderildi, ancak ana dala (mainline) birle\u015ftirildi\u011fi do\u011frulanmad\u0131. \u00c7ekirdek i\u00e7i SMB sunucusuyla (ksmbd) ilgili iki rapor, ksmbd&#8217;yi derlemeyen AlmaLinux, CloudLinux ve RHEL \u00e7ekirdeklerini etkilemiyor.<\/p>\n<p>\u00dcreticiler CVE&#8217;yi beklemedi. AlmaLinux 28 Ekim&#8217;de 8, 9 ve 10 s\u00fcr\u00fcmleri i\u00e7in yamal\u0131 \u00e7ekirdekleri RHEL&#8217;den \u00f6nce \u00fcretim depolar\u0131na \u00e7\u0131kard\u0131. TuxCare&#8217;in KernelCare&#8217;i EL10 i\u00e7in 23 Ekim&#8217;de, EL9 i\u00e7in 26 Ekim&#8217;de canl\u0131 yama yay\u0131mlad\u0131; EL8 yay\u0131ma haz\u0131r. CloudLinux&#8217;ta 26 Ekim&#8217;de CloudLinux 7 hybrid ve CloudLinux 8 \u00e7ekirdekleri beta a\u015famas\u0131ndayd\u0131, CloudLinux 10 i\u00e7in bir canl\u0131 yama vard\u0131 ve CloudLinux 9 derlemeleri AlmaLinux&#8217;u takip ediyordu. Yay\u0131mlad\u0131\u011f\u0131 hafifletme, <a href=\"\/blog\/paylasimli-linux-sunucu-cekirdek-sikilastirma-bes-ayar\/\">payla\u015f\u0131ml\u0131 bir Linux sunucu i\u00e7in be\u015f \u00e7ekirdek ayar\u0131<\/a> yaz\u0131s\u0131nda anlatt\u0131\u011f\u0131m\u0131z y\u00f6ntemle ayn\u0131: hi\u00e7bir \u015feyin ihtiya\u00e7 duymad\u0131\u011f\u0131 yerlerde <code>user.max_user_namespaces<\/code> de\u011ferini 0 yapmak.<\/p>\n<ul>\n<li><strong>Sunucu taraf\u0131.<\/strong> Namespace s\u0131n\u0131r\u0131n\u0131 yerinde tutun, KernelCare otomatik g\u00fcncellemesinin a\u00e7\u0131k oldu\u011funu do\u011frulay\u0131n, uygulanan yamay\u0131 <code>kcarectl --patch-info<\/code> ile kontrol edin ve yeniden ba\u015flatmay\u0131 yaln\u0131zca canl\u0131 yama uygulanamayan \u00e7ekirdekler i\u00e7in planlay\u0131n.<\/li>\n<li><strong>Uygulama taraf\u0131.<\/strong> Kullan\u0131c\u0131 namespace&#8217;lerine ihtiya\u00e7 duyan konteyner sunucular\u0131, yap\u0131land\u0131rma hafifletmesini kullanamad\u0131klar\u0131 i\u00e7in yeni \u00e7ekirde\u011fi ya da canl\u0131 yamay\u0131 ilk alanlar olmal\u0131.<\/li>\n<\/ul>\n<h2>Peki ya cPanel&#8217;in kendisi?<\/h2>\n<p>21 Ekim&#8217;deki PHP g\u00fcvenlik g\u00fcncellemesi d\u0131\u015f\u0131nda cPanel Ekim ay\u0131nda herhangi bir Targeted Security Release yay\u0131mlamad\u0131; en sonuncusu 29 Eyl\u00fcl&#8217;deydi. EasyApache 4 ay i\u00e7inde alt\u0131 s\u00fcr\u00fcm \u00e7\u0131kard\u0131; bunlar aras\u0131nda Apache 2.4.69 ve bir dizi g\u00fcvenlik d\u00fczeltmesi i\u00e7eren 2 Ekim tarihli 25.88 de var. Dolay\u0131s\u0131yla ay boyunca g\u00fcncellemeleri atlayan sunucularda eksik olan yaln\u0131zca PHP d\u00fczeltmesi de\u011fil.<\/p>\n<h2>Altyap\u0131n\u0131z\u0131n h\u00e2l\u00e2 hangi d\u00fczeltmelere ihtiyac\u0131 var?<\/h2>\n<p>Sunucunuzda \u00e7al\u0131\u015fanlar\u0131 i\u015faretleyin, ona ait a\u00e7\u0131k maddeleri g\u00f6r\u00fcn:<\/p>\n<div class=\"gitm-widget\" data-widget=\"oct-status\"><\/div>\n<h2>Sahadan bir not: bir hafta bizim sunucular\u0131m\u0131zda nas\u0131l ge\u00e7ti<\/h2>\n<p>CloudLinux 8 \u00e7al\u0131\u015ft\u0131ran cPanel sunucular\u0131m\u0131zda geriye ta\u015f\u0131nm\u0131\u015f ea-php paketleri 21 Ekim \u00f6\u011fleden sonra otomatik olarak kuruldu ve CloudLinux 23 Ekim&#8217;de php.net numaral\u0131 derlemeleri yay\u0131mlam\u0131\u015f olmas\u0131na ra\u011fmen, g\u00fcnler sonra kontrol etti\u011fimizde h\u00e2l\u00e2 geriye ta\u015f\u0131nm\u0131\u015f derlemelerdi. \u0130kisi de yamal\u0131; bunu kan\u0131tlayan de\u011fi\u015fiklik g\u00fcnl\u00fc\u011f\u00fc. Canl\u0131 yama durumu, komut sat\u0131r\u0131 \u00f6zetinden de\u011fil KernelCare yap\u0131land\u0131rmas\u0131ndan kontrol ediliyor ve 23 Ekim&#8217;de t\u00fcm filoya uygulad\u0131\u011f\u0131m\u0131z namespace s\u0131n\u0131r\u0131, EL8 canl\u0131 yamas\u0131 gelene kadar \u00e7ekirdek bo\u015flu\u011funu kapat\u0131yor. Hafta boyunca hi\u00e7bir \u015fey yeniden ba\u015flatma gerektirmedi.<\/p>\n<h2>K\u0131sacas\u0131<\/h2>\n<p>A\u00e7\u0131klamadan bir hafta sonra i\u015f, yama yapmaktan kalan bo\u015fluklar\u0131 kapatmaya kayd\u0131. PHP2Shell art\u0131k istismar edilen bir a\u00e7\u0131k ve h\u00e2l\u00e2 yamas\u0131z bir derleme \u00e7al\u0131\u015ft\u0131ran her sunucu acil olarak ele al\u0131nmal\u0131. BIND ve \u00e7ekirdek, h\u00e2l\u00e2 gelmekte olan da\u011f\u0131t\u0131m \u00fcreticisi paketlerine ve canl\u0131 yamalara ba\u011fl\u0131; bu y\u00fczden orada yap\u0131land\u0131rma hafifletmeleri daha \u00f6nemli. eMudhra de\u011fi\u015fiklikleri de ba\u015fka bir sertifika otoritesine ge\u00e7memi\u015f siteler i\u00e7in sertifika hatalar\u0131 olarak kar\u015f\u0131m\u0131za \u00e7\u0131kmaya devam edecek.<\/p>\n<h2 id=\"faq-ekim-2026-aciklari-bir-hafta-sonra\">SSS: Ekim 2026 a\u00e7\u0131klar\u0131 bir hafta sonra<\/h2>\n<h3 id=\"faq-php2shell-cisa-kev-istismar-2026\">PHP2Shell Ekim 2026&#8217;da ger\u00e7ek ortamda aktif olarak istismar ediliyor mu?<\/h3>\n<p>Evet. CISA, 26 Ekim 2026&#8217;da CVE-2026-109618 ve CVE-2026-109619&#8217;u Bilinen \u0130stismar Edilmi\u015f A\u00e7\u0131klar katalo\u011funa ekledi ve ara\u015ft\u0131rmac\u0131lar Apache mod_php kurulumuna kar\u015f\u0131 istismar bildirdi. Yamalanmam\u0131\u015f her PHP derlemesini acil olarak ele al\u0131n.<\/p>\n<h3 id=\"faq-cve-2026-115560-hafifletme\">CVE-2026-115560 nedir ve PHP2Shell s\u00fcr\u00fcmleriyle bu sorun da d\u00fczeltildi mi?<\/h3>\n<p>23 Ekim&#8217;de duyurulan ayr\u0131 bir oturum y\u00fckleme ilerlemesi sorunu ve 8.2.35, 8.3.36, 8.4.27 ya da 8.5.12 ile d\u00fczeltilmiyor. Bir sonraki ola\u011fan PHP s\u00fcr\u00fcm\u00fcne kadar <code>php.ini<\/code> dosyas\u0131nda ya da FPM havuzunda <code>session.upload_progress.enabled = 0<\/code> ayar\u0131n\u0131 koruyun.<\/p>\n<h3 id=\"faq-cloudlinux-alt-php-durumu\">Hangi CloudLinux s\u00fcr\u00fcmlerinde PHP2Shell i\u00e7in yamal\u0131 alt-php paketleri var?<\/h3>\n<p>CloudLinux 7, 8 ve 9&#8217;da 22 Ekim&#8217;den, Ubuntu 22.04 \u00fczerindeki CloudLinux&#8217;ta 21 Ekim&#8217;den beri kararl\u0131 depoda bulunuyor. CloudLinux 10 TuxCare ELS deposunu kullan\u0131yor ve CloudLinux 6 do\u011frulanmam\u0131\u015f olarak listeleniyor.<\/p>\n<h3 id=\"faq-cpanel-ea-php-mi-php-net-surumu-mu\">cPanel ea-php geri ta\u015f\u0131mas\u0131 m\u0131 php.net s\u00fcr\u00fcm\u00fc m\u00fc: hangi derlemenin yamal\u0131 oldu\u011funu nas\u0131l anlars\u0131n\u0131z?<\/h3>\n<p>Geriye ta\u015f\u0131nm\u0131\u015f derlemeler eski s\u00fcr\u00fcm numaras\u0131n\u0131 korur, \u00f6rne\u011fin ea-php84 8.4.26-2; sonraki derlemeler ise 8.4.27-1 gibi php.net numaralar\u0131n\u0131 kullan\u0131r. \u0130kisi de yamal\u0131; <code>php -v<\/code> \u00e7\u0131kt\u0131s\u0131na g\u00fcvenmek yerine paket de\u011fi\u015fiklik g\u00fcnl\u00fc\u011f\u00fcnde CVE numaralar\u0131n\u0131 kontrol edin.<\/p>\n<h3 id=\"faq-imunify360-php2shell-icin-yeterli-mi\">Imunify360 WAF kurallar\u0131 yamas\u0131z bir sunucuyu PHP2Shell&#8217;e kar\u015f\u0131 korumaya yeterli mi?<\/h3>\n<p>Hay\u0131r. 8.83&#8217;ten 8.88&#8217;e kadar olan kural setleri bilinen istismar ara\u00e7lar\u0131n\u0131 ve kal\u0131plar\u0131n\u0131 engelliyor, ancak CloudLinux CVE-2026-109618&#8217;in bellek yetersizli\u011fi yolunu hi\u00e7bir kural\u0131n kapsamad\u0131\u011f\u0131n\u0131 belirtiyor. Bunlar yama yaparken kullan\u0131lan ge\u00e7ici bir katman.<\/p>\n<h3 id=\"faq-bind-rhel-ubuntu-duzeltme-2026\">RHEL, AlmaLinux ve Ubuntu Ekim 2026 BIND d\u00fczeltmelerini ne zaman yay\u0131mlayacak?<\/h3>\n<p>29 Ekim 2026&#8217;ya kadar bir tarih a\u00e7\u0131klanmad\u0131; \u00fc\u00e7\u00fc de bind paketlerini etkilenen ya da savunmas\u0131z olarak listeliyordu. Yay\u0131mlanana kadar kullan\u0131lmayan GSS-TSIG se\u00e7eneklerini kald\u0131r\u0131n, \u00f6zyinelemeyi ve 53 numaral\u0131 portu g\u00fcvenilir a\u011flarla s\u0131n\u0131rlay\u0131n.<\/p>\n<h3 id=\"faq-node-24-22-2-mi-24-22-1-mi\">Node.js 24.22.2 mi 24.22.1 mi: sunucularda hangi s\u00fcr\u00fcm \u00e7al\u0131\u015ft\u0131r\u0131lmal\u0131?<\/h3>\n<p>24.22.2&#8217;yi \u00e7al\u0131\u015ft\u0131r\u0131n. 28 Ekim&#8217;de, g\u00fcvenlik d\u00fczeltmelerini ta\u015f\u0131yan 24.22.1&#8217;in \u00fczerine V8 geri ta\u015f\u0131malar\u0131 ve bir stream d\u00fczeltmesiyle yay\u0131mland\u0131. \u0130kisi de Ekim CVE d\u00fczeltmelerini i\u00e7eriyor; daha yeni derleme daha iyi bir ba\u015flang\u0131\u00e7 noktas\u0131.<\/p>\n<h3 id=\"faq-emudhra-g3-sertifika-hatalari\">eMudhra de\u011fi\u015fikliklerinden sonra baz\u0131 web siteleri neden sertifika hatas\u0131 g\u00f6steriyor?<\/h3>\n<p>\u00c7\u00fcnk\u00fc Mozilla ve Chrome emSign ECC Root CA &#8211; G3 k\u00f6k\u00fcn\u00fc kald\u0131rd\u0131; bu nedenle istemciler g\u00fcncellendik\u00e7e bu k\u00f6ke zincirlenen sertifikalar do\u011frulanam\u0131yor. eMudhra sertifikas\u0131 kullanan sitelerin ba\u015fka bir sertifika otoritesinden yeni sertifika almas\u0131 gerekiyor.<\/p>\n<h3 id=\"faq-cekirdek-zdi-cve-durumu\">S\u0131zan Ekim 2026 Linux \u00e7ekirde\u011fi raporlar\u0131na art\u0131k CVE numaras\u0131 atand\u0131 m\u0131?<\/h3>\n<p>29 Ekim 2026&#8217;ya kadar CVE numaras\u0131 atanmam\u0131\u015ft\u0131. \u00dcreticiler bunlar\u0131 ZDI rapor numaralar\u0131yla takip ediyor; AlmaLinux, TuxCare ve CloudLinux bir CVE beklemeden d\u00fczeltmeleri yay\u0131mlad\u0131 ya da haz\u0131rlad\u0131.<\/p>\n<h3 id=\"faq-kernelcare-yeniden-baslatma-gerekir-mi\">KernelCare kullanan sunucular\u0131n s\u0131zan \u00e7ekirdek hatas\u0131 d\u00fczeltmeleri i\u00e7in yeniden ba\u015flat\u0131lmas\u0131 gerekiyor mu?<\/h3>\n<p>Canl\u0131 yaman\u0131n bulundu\u011fu yerlerde hay\u0131r: EL10 ve EL9 canl\u0131 yama ald\u0131, EL8 ise yay\u0131ma haz\u0131rd\u0131. <code>kcarectl --patch-info<\/code> ile do\u011frulay\u0131n, otomatik g\u00fcncellemeyi a\u00e7\u0131k tutun ve yaln\u0131zca canl\u0131 yama uygulanamayan \u00e7ekirdekler i\u00e7in yeniden ba\u015flat\u0131n.<\/p>\n<h2>Kaynaklar<\/h2>\n<ul class=\"sources\">\n<li><a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" rel=\"noopener\" target=\"_blank\">Bilinen \u0130stismar Edilmi\u015f A\u00e7\u0131klar Katalo\u011fu<\/a>, CISA<\/li>\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php\" rel=\"noopener\" target=\"_blank\">PHP haber ar\u015fivi 2026<\/a>, php.net<\/li>\n<li><a href=\"https:\/\/blog.cloudlinux.com\/php-cve-2026-109618-and-cve-2026-109619\/\" rel=\"noopener\" target=\"_blank\">PHP CVE-2026-109618 ve CVE-2026-109619 durumu<\/a>, CloudLinux<\/li>\n<li><a href=\"https:\/\/docs.cpanel.net\/release-notes\/release-notes\/\" rel=\"noopener\" target=\"_blank\">S\u00fcr\u00fcm notlar\u0131<\/a>, cPanel<\/li>\n<li><a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" rel=\"noopener\" target=\"_blank\">Ekim 2026 g\u00fcvenlik s\u00fcr\u00fcmleri<\/a>, nodejs.org<\/li>\n<li><a href=\"https:\/\/kb.isc.org\/docs\/cve-2026-94300\" rel=\"noopener\" target=\"_blank\">CVE-2026-94300<\/a>, ISC<\/li>\n<li><a href=\"https:\/\/access.redhat.com\/security\/cve\/CVE-2026-94300\" rel=\"noopener\" target=\"_blank\">CVE-2026-94300<\/a>, Red Hat<\/li>\n<li><a href=\"https:\/\/blog.google\/security\/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates\/\" rel=\"noopener\" target=\"_blank\">Kullan\u0131c\u0131lar\u0131 ele ge\u00e7irilmi\u015f eMudhra ara sertifikalar\u0131ndan korumak<\/a>, Google<\/li>\n<li><a href=\"https:\/\/almalinux.org\/blog\/2026-10-23-zdi-can-33367\/\" rel=\"noopener\" target=\"_blank\">ZDI-CAN-33367 \u00e7ekirdek g\u00fcncellemesi<\/a>, AlmaLinux<\/li>\n<li><a href=\"https:\/\/tuxcare.com\/blog\/zdi-ksmbd-bugs-cve\/\" rel=\"noopener\" target=\"_blank\">ZDI \u00e7ekirdek raporlar\u0131 ve KernelCare durumu<\/a>, TuxCare<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell, Node.js ve BIND s\u00fcr\u00fcmleri, eMudhra sertifika otoritesinin ele ge\u00e7irilmesi ve s\u0131zan Linux \u00e7ekirde\u011fi raporlar\u0131ndan bir hafta sonra her birinin durumu: istismar, ana projedeki d\u00fczeltmeler, cPanel, CloudLinux ve da\u011f\u0131t\u0131m yamalar\u0131 ve h\u00e2l\u00e2 kapanmam\u0131\u015f bo\u015fluklar.<\/p>\n","protected":false},"author":0,"featured_media":55,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[14,37,12,6,17,25,3,10,32,30],"class_list":["post-54","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-bind-9","tag-cisa-kev","tag-cloudlinux","tag-cpanel","tag-emudhra","tag-kernelcare","tag-node-js","tag-php2shell","tag-sunucu-guvenligi","tag-yama-yonetimi"],"_links":{"self":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/54","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/comments?post=54"}],"version-history":[{"count":0,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/54\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/media\/55"}],"wp:attachment":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/media?parent=54"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/categories?post=54"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/tags?post=54"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}