{"id":1206,"date":"2026-10-22T11:13:45","date_gmt":"2026-10-22T11:13:45","guid":{"rendered":"https:\/\/serhatdiker.com\/?p=1206"},"modified":"2026-10-22T11:13:47","modified_gmt":"2026-10-22T11:13:47","slug":"php2shell-php-oom-use-after-free-teknik-analiz","status":"publish","type":"post","link":"https:\/\/serhatdiker.com\/index.php\/2026\/10\/22\/php2shell-php-oom-use-after-free-teknik-analiz\/","title":{"rendered":"PHP2Shell: OOM, Use-After-Free ve \u0130stekler Aras\u0131 Bellek G\u00fcvenli\u011fi"},"content":{"rendered":"\n

21 Ekim 2026’da yay\u0131mlanan PHP g\u00fcvenlik g\u00fcncellemeleri, PHP2Shell ad\u0131yla g\u00fcndeme gelen iki kritik a\u00e7\u0131\u011f\u0131 kapatt\u0131: CVE-2026-109618 ve CVE-2026-109619.<\/strong> \u0130kisi de uygun ko\u015fullarda kimlik do\u011frulama gerektirmeden uzaktan kod \u00e7al\u0131\u015ft\u0131rmaya ula\u015fabiliyor. CVSS v4.0 puanlar\u0131 9.2. Teknik tablo, tek bir hatal\u0131 endpoint’ten daha derin: istek belle\u011finin, hata i\u015fleme mekanizmas\u0131n\u0131n ve uzun ya\u015fayan worker durumunun birbirleriyle ili\u015fkisi bozuluyor. PHP Foundation duyurusu<\/a><\/p>\n\n\n\n

Ben bu olay\u0131 \u00fc\u00e7 s\u0131n\u0131r \u00fczerinden okuyorum: bir verinin ne zaman ge\u00e7erli say\u0131ld\u0131\u011f\u0131, ne kadar s\u00fcre ya\u015fad\u0131\u011f\u0131 ve hata olu\u015ftu\u011funda hangi kodun h\u00e2l\u00e2 \u00e7al\u0131\u015fmaya devam etti\u011fi. Bu s\u0131n\u0131rlar do\u011fru \u00e7izilmedi\u011finde, normalde yaln\u0131zca ba\u015far\u0131s\u0131z olmas\u0131 gereken bir HTTP iste\u011fi bellek g\u00fcvenli\u011fi problemine d\u00f6n\u00fc\u015febiliyor.<\/p>\n\n\n\n

Bilgi kesiti: 22 Ekim 2026. A\u015fa\u011f\u0131daki modeller a\u00e7\u0131klama ama\u00e7l\u0131d\u0131r; PHP kaynak kodundan al\u0131nm\u0131\u015f bir exploit veya birebir uygulama de\u011fildir. Ortama \u00f6zg\u00fc s\u00f6m\u00fcr\u00fclebilirlik ile g\u00fcncelleme gereklili\u011fini ayr\u0131 de\u011ferlendiriyorum.<\/em><\/p>\n\n\n\n

\u00d6nce operasyonel ger\u00e7ek: Hangi s\u00fcr\u00fcmler yamal\u0131?<\/h2>\n\n\n\n

Desteklenen dallar i\u00e7in 21 Ekim g\u00fcvenlik s\u00fcr\u00fcmleri \u015f\u00f6yle:<\/p>\n\n\n\n

PHP dal\u0131<\/th>Bu iki a\u00e7\u0131k i\u00e7in ilk yamal\u0131 s\u00fcr\u00fcm<\/th><\/tr><\/thead>
8.2<\/td>8.2.35<\/td><\/tr>
8.3<\/td>8.3.36<\/td><\/tr>
8.4<\/td>8.4.27<\/td><\/tr>
8.5<\/td>8.5.12<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Bu tablo upstream s\u00fcr\u00fcmleri g\u00f6steriyor. Da\u011f\u0131t\u0131m\u0131n\u0131z daha eski g\u00f6r\u00fcnen bir s\u00fcr\u00fcme g\u00fcvenlik d\u00fczeltmesini backport etmi\u015f olabilir; karar paket sa\u011flay\u0131c\u0131s\u0131n\u0131n bu iki CVE’yi kapatt\u0131\u011f\u0131n\u0131 belirten duyurusuyla verilmelidir. PHP 8.1 ve daha eski dallar i\u00e7in PHP projesinin normal g\u00fcvenlik deste\u011fi yok. Baz\u0131 eski dallara yay\u0131mlanan s\u0131n\u0131rl\u0131 kaynak yamalar\u0131, o dallar\u0131n yeniden desteklendi\u011fi anlam\u0131na gelmiyor. Resm\u00ee PHP g\u00fcvenlik duyurusu<\/a><\/p>\n\n\n\n

Bir g\u00fcncelleme kayd\u0131n\u0131 kapat\u0131rken arayaca\u011f\u0131m kan\u0131t yaln\u0131zca bir s\u00fcr\u00fcm ekran\u0131 olmaz: hangi paketin d\u00fczeltmeyi i\u00e7erdi\u011fi, hangi instance’lara da\u011f\u0131t\u0131ld\u0131\u011f\u0131 ve \u00e7al\u0131\u015fan s\u00fcre\u00e7lerin yeni binary ile ba\u015flad\u0131\u011f\u0131 birlikte do\u011frulanmal\u0131.<\/p>\n\n\n\n

\u0130stek biter, worker ya\u015famaya devam eder<\/h2>\n\n\n\n

Bir web runtime’\u0131n\u0131 yaln\u0131zca request \u2192 response<\/code> olarak d\u00fc\u015f\u00fcnmek eksik kal\u0131yor. Bellek sahipli\u011fi a\u00e7\u0131s\u0131ndan iki ayr\u0131 zaman \u00f6l\u00e7e\u011fi var: iste\u011fe ait nesnelerin \u00f6mr\u00fc ve o istekleri i\u015fleyen s\u00fcrecin \u00f6mr\u00fc.<\/p>\n\n\n\n

Worker \u00f6mr\u00fc\n  \u251c\u2500 \u0130stek A: ba\u015flat \u2192 ayr\u0131\u015ft\u0131r \u2192 uygulama \u2192 temizle\n  \u251c\u2500 \u0130stek B: ba\u015flat \u2192 ayr\u0131\u015ft\u0131r \u2192 uygulama \u2192 temizle\n  \u2514\u2500 \u0130stek C: ...\n\nG\u00fcvenlik invariant\u0131:\n\u0130stek belle\u011fi serbest b\u0131rak\u0131ld\u0131\u011f\u0131nda,\nworker i\u00e7inde o belle\u011fe kullan\u0131labilir referans kalmamal\u0131.<\/code><\/pre>\n\n\n\n
Buradaki invariant, sistemin her durumda do\u011fru kalmas\u0131 gereken \u00f6zelli\u011fi. Bir iste\u011fin hata vermesi bu s\u00f6zle\u015fmeyi ortadan kald\u0131rm\u0131yor. \u00d6zellikle hata yolu; yar\u0131m kalm\u0131\u015f nesneleri, daha \u00f6nce yay\u0131mlanm\u0131\u015f referanslar\u0131 ve s\u0131rayla \u00e7al\u0131\u015fmas\u0131 beklenen temizleme ad\u0131mlar\u0131n\u0131 hesaba katmal\u0131.<\/p>\n\n\n\n
Bu benim i\u00e7in kod incelemesinde \u00e7ok somut bir soruya d\u00f6n\u00fc\u015f\u00fcyor: Bu iki sat\u0131r\u0131n aras\u0131na bir ba\u015far\u0131s\u0131zl\u0131k koyarsam sistem hangi durumda kal\u0131r?<\/strong> Yaln\u0131zca fonksiyonun d\u00f6n\u00fc\u015f de\u011ferine bakmak yerine, o noktada kimlerin hangi veriye ula\u015fabildi\u011fine bakmak gerekiyor.<\/p>\n\n\n\n
CVE-2026-109618: OOM, neden yaln\u0131zca bir kapasite problemi de\u011fil?<\/h2>\n\n\n\n
\u0130lk a\u00e7\u0131kta PHP’nin bellek t\u00fckenmesi yolunda kulland\u0131\u011f\u0131 longjmp()<\/code>, y\u00fcr\u00fctmeyi verinin hen\u00fcz tam ba\u015flat\u0131lmad\u0131\u011f\u0131 bir noktadan \u00e7\u0131karabiliyor. Temizleme kodu daha sonra bu ge\u00e7ici durumu ge\u00e7erli veri gibi kullanabiliyor. Sorunu tetikleyen tahsisin, bozuk durumda kalan nesneyle do\u011frudan ili\u015fkili olmas\u0131 da gerekmiyor.<\/p>\n\n\n\n
Multipart ayr\u0131\u015ft\u0131rmada metadata maliyeti bu tabloyu a\u011f\u0131rla\u015ft\u0131rabiliyor: \u00e7ok say\u0131da par\u00e7a ba\u015fl\u0131\u011f\u0131 ve i\u00e7 i\u00e7e alan yap\u0131lar\u0131, a\u011fda ta\u015f\u0131nan boyuttan daha pahal\u0131 bir bellek temsili olu\u015fturabiliyor. Kullan\u0131labilir i\u00e7erik uzunlu\u011fu bulunmayan istekler de ilk boyut kontrol\u00fcn\u00fcn varsay\u0131mlar\u0131n\u0131 etkileyebiliyor.<\/p>\n\n\n\n
Yama, OOM an\u0131ndaki bu g\u00fcvensiz s\u0131\u00e7ramay\u0131 de\u011fi\u015ftiriyor: uygun VM g\u00fcvenli noktas\u0131nda geciktirilmi\u015f soft OOM; ikinci, daha y\u00fcksek e\u015fikte ise _exit()<\/code> ile hard OOM uygulan\u0131yor. B\u00f6ylece yar\u0131m durumun normal temizleme yolunda t\u00fcketilmesi \u00f6nleniyor. CVE-2026-109618 teknik duyurusu<\/a><\/p>\n\n\n\n
Bu tasar\u0131mdan \u00e7\u0131kard\u0131\u011f\u0131m m\u00fchendislik dersi \u015fu: kaynak s\u0131n\u0131r\u0131n\u0131 a\u015fan bir i\u015fi durdurmak ile onu g\u00fcvenli bir noktada durdurmak farkl\u0131 garantiler. Bir hata mekanizmas\u0131, ba\u015far\u0131s\u0131z i\u015flemi durdururken temizleme kodunun varsay\u0131mlar\u0131n\u0131 bozabiliyor. Dolay\u0131s\u0131yla hata y\u00f6netimi de sald\u0131r\u0131 y\u00fczeyinin bir par\u00e7as\u0131 olarak incelenmeli.<\/p>\n\n\n\n
CVE-2026-109619: Serbest b\u0131rak\u0131lan bellek, unutulmayan referans<\/h2>\n\n\n\n
\u0130kinci a\u00e7\u0131kta iste\u011fe ait durum, belle\u011fi serbest b\u0131rak\u0131ld\u0131ktan sonra worker i\u00e7inde referanslanabilir kalabiliyor. Ayn\u0131 worker’\u0131n sonraki iste\u011fi, normal ba\u015flatma o durumu s\u0131f\u0131rlamadan \u00f6nce referans\u0131 kullan\u0131rsa use-after-free olu\u015fuyor. Teknik duyuru bunu bir producer<\/em> ve consumer<\/em> ili\u015fkisiyle a\u00e7\u0131kl\u0131yor. FPM i\u00e7in uygulama y\u00fcr\u00fctmesiyle durum \u00fcreten ve sonraki istekte session upload progress ile t\u00fcketen bir yol da do\u011frulanm\u0131\u015f durumda. CVE-2026-109619 teknik duyurusu<\/a><\/p>\n\n\n\n
A\u015fa\u011f\u0131daki \u015fema, bellek sahipli\u011fini anlatan kavramsal bir model:<\/p>\n\n\n\n
\u0130stek A\n  request_state olu\u015ftur\n  worker_reference = request_state\n  beklenmeyen hata \u2192 referans\u0131 temizleyen ad\u0131m tamamlanamaz\n  istek belle\u011fi serbest b\u0131rak\u0131l\u0131r\n\nAyn\u0131 worker'daki istek B\n  erken \u00e7al\u0131\u015fan i\u015flem \u2192 worker_reference kullan\u0131l\u0131r\n  normal reset hen\u00fcz ger\u00e7ekle\u015fmemi\u015ftir\n\nSorun: referans var; referans\u0131n g\u00f6sterdi\u011fi nesnenin \u00f6mr\u00fc bitmi\u015f.<\/code><\/pre>\n\n\n\n
Burada yaln\u0131zca free()<\/code> \u00e7a\u011fr\u0131s\u0131n\u0131n do\u011frulu\u011funu sorgulamak yetmez. Belle\u011fin sahipli\u011fi de\u011fi\u015firken yay\u0131mlanm\u0131\u015f referanslar\u0131n da ge\u00e7ersizle\u015ftirilmesi gerekir. \u0130yi bir ya\u015fam d\u00f6ng\u00fcs\u00fc incelemesi; olu\u015fturma, g\u00f6r\u00fcn\u00fcr k\u0131lma, kullan\u0131m, s\u0131f\u0131rlama ve serbest b\u0131rakma ad\u0131mlar\u0131n\u0131n b\u00fct\u00fcn\u00fcne bakar.<\/p>\n\n\n\n
mod_php ile PHP-FPM neden ayn\u0131 de\u011ferlendirilmemeli?<\/h2>\n\n\n\n
PHP, web iste\u011fi kar\u015f\u0131layan FPM, mod_php, CGI, FrankenPHP ve LiteSpeed kurulumlar\u0131n\u0131n g\u00fcncellenmesini istiyor. \u00d6zellikle mod_php i\u00e7in uygulama kodu ba\u015flamadan tetiklenebilen kimlik do\u011frulamas\u0131z bir sald\u0131r\u0131 g\u00f6sterilmi\u015f durumda. Burada Laravel middleware’i veya WordPress giri\u015f kontrol\u00fc, runtime’\u0131n daha \u00f6nce i\u015fledi\u011fi veriye zaman\u0131nda m\u00fcdahale edemeyebilir. PHP’nin risk kapsam\u0131<\/a><\/p>\n\n\n\n
FPM’nin ba\u015flang\u0131\u00e7 ba\u015far\u0131s\u0131zl\u0131\u011f\u0131nda child s\u00fcreci sonland\u0131rmas\u0131, belirli bir mod_php ak\u0131\u015f\u0131n\u0131n aynen devam etmesini engelliyor. Bu davran\u0131\u015f b\u00fct\u00fcn uygulama ve extension yollar\u0131n\u0131 g\u00fcvenli yapm\u0131yor. OOM duyurusundaki kaynak analizi ile stale-state duyurusundaki do\u011frulanm\u0131\u015f FPM yolu ayn\u0131 kan\u0131t seviyesini ve ayn\u0131 ak\u0131\u015f\u0131 anlatm\u0131yor. OOM kapsam\u0131<\/a>, stale-state kapsam\u0131<\/a><\/p>\n\n\n\n
Benim de\u011ferlendirme matrisim bu nedenle tek bir \u201cPHP kullan\u0131l\u0131yor mu?\u201d s\u00fctunundan olu\u015fmaz:<\/p>\n\n\n\n
Boyut<\/th>Toplanacak kan\u0131t<\/th><\/tr><\/thead>
Runtime<\/td>\u00c7al\u0131\u015fan paket, sa\u011flay\u0131c\u0131 d\u00fczeltmesi, s\u00fcre\u00e7 ba\u015flang\u0131\u00e7 zaman\u0131<\/td><\/tr>
SAPI ve worker<\/td>mod_php\/FPM\/LSAPI, havuzlar, yeniden kullan\u0131m davran\u0131\u015f\u0131<\/td><\/tr>
\u0130stek yolu<\/td>Proxy’den PHP’ye ula\u015fan g\u00f6vde, etkin limitler, erken ayarlar<\/td><\/tr>
Uygulama<\/td>Upload\/import, callback, hata ve cleanup ak\u0131\u015flar\u0131<\/td><\/tr>
Yetki s\u0131n\u0131r\u0131<\/td>Worker’\u0131n okuyabildi\u011fi s\u0131rlar, yazabildi\u011fi dizinler, a\u011f eri\u015fimi<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
HTTP g\u00f6vde boyutu, heap maliyetinin \u00fcst s\u0131n\u0131r\u0131 de\u011fildir<\/h2>\n\n\n\n
G\u00f6vdeyi 8 MB ile s\u0131n\u0131rlamak, \u00e7al\u0131\u015fma belle\u011fini de 8 MB ile s\u0131n\u0131rlad\u0131\u011f\u0131m\u0131z anlam\u0131na gelmez. Bir parser; byte dizisini anahtarlar, de\u011ferler, diziler ve metadata nesnelerine d\u00f6n\u00fc\u015ft\u00fcr\u00fcrken yeni tahsisler yapar. Bunu analiz etmek i\u00e7in kulland\u0131\u011f\u0131m basit maliyet modeli \u015f\u00f6yle:<\/p>\n\n\n\n
M_toplam \u2248 B_g\u00f6vde\n         + N_alan \u00d7 C_alan\n         + N_ba\u015fl\u0131k \u00d7 C_ba\u015fl\u0131k\n         + M_i\u00e7_i\u00e7e_yap\u0131\n         + M_ge\u00e7ici_kopyalar<\/code><\/pre>\n\n\n\n
Bu bir PHP benchmark sonucu veya kesin heap form\u00fcl\u00fc de\u011fil; savunma tasarlarken sorulacak sorular\u0131 g\u00f6r\u00fcn\u00fcr k\u0131lan bir model. Ayn\u0131 byte b\u00fct\u00e7esi i\u00e7inde nesne say\u0131s\u0131 artabiliyorsa, yaln\u0131zca toplam boyutu \u00f6l\u00e7mek eksik bir kontrol olabilir. Ben bu y\u00fczden test plan\u0131na g\u00f6vde boyutunun yan\u0131nda alan say\u0131s\u0131n\u0131, ba\u015fl\u0131k say\u0131s\u0131n\u0131, derinli\u011fi ve ayr\u0131\u015ft\u0131rma sonras\u0131 bellek t\u00fcketimini de koyar\u0131m.<\/p>\n\n\n\n
Normal PHP yap\u0131land\u0131rmas\u0131nda post_max_size<\/code>, POST verisinin boyutunu; memory_limit<\/code> ise script’in tahsis edebilece\u011fi belle\u011fi s\u0131n\u0131rlar. Bu iki de\u011fer farkl\u0131 kaynaklar\u0131 \u00f6l\u00e7er. Konfig\u00fcrasyon ili\u015fkileri i\u00e7in PHP \u00e7ekirdek direktifleri belgesi<\/a> esas al\u0131nmal\u0131; bir limitin varl\u0131\u011f\u0131 ba\u015fka bir kayna\u011f\u0131n s\u0131n\u0131rland\u0131\u011f\u0131n\u0131 tek ba\u015f\u0131na kan\u0131tlamaz.<\/p>\n\n\n\n
Ge\u00e7ici \u00f6nlemler: Ayar\u0131n yeri de de\u011feri kadar \u00f6nemli<\/h2>\n\n\n\n
PHP’nin duyurusunda session.upload_progress.enabled=0<\/code>; PHP 8.5 i\u00e7in ayr\u0131ca fatal_error_backtraces=0<\/code> belirli do\u011frulanm\u0131\u015f yollar\u0131 daraltan ge\u00e7ici \u00f6nlemler aras\u0131nda. Worker’lar\u0131n yeniden ba\u015flat\u0131lmas\u0131 gerekiyor. Session \u00f6nlemini uygulama i\u00e7indeki ini_set()<\/code> veya FPM .user.ini<\/code> ayar\u0131na b\u0131rakmak, erken ayr\u0131\u015ft\u0131rma a\u015famas\u0131 i\u00e7in yeterli de\u011fil. Bu \u00f6nlemler b\u00fct\u00fcn varyantlar\u0131 kapatm\u0131yor. Resm\u00ee ge\u00e7ici \u00f6nlemler<\/a><\/p>\n\n\n\n
.user.ini<\/code> zaten ayr\u0131 bir konfig\u00fcrasyon mekanizmas\u0131: CGI\/FastCGI ba\u011flam\u0131nda \u00e7al\u0131\u015f\u0131yor ve varsay\u0131lan yeniden okuma aral\u0131\u011f\u0131 300 saniye. Bu da \u201cdosyay\u0131 de\u011fi\u015ftirdim\u201d ile \u201cb\u00fct\u00fcn s\u00fcre\u00e7ler do\u011fru ayar\u0131 do\u011fru a\u015famada kullan\u0131yor\u201d ifadelerini birbirinden ay\u0131rmak i\u00e7in ek bir neden. PHP .user.ini belgesi<\/a><\/p>\n\n\n\n
memory_limit=-1<\/code> \u00f6nerisi de ba\u011flam\u0131ndan kopar\u0131lmamal\u0131. OOM duyurusu bunu kontroll\u00fc PHP limit a\u015f\u0131m\u0131n\u0131 kald\u0131ran k\u0131smi bir \u00f6nlem olarak a\u00e7\u0131kl\u0131yor; alttaki bellek tahsisi yine ba\u015far\u0131s\u0131z olabilir. OOM \u00f6nleminin s\u0131n\u0131r\u0131<\/a><\/p>\n\n\n\n
Normalde bellek kullan\u0131m\u0131n\u0131 s\u0131n\u0131rlayan bu de\u011feri kald\u0131rmak, kapasite plan\u0131n\u0131 da de\u011fi\u015ftirir. Ben b\u00f6yle bir ge\u00e7i\u015fi; host kapasitesi, worker ba\u015f\u0131na t\u00fcketim ve i\u015fletim sistemi seviyesindeki s\u0131n\u0131rlar de\u011ferlendirilmeden standart bir kopyala-yap\u0131\u015ft\u0131r \u00e7\u00f6z\u00fcm\u00fc olarak \u00f6nermem. Hedef, bir RCE yolunu daralt\u0131rken b\u00fct\u00fcn sunucuyu eri\u015filebilirlik problemine s\u00fcr\u00fcklememek olmal\u0131.<\/p>\n\n\n\n
FPM’deki pm.max_requests<\/code>, bir child’\u0131n ka\u00e7 istekten sonra yeniden olu\u015fturulaca\u011f\u0131n\u0131 belirler. \u00c7ok d\u00fc\u015f\u00fck de\u011ferler s\u00fcre\u00e7 yenileme maliyetini art\u0131raca\u011f\u0131 i\u00e7in trafik ve kapasite \u00f6l\u00e7\u00fcmleriyle de\u011ferlendirilmelidir; worker yenilemek, d\u00fczeltilmi\u015f runtime’\u0131n yerine konmamal\u0131. FPM yap\u0131land\u0131rma belgesi<\/a><\/p>\n\n\n\n
WordPress g\u00fcncel olabilir; alt\u0131nda \u00e7al\u0131\u015fan PHP eski kalabilir<\/h2>\n\n\n\n
WordPress’in a\u00e7\u0131klamas\u0131 net: sorun WordPress’e \u00f6zel de\u011fil ve bu iki a\u00e7\u0131k i\u00e7in ayr\u0131 bir WordPress g\u00fcncellemesi planlanm\u0131yor. Runtime s\u00fcr\u00fcm\u00fc panelde Ara\u00e7lar \u2192 Site sa\u011fl\u0131\u011f\u0131 \u2192 Bilgi \u2192 Sunucu<\/strong> alt\u0131nda g\u00f6r\u00fclebiliyor. Yani WordPress \u00e7ekirde\u011finin, eklentilerin ve teman\u0131n g\u00fcncel olmas\u0131 PHP yamas\u0131n\u0131n uyguland\u0131\u011f\u0131n\u0131 g\u00f6stermiyor. WordPress resm\u00ee duyurusu<\/a><\/p>\n\n\n\n
Birden fazla domain, havuz veya container bulunan ortamda bunu her y\u00fcr\u00fctme ba\u011flam\u0131 i\u00e7in kaydetmek gerekir. Ben a\u015fa\u011f\u0131daki k\u00fc\u00e7\u00fck te\u015fhis \u00e7\u0131kt\u0131s\u0131n\u0131 yaln\u0131zca eri\u015fimi k\u0131s\u0131tlanm\u0131\u015f bir tan\u0131lama ba\u011flam\u0131nda kullan\u0131r\u0131m; herkese a\u00e7\u0131k bir endpoint olarak b\u0131rakmam:<\/p>\n\n\n\n
<?php\n\/\/ Yaln\u0131zca kontroll\u00fc tan\u0131lama ba\u011flam\u0131nda \u00e7al\u0131\u015ft\u0131r\u0131n.\n\/\/ CLI sonucu, web iste\u011fini i\u015fleyen PHP'nin kan\u0131t\u0131 de\u011fildir.\necho json_encode([\n    'version' => PHP_VERSION,\n    'sapi' => PHP_SAPI,\n    'loaded_ini' => php_ini_loaded_file(),\n    'memory_limit' => ini_get('memory_limit'),\n    'upload_progress' => ini_get('session.upload_progress.enabled'),\n], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);<\/code><\/pre>\n\n\n\n
\u00c7\u0131kt\u0131 bir envanter girdisidir; zafiyet taray\u0131c\u0131s\u0131 de\u011fildir. Backport durumunu s\u00f6ylemez, di\u011fer havuzlar\u0131n ayar\u0131n\u0131 g\u00f6stermez ve eski worker’lar\u0131n tamamen kapand\u0131\u011f\u0131n\u0131 kan\u0131tlamaz. \u0130\u015fletim ekibinden isteyece\u011fim kay\u0131t; domain \u2192 handler \u2192 paket \u2192 s\u00fcre\u00e7 \u2192 yama kan\u0131t\u0131 zinciridir.<\/p>\n\n\n\n
WAF korumas\u0131 ve origin’e ula\u015fan ger\u00e7ek trafik<\/h2>\n\n\n\n
Cloudflare, bu a\u00e7\u0131klar i\u00e7in request ve response sinyallerini birlikte de\u011ferlendiren \u201cfull transaction detection\u201d yakla\u015f\u0131m\u0131n\u0131 duyurdu; korumalar varken de PHP’nin yamalanmas\u0131n\u0131 istiyor. Bu \u00f6nemli bir ayr\u0131m: s\u0131n\u0131rdaki filtre \u00e7al\u0131\u015fma zaman\u0131n\u0131n bellek sahipli\u011fi hatas\u0131n\u0131 d\u00fczeltmiyor. Cloudflare teknik a\u00e7\u0131klamas\u0131<\/a><\/p>\n\n\n\n
Benim buradan \u00e7\u0131kard\u0131\u011f\u0131m kontrol listesi \u015fu: hangi hostname proxy’den ge\u00e7iyor, alternatif origin adresi d\u0131\u015far\u0131ya a\u00e7\u0131k m\u0131, ba\u015fka porttan ayn\u0131 uygulamaya eri\u015filiyor mu, staging ayn\u0131 backend’e ula\u015f\u0131yor mu? WAF’\u0131n korudu\u011fu trafik k\u00fcmesiyle runtime’a ula\u015fabilen trafik k\u00fcmesi e\u015fle\u015fmiyorsa, paneldeki koruma g\u00f6stergesi ortam\u0131n tamam\u0131n\u0131 temsil etmez.<\/p>\n\n\n\n
Yamay\u0131 kurmak ile olay\u0131 kapatmak aras\u0131nda<\/h2>\n\n\n\n
\u00dcretim m\u00fcdahalesini ben \u015fu kan\u0131tlarla tamamlar\u0131m:<\/p>\n\n\n\n
    \n
  1. Envanter:<\/strong> \u0130nternete a\u00e7\u0131k uygulamalar, PHP handler’lar\u0131, havuzlar ve imajlar e\u015fle\u015ftirilmi\u015f olmal\u0131.<\/li>\n\n\n
  2. Yama:<\/strong> Paket sa\u011flay\u0131c\u0131s\u0131n\u0131n iki CVE i\u00e7in d\u00fczeltme kan\u0131t\u0131 ve da\u011f\u0131t\u0131lan paket kimli\u011fi kayda al\u0131nmal\u0131.<\/li>\n\n\n
  3. \u00c7al\u0131\u015fan s\u00fcre\u00e7:<\/strong> Eski s\u00fcre\u00e7lerin sonland\u0131\u011f\u0131, yeni binary’nin trafik ald\u0131\u011f\u0131 ve b\u00fct\u00fcn instance’lar\u0131n kapsand\u0131\u011f\u0131 do\u011frulanmal\u0131.<\/li>\n\n\n
  4. Regresyon:<\/strong> Giri\u015f, upload\/import, zamanlanm\u0131\u015f i\u015fler, API’ler ve extension ba\u011f\u0131ml\u0131l\u0131klar\u0131 kontroll\u00fc test edilmeli.<\/li>\n\n\n
  5. \u0130zleme:<\/strong> Proxy, web sunucusu, PHP ve s\u00fcre\u00e7 telemetrisi ayn\u0131 zaman \u00e7izgisinde incelenmeli.<\/li>\n<\/ol>\n\n\n\n
    Hata art\u0131\u015f\u0131, worker \u00e7\u00f6kmesi veya ola\u011fand\u0131\u015f\u0131 s\u00fcre\u00e7 davran\u0131\u015f\u0131 ara\u015ft\u0131rma sinyalidir; tek ba\u015f\u0131na ba\u015far\u0131l\u0131 s\u00f6m\u00fcr\u00fc kan\u0131t\u0131 de\u011fildir. Tersi de ge\u00e7erli: yaln\u0131zca eri\u015fim loglar\u0131nda belirgin bir \u015fey g\u00f6rmemekle olay kapat\u0131lmaz. M\u00fcdahale kayd\u0131, g\u00f6zlemin kapsad\u0131\u011f\u0131 sistemleri ve zaman aral\u0131\u011f\u0131n\u0131 a\u00e7\u0131k\u00e7a s\u00f6ylemeli.<\/p>\n\n\n\n
    Bir ihlal \u015f\u00fcphesi varsa benim tercih edece\u011fim ak\u0131\u015f, adli izleri koruyup olay m\u00fcdahalesini ba\u015flatmak; eri\u015filebilen s\u0131rlar\u0131 ve yetkileri o incelemenin kapsam\u0131na almakt\u0131r. Yama gelecekteki tetiklemeyi engellerken ge\u00e7mi\u015fte ne oldu\u011funu geriye d\u00f6n\u00fck a\u00e7\u0131klamaz.<\/p>\n\n\n\n
    AI taraf\u0131ndaki ders: Karma\u015f\u0131kl\u0131k bir g\u00fcvenlik kontrol\u00fc say\u0131lmamal\u0131<\/h2>\n\n\n\n
    Wiz, bellek yerle\u015fimine g\u00f6re uyarlama ve tekrarl\u0131 hata ay\u0131klama gerektiren s\u00f6m\u00fcr\u00fc \u00e7al\u0131\u015fmalar\u0131nda frontier modellerin s\u00fcreci h\u0131zland\u0131rd\u0131\u011f\u0131n\u0131 anlat\u0131yor. Foundation ise bu hata s\u0131n\u0131f\u0131n\u0131n izlerinin 2024’te g\u00f6r\u00fcld\u00fc\u011f\u00fcn\u00fc; uyumluluk, performans ve kaynak k\u0131s\u0131tlar\u0131n\u0131n d\u00fczeltme s\u00fcrecini zorla\u015ft\u0131rd\u0131\u011f\u0131n\u0131 a\u00e7\u0131kl\u0131yor. Wiz ara\u015ft\u0131rmas\u0131<\/a>, Foundation’\u0131n s\u00fcre\u00e7 de\u011ferlendirmesi<\/a><\/p>\n\n\n\n
    Benim \u00e7\u0131kar\u0131m\u0131m, teknik karma\u015f\u0131kl\u0131\u011f\u0131 kal\u0131c\u0131 bir savunma gibi saymamak gerekti\u011fi. \u201cBunu \u00e7al\u0131\u015f\u0131r sald\u0131r\u0131ya \u00e7evirmek \u00e7ok zor\u201d de\u011ferlendirmesi, ara\u00e7lar ve otomasyon de\u011fi\u015fti\u011finde h\u0131zla eskiyebilir. Savunma taraf\u0131nda bunun kar\u015f\u0131l\u0131\u011f\u0131; daha k\u0131sa yama s\u00fcresi, hata yollar\u0131n\u0131 da kapsayan testler ve \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131m\u0131z runtime’a ili\u015fkin do\u011frulanabilir envanterdir.<\/p>\n\n\n\n
    PHP2Shell’de beni en \u00e7ok d\u00fc\u015f\u00fcnd\u00fcren nokta, normal istek ak\u0131\u015f\u0131 kadar ba\u015far\u0131s\u0131zl\u0131\u011f\u0131n da tasarlanmas\u0131 gerekti\u011fi.<\/strong> Veri ge\u00e7erli olmadan g\u00f6r\u00fcn\u00fcr olmamal\u0131; \u00f6mr\u00fc bitti\u011finde eri\u015filebilir kalmamal\u0131; hata yolu bu iki garantiyi bozuyorsa sistem h\u00e2l\u00e2 g\u00fcvenli say\u0131lmamal\u0131.<\/p>\n\n\n\n
    Bug\u00fcnk\u00fc operasyonel karar ise a\u00e7\u0131k: sa\u011flay\u0131c\u0131s\u0131 taraf\u0131ndan do\u011frulanm\u0131\u015f PHP d\u00fczeltmesini \u00e7al\u0131\u015fan web ortam\u0131na ula\u015ft\u0131rmak ve bunu s\u00fcre\u00e7 seviyesinde kan\u0131tlamak.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    PHP2Shell iki kritik PHP a\u00e7\u0131\u011f\u0131n\u0131 g\u00fcndeme ta\u015f\u0131d\u0131. OOM, istekler aras\u0131nda kalan ge\u00e7ersiz bellek referanslar\u0131, mod_php\u2013FPM farklar\u0131 ve yama do\u011frulama s\u00fcrecini teknik a\u00e7\u0131dan inceliyorum.<\/p>\n","protected":false},"author":1,"featured_media":1234,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":false,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[260],"tags":[269,272,266,271,267,270],"class_list":["post-1206","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-yazilim-muhendisligi","tag-bellek-guvenligi","tag-guvenlik","tag-php","tag-php-fpm","tag-php2shell","tag-use-after-free"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/serhatdiker.com\/wp-content\/uploads\/2026\/10\/sd-v2-1206-php-memory.jpg","_links":{"self":[{"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/posts\/1206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/comments?post=1206"}],"version-history":[{"count":3,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/posts\/1206\/revisions"}],"predecessor-version":[{"id":1235,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/posts\/1206\/revisions\/1235"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/media\/1234"}],"wp:attachment":[{"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/media?parent=1206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/categories?post=1206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serhatdiker.com\/index.php\/wp-json\/wp\/v2\/tags?post=1206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}