A crack in the code: PHP flaws raise cyber risks for Indian firms

SENSEX 73,249.39

 -460.30

NIFTY 22,687.65

 -123.70

CRUDEOIL 9,397.00

+ 189.00

GOLD 143,888.00

 -2,191.00

SILVER 201,138.00

 -8,030.00

SENSEX 73,249.39

 -460.30

NIFTY 22,687.65

 -123.70

NIFTY 22,687.65

 -123.70

CRUDEOIL 9,397.00

+ 189.00

CRUDEOIL 9,397.00

+ 189.00

GOLD 143,888.00

 -2,191.00

'; } document.getElementById("lgdv").innerHTML = htmlElements; } function numberformat(i) { return Number(parseFloat(i).toFixed(2)).toLocaleString('en', { minimumFractionDigits: 2 }) } async function gatherResponse(response) { const { headers } = response; const contentType = headers.get('content-type') || ''; if (contentType.includes('application/json')) { return await response.json() } return response.text(); } function getWidth() { if (Math.max(document.body.scrollWidth,document.documentElement.scrollWidth,document.body.offsetWidth,document.documentElement.offsetWidth,document.documentElement.clientWidth) > 991) { document.getElementById("mob").style.display = "none"; document.getElementById("lgdv").style.display = "block"; } else { document.getElementById("mob").style.display = "block"; document.getElementById("lgdv").style.display = "none"; } } getWidth(); THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.

Experts urge businesses to patch vulnerable systems amid rising risks of cyberattacks

By Sanjana B

Updated - October 22, 2026 at 08:57 PM.

The vulnerability had remained hidden in PHP’s codebase for more than a decade | Photo Credit: KSL

Indian businesses that rely on PHP-powered websites and applications face potential risks after two critical vulnerabilities in the widely used programming language prompted CERT-In to issue a security alert. The warning has put the spotlight on the security of India’s digital infrastructure, with businesses urged to identify vulnerable systems, apply patches and check for signs of exploitation.

PHP, short for Hypertext Preprocessor, is a popular general-purpose scripting language especially suited to web development.

Vulnerability Fixes

On October 21, PHP released fixes for two critical vulnerabilities that can enable unauthenticated remote code execution (RCE). It urged users to update to PHP’s latest 8 versions immediately. The flaws affect web-facing PHP installations across multiple server configurations, while older, unsupported versions may require vendor-provided fixes or backports.

The vulnerability had remained hidden in PHP’s codebase for more than a decade. Cybersecurity firm Wiz discovered it using its autonomous vulnerability detection system, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz worked with PHP core developers, OpenAI and security firm Calif to verify the flaw and confirm fixes.

The vulnerabilities could allow attackers to execute commands on servers without logging in, potentially leading to website takeovers, data theft, malware installation, and access to internal systems.

PHP Dominance

According to Web Technology Surveys, PHP is used by 69.3 per cent of websites whose server-side programming language is known, compared with Java at 8.1 per cent and Python at 1.1 per cent. Among websites using PHP, 65.3 per cent run version 8.

Yash Kadakia, Chief Technology Officer, Security Brigade InfoSec Private, highlighted that for websites using India’s .in domain, that figure is approximately 67 per cent.

I would put e-commerce businesses, SMEs, educational institutions, healthcare providers, and government portals particularly high on the alert list. India also has an enormous ecosystem of web-development agencies and hosting providers managing websites for thousands of businesses.

In response, the Indian Computer Emergency Response Team (CERT-In) issued a critical-severity alert warning of two vulnerabilities in PHP.

With India’s increasing dependence on digital banking, online transactions, and citizen-facing government portals, such attacks could have far-reaching operational, financial, and reputational consequences.

Hakimuddin Wadlawala, founder of Aquila I, an AI Native Unified, Detection and Response Platform, explained that the immediate concern for Indian enterprises is the potential exposure of business-critical applications that rely on vulnerable PHP runtimes, particularly those accessible over the internet.

For banks and financial institutions, exploitation could create risks involving customer information, digital banking services, and connected backend systems. E-commerce platforms face potential exposure of customer records, transaction workflows, and business operations.

The AGM- IT of a large bank, for instance, shared that its PHP footprint is low, as it migrated most systems to Java over the years. However, it used to be high.

“We are waiting for the patch to be released for some versions; we contacted our cybersecurity vendors last night and upped the perimeter security systems and firewalls. Our partners and in-house teams have also increased monitoring activities, watching out for any threat. I would say banks are relatively better placed, as the stack will not be too reliant on PHP and also because of an overall strong cybersecurity focus,” he said.

Government organisations could experience disruption of citizen-facing services, while IT service providers must also assess the applications and infrastructure they manage on behalf of customers.

Rajesh Chhabra, General Manager, India & Asia, Acronis, noted that e-commerce firms also face data theft and fraud risk through customer-facing portals, and may have to meet CERT-In’s six-hour incident reporting rule and DPDP obligations if personal data is affected.

Government portals are also a concern because many run older, unsupported PHP versions that will not receive fixes, so they need upgrades or isolation.

The recent Mozilla Firefox certificate security incident reminds us that certificate lifecycle management is a security issue, not IT housekeeping, Dipesh Kaura, Country Director, India and SAARC, Securonix, says.

“The compromise of the eMudhra intermediate certificate private keys goes beyond error messages, weakens trust in HTTPS connections, and exposes users to website impersonation. This incident shows that the digital ecosystem’s resilience is only as strong as the integrity of its underlying cryptographic processes,” he said.

Government agencies globally also took note of this incident. US National Security Agency (NSA) on Wednesday said it was prioritising the identification of malicious actors seeking to exploit the PHP2Shell vulnerabilities. It urged organisations to inventory internet-facing systems running vulnerable PHP versions, maintain heightened vigilance, and promptly apply relevant vendor patches.

The European Commission, ENISA, CERT-EU, Europol EC3 and EU national cybersecurity response teams urged organisations to immediately address two critical PHP vulnerabilities. They will continue monitoring the threat.

Experts also added thatcybersecurity risks are not limited to PHP. Widely used programming languages such as Java, Python, JavaScript, and others can also face vulnerabilities involving third-party libraries, malicious packages, compromised repositories, and insecure dependencies.

“For example, ecosystems such as npm for JavaScript, PyPI for Python, and Maven for Java have experienced malicious-package and software supply-chain security incidents. However, no programming language can be universally classified as more vulnerable without considering its architecture, dependencies, application design, deployment environment, and security practices,” Satyam Gupta, Business Head – Cybersecurity, Pelorus Technologies said.

Wadlawala echoed that languages such as C and C++ have historically faced memory-safety challenges, including buffer overflows and use-after-free vulnerabilities. JavaScript and Python ecosystems frequently encounter risks involving third-party dependencies, malicious packages, and insecure application implementations.

Sanjeev Singh, Partner, Deloitte India, noted that Indian banks, ecommerce ple-commerceIT services companies and government departments should immediately identify and patch affected PHP systems. Where patching cannot be completed quickly, they should remove non-essential applications from the internet, restrict network access, reduce service-account privileges and apply web application firewall controls. Logs should be reviewed from at least 17 October, with confirmed incidents reported under applicable regulatory requirements.

With inputs from Sindhu Hariharan in Chennai and Kurmanath KV in Hyderabad

Published on October 22, 2026

THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.Sign into Unlock benefits!

• Access 10 free stories per month
• Get notified by email for early preview to new features, discounts & offers