New Delhi: Indian companies, especially small and medium enterprises, rushed to inspect their websites and applications, patch vulnerable systems and tighten security controls after two critical flaws were found in PHP, The Hindu BusinessLine reported on Thursday, October 22.
CERT-In, India's computer emergency response team, raised a critical alert saying multiple vulnerabilities in PHP could allow a remote attacker to execute arbitrary code on a targeted system and compromise it completely, Digit reported, quoting CERT-In's vulnerability note attributing the flaws to memory corruption and improper resource control. BusinessLine said CERT-In urged organisations using PHP to identify affected systems, apply the latest security fixes and look for signs of exploitation.
Source: Digit — PHP security alert: Why CERT-In, FBI, Google and OpenAI are warning users, Oct 2026
"We have alerted all the critical sectors including banks, power companies and others but the segment which is big in PHP is actually the MSME sector," a top government official told BusinessLine, adding that the government was talking to industry associations and had begun outreach to support smaller firms. The official said 70% of government websites do not use PHP, that the National Informatics Centre had patched government PHP sites on priority, and that most key sites had been patched through the day.
Source: The Hindu BusinessLine, Oct 22, 2026
PHP released fixes on October 21 for the two vulnerabilities, which can enable unauthenticated remote code execution, and urged users to update to the latest PHP 8 versions immediately, BusinessLine and MediaNama reported. MediaNama said the flaws, dubbed php2shell, affect PHP versions from 5.4 through 8.5.11 and that CERT-In rated the risk as high, capable of remote code execution and complete system compromise.
Source: MediaNama — What are the two PHP vulnerabilities behind a global rush to update, Oct 2026
Security experts quoted by BusinessLine said the firms typically affected in India include government services, select financial-institution systems, educational platforms, MSMEs and enterprises mixing modern and legacy technology, with many depending on third-party hosting providers — making it hard to establish which systems run vulnerable components and who is responsible for updating them. Microsoft CEO Satya Nadella, speaking at an event in Germany on Thursday, said of the incident: "I've not seen anything like this in a long, long time."