Indian Patch Patrol Sets Out to Resolve PHP Risk

Indian organisations are scrambling to secure their systems after two critical vulnerabilities in PHP -- the programming language powering 70% of the web -- sparked a global cybersecurity panic. They are fast-tracking emergency response plans, pulling vulnerable applications offline, scanning websites for breaches and demanding urgent patches from their tech vendors, officials and industry executives said.

Banks have begun auditing applications for weaknesses, taking some non-critical services offline and preparing backups to divert traffic if parts of their websites or mobile applications experience downtime, according to executives.

The government has also started immediate patch-fixing for scores of official websites that may be targeted by hacker groups. However, no such attempts have been noted yet, officials said.

Financial services firm Razorpay said it had created a security posture that uses AI to discover and patch security flaws at machine speed. It also issued advisories to merchants on immediate steps to prevent breaches at their end.

"I have been stressing the fact that AI models can identify and attack security vulnerabilities that traditional human-based detection systems aren't prepared to handle," said Harshil Mathur, CEO of Razorpay. "What I am worried about is that PHP flaws can target roughly 70% of the internet. This can have long-lasting repercussions, as personal data can be used to carry out social engineering attacks."

Ever since the critical

PHP vulnerabilities came to light on Wednesday, technology leaders at organisations are scrambling to answer three pressing questions: Is our site vulnerable? What data is at risk? Have we already been breached?

Over the next 15 hours, IT suppliers, software-as-a-service providers, consultants and security experts discussed the PHP vulnerabilities, as they sought to identify exposed websites and decide which services could safely stay online, executives said.

"Over the next two to three weeks, attackers are likely to target vulnerable systems, particularly those where they can gain access to sensitive data," said Ranganath Sadasiva, chief technology officer at US enterprise technology firm Hewlett Packard Enterprise. "They will look for places where the potential payoff is high. Government websites and other large systems holding sensitive information could be targets. Much of what attackers seek is personal data, such as phone numbers and other identifying information. They may also try to alter authentication processes."

For India, the bigger problem is that legacy banks, telecoms, power and even direct-to-consumer applications are running on older PHP 5 and 7 versions, which have no fix. Experts suggest that patching on this scale could run until 2027. PHP powers 69.3% of websites, 34.8% of which run version 7 or older.

The Data Security Council of India (DSCI), part of software industry lobby Nasscom, said PHP flaws are critical and can let an attacker run their own code on a web server without logging in. "They can also leak data from the server's memory. Attackers can read passwords, tokens, and API keys from memory without running any code at all. For portals hosting personal data, it is a serious risk on its own, even without a full takeover," a DSCI spokesperson said.

"There have been no complaints of disruptions to government websites. All government agencies should comply with CERT-In's advisory to update their servers with the newly released patches. There is no new direction from our side," a Ministry of Electronics and Information Technology official said on condition of anonymity. "Major digital public infrastructure (DPI) stack websites operate at the national level, are not built on PHP and their operations should not be disrupted as a result of the latest incident."

These include the Aadhaar portal run by the Unique Identification Authority of India, the finance ministry's Goods and Services Tax Network (GSTN) website, the Unified Payments Interface (UPI) system run by the National Payments Corporation of India and the corporate affairs ministry's MCA21 portal handling company registration, the official added. These rely on Java enterprise frameworks, or Java based open stacks, .NET or distinct enterprise stacks such as Microsoft.

Debashish Roy, chief digital transformation officer at CEAT, said that the company had undertaken a focused security-hardening exercise. This included reviewing patch levels, tightening access controls for critical manufacturing environments and enhancing threat monitoring. "Plenty of state department and municipal sites were built by a vendor on a fixed contract years ago and still run whatever version was current at launch. For those sites, there is no update to install," said Beenu Arora, cofounder at cyber intelligence firm Cyble. "In many departments, nobody can say for certain who is allowed to touch the server - the IT cell, the original vendor, the hosting provider, or the state data centre."

He added that risks to Indian infrastructure could keep emerging for months - "defacements timed to a political moment, malicious redirects on government pages, card skimmers on e-commerce checkouts and data pulled from portals that were compromised before anyone patched". "First, a thorough check is done to ensure that any part or website of the bank is not impacted. In case we find something amiss, traffic is diverted to alternate sites or channels so that customers do not have a problem with transactions," said a senior banking executive, who did not wish to be identified.

More than 22.6 million internet-exposed instances worldwide could be vulnerable, according to Palo Alto Networks' threat intelligence team, which has observed exploitation in the wild. The next two weeks will be an open canvas for trophy hunters who will try to deface prominent websites or steal sensitive data, as security teams continue to fire-fight through sleepless nights.

"The companies that suffer will be the ones that can't answer "where do we run PHP, and who owns it?" within the hour," said Arjun Nagulapally, chief technology officer at enterprise AI firm AIONOs.

Organisations running PHP 7 or older, which won't get an official patch, are in the worst position. "Mitigation there means distribution backports, vendor fixes, or migration," Nagulapally said.

Global Meltdown

The past 72 hours have been the most critical in cybersecurity, with a dozen incidents being reported globally, in what netizens are calling "Black October". The most serious flaw was related to PHP. Researchers at Calif, OpenAI and Wiz discovered two vulnerabilities in PHP which could be exploited by hackers to bring down any website, steal passwords and compromise sensitive information. Cloudflare chief executive Mathew Prince said they have seen millions of attempts to exploit the security holes.

Governments across France, Germany, the Netherlands, Denmark, Belgium, Finland, the UK and the US shut down their websites serving public authorities, hospitals, schools and critical infrastructure. Japanese Prime Minister Sanae Takaichi issued an unusual public warning on X on Wednesday, urging website operators to urgently patch critical vulnerabilities.

The PHP vulnerability, rated 9.2 out of 10 on the severity scale, is among the worst security holes in recent times, according to Anirudh Batra, security researcher at CloudSEK. In 2021, Log4Shell vulnerability related to programming language Java was rated 10 out on the severity scale. During that time, more than 25 million hacking attempts were made. Companies faced an average response cost of $90,000. Ransomware groups such as LockBit, Conti and BlackCat demanded multi-million dollar payouts to return corporate data. Years after the patch was released, organisations are still losing money protecting against this flaw.

Palo Alto Networks said the PHP episode "is not just another high-severity vulnerability disclosure; it marks the opening chapter in a massive acceleration of cyberthreats that will define foreseeable future".

(This story has not been edited by economictimes.com and is auto-generated from a syndicated feed we subscribe to.)