🇦🇺 English, 23 October 2026, vulnerabilities
Critical PHP vulnerabilities trigger CERT-In warnings as SBI reports suspected data exposure and eMudhra addresses certificate flaws
Critical PHP vulnerabilities, suspected data leaks and AI security risks raise concerns across the technology industry.
Two critical vulnerabilities in PHP, collectively known as php2shell, have raised concerns about the security of websites and applications using the programming language. The flaws, publicly disclosed on October 21, affect PHP versions dating back to 5.4 and could allow attackers to execute malicious code remotely and access sensitive information. Researchers associated with Calif.io, Wiz, OpenAI and Quarkslab disclosed the vulnerabilities.
Cloudflare reported observing exploitation attempts before the public disclosure. According to CEO Matthew Prince, attempts increased from thousands to tens of thousands within 45 minutes of the announcement, reaching hundreds of thousands within two hours. Emergency updates have been released for affected PHP versions, although organisations using unsupported legacy versions face additional difficulties securing their systems.
State Bank of India reported a suspected customer data leak after receiving alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In. A preliminary investigation identified more than 375,000 potentially exposed records, including 3,897 containing personally identifiable information.