India’s cybersecurity agency urged PHP users to install fixes for two critical flaws that can let unauthenticated attackers run code on servers, putting widely deployed web infrastructure at risk.
The Indian Computer Emergency Response Team (CERT-In) issued a critical note for PHP users Wednesday, Oct. 21, then published separate guidance for micro, small and medium enterprises Thursday. The follow-up put systems reachable from the internet at the front of remediation efforts. The PHP project rated the vulnerabilities 9.2 under CVSS v4.0.
PHP released fixes Oct. 21 for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-In urged operators to review system activity for warning signs and limit access when an update cannot be installed promptly. It said a successful attack could expose customer information, databases and connected resources, or allow changes to website content.
The New Indian Express reported that S Krishnan, secretary of the Ministry of Electronics and Information Technology, said CERT-In had alerted operators at 60,000 sites running vulnerable PHP. That number does not appear in the agency’s public notices. The Economic Times separately reported that banks reviewed applications, prepared alternate traffic routes and took some noncritical services offline. It also said Razorpay advised merchants and developed AI-assisted vulnerability detection. The report did not identify the banks or services, and CERT-In’s published notices do not describe a countrywide shutdown.
PHP’s reach extends well beyond India. W3Techs reported that the language ran on 69.3% of websites where it could identify a server-side language as of Oct. 23. Unit 42, the threat research team at Palo Alto Networks, counted more than 22.6 million internet-exposed instances that might be vulnerable in an Oct. 21 brief. That figure measures potential exposure, not confirmed compromises.
CERT-In’s follow-up advisory described reports of exploitation on a broad scale but gave no incident tally. Unit 42 said it had identified proof-of-concept code, while The PHP Foundation said it had not found a working exploit when the fixes were disclosed. The Foundation said work on the underlying issue began after an early warning sign in 2024 and later stalled amid compatibility concerns and limited specialist capacity.
Website operators and their providers face the immediate work of finding affected installations, applying fixes and checking for suspicious activity. PHP 8.2 is scheduled to reach end of life Dec. 31, when the project says it will stop receiving security fixes.
