Two critical PHP flaws lead India to activate emergency response and take sites offline

What was discovered

Two critical vulnerabilities in PHP came to light on Wednesday, October 21, 2026, discovered by researchers linked to Calif, OpenAI, and Wiz, according to a report by the Economic Times. The flaws received a 9.2 rating on a severity scale of 0 to 10, placing them among the most severe ever recorded in the language.

The problem is one of scale: PHP powers about 69.3% of all websites in the world, according to data cited in the report. Even more serious, 34.8% of those sites run PHP 7 or earlier versions, which no longer receive official fixes from the project. For these installations, there is no patch to install, only workarounds.

Palo Alto Networks estimates that more than 22.6 million internet-exposed instances may be vulnerable, and the company has already observed active exploitation in the field. Cloudflare CEO Matthew Prince said the company has seen millions of attempts to exploit the flaws.

India in emergency mode

Indian banks audited applications, took non-critical services offline, and prepared backups to reroute traffic in case of instability. The government began applying emergency fixes to dozens of official websites, following guidance from CERT-In, the national cybersecurity incident response agency.

The fintech Razorpay deployed an AI-based vulnerability detection system and issued alerts to its merchants. The company's CEO summed up the concern:

I have been stressing the fact that AI models can identify and attack security vulnerabilities that traditional human-based detection systems aren't prepared to handle. What I am worried about is that PHP flaws can target roughly 70% of the internet. This can have long-lasting repercussions, as personal data can be used to carry out social engineering attacks.

Harshil Mathur, CEO of Razorpay

India's Ministry of Electronics and Information Technology stated that the country's public digital infrastructure, such as the Aadhaar identification portal, the UPI instant payment system, and the GSTN tax collection portal, does not run on PHP but on Java, .NET, or proprietary enterprise stacks, and therefore should not be affected.

The rest of the world also reacted

Governments in France, Germany, the Netherlands, Denmark, Belgium, Finland, the United Kingdom, and the United States took down websites belonging to public agencies, hospitals, schools, and critical infrastructure as a precautionary measure. Japan's Prime Minister, Sanae Takaichi, issued an unusual public alert urging website operators to fix the vulnerabilities urgently.

Internet users have already dubbed the episode "Black October": the 72 hours before the report's publication saw about a dozen security incidents reported globally, with the PHP flaw as the most severe among them. Palo Alto Networks described the case as "the opening chapter of a massive acceleration of cyberthreats that will define the near future," rather than just another high-severity vulnerability disclosure.

Why the timeline matters

The warning from those who deal with incident response is that the window of highest risk has not passed yet. According to Hewlett Packard Enterprise CTO Ranganath Sadasiva, attackers will hunt high-value targets in the coming weeks:

Over the next two to three weeks, attackers are likely to target vulnerable systems, particularly those where they can gain access to sensitive data. They will look for places where the potential payoff is high. Government websites and other large systems holding sensitive information could be targets. Much of what attackers seek is personal data, such as phone numbers and other identifying information. They may also try to alter authentication processes.

Ranganath Sadasiva, CTO of Hewlett Packard Enterprise

The most cited case for comparison is Log4Shell, a 2021 flaw in the Log4j logging library for the Java language, which received the maximum severity rating (10 out of 10). At the time, more than 25 million exploitation attempts were recorded, the average response cost per affected company reached US$90,000, and ransomware groups such as LockBit, Conti, and BlackCat demanded million-dollar ransoms. Years after the patch became available, organizations are still spending money protecting themselves against this flaw, according to the report.

The problem of not knowing where PHP runs

Beenu Arora, co-founder of threat intelligence company Cyble, described the worst-case scenario: city and state government websites built by vendors under contracts signed years ago, still running whatever PHP version was available at launch, with no one clearly knowing who has authorization to touch the server, whether it's the internal IT team, the original vendor, the hosting provider, or the state data center.

He also warned that risks are likely to keep surfacing for months: defacements timed to coincide with political moments, malicious redirects on government pages, card skimmers on e-commerce checkouts, and data leaks from portals that were already compromised before any fix was applied.

Arjun Nagulapally, CTO of enterprise AI company AIONOs, summed up the criterion that will separate those who suffer from this episode from those who don't:

The companies that suffer will be the ones that can't answer "where do we run PHP, and who owns it?" within the hour.

Arjun Nagulapally, CTO of AIONOs

What about Brazil, is it a target?

The Economic Times report does not mention Brazil or provide exposure data for the country. But it's worth reading the situation from here: PHP is the language behind much of the Brazilian web, from online stores built on WooCommerce and Magento to institutional portals, city halls, and government agencies that fit exactly the profile described by Beenu Arora, systems contracted years ago, frozen at whatever version was available at launch, with no clear owner for maintenance.

In Brazil, the body that concentrates national-level security incident alerts is CERT.br, Brazil's national computer emergency response team, the counterpart to India's CERT-In. The report used as a source does not mention any specific communication from the Brazilian agency about these two flaws, which does not mean there is no risk, only that there was no public confirmation by the time the original story was published.

For those who develop or maintain PHP systems here, the practical lesson from the Indian crisis is direct: take inventory of where PHP runs in the operation, which version is in production, and who is responsible for applying fixes, before the question comes up during an incident. Projects stuck on PHP 5 or 7 without a migration plan are, according to the report itself, left with no way out other than a distribution backport, a vendor fix, or a full migration.

Source: ET Tech (India): "PHP security flaw: India activates emergency response; takes apps offline amid a global alert", The Economic Times.