PHP security flaw: India activates emergency response; takes apps offline amid a global alert

Mumbai | New Delhi: Indian organisations are activating emergency response, taking applications offline, checking websites for intrusion and pressing technology vendors for emergency updates after two critical security flaws in PHP-the software programming language which forms the core of 70% of the internet-triggered a global security scramble.

Banks have begun auditing applications for weaknesses, taking some non-critical services offline and preparing backups to divert traffic if parts of their websites or mobile applications experience downtime, according to banking executives.

Also read: From eMudhra to PHP: Breach spree hits tech infrastructure, AI emerges as threat multiplier


The Indian government has also started immediate patch-fixing for scores of official websites which may be targeted by hacker groups. However, no attempts have been noted yet, officials said.

Financial services firm Razorpay said it has created a security posture that uses AI to discover and patch security flaws at machine speed.

It has also issued advisories to merchants on immediate steps to prevent breaches at their end.

Also read: What eMudhra security incident means for anyone who shops, banks or pays online

"I have been stressing the fact that AI models can identify and attack security vulnerabilities that traditional human-based detection systems aren't prepared to handle," said Harshil Mathur, cofounder and CEO of Razorpay.

"What I am worried about is that PHP flaws can target roughly 70% of the internet. This can have long-lasting repercussions, as personal data can be used to carry out social engineering attacks."