New Delhi: Two critical vulnerabilities in PHP, a programming language widely used for web development, have set off a scramble among Indian companies, particularly MSMEs, to patch their websites.
The flaws could let hackers take control of internet-facing servers without logging in, potentially enabling data theft and the installation of malware. Around 67 per cent of websites on India's .in domain reportedly run on PHP.
The Computer Emergency Response Team (CERT-In) has urged organisations to identify vulnerable systems and install the latest security fixes. The flaws must be closed by applying the official patches, it said.
The government says most key public websites have been patched. Experts say the vulnerabilities stayed hidden for more than a decade. Precautionary action has been taken worldwide as well.
Cyber security experts say organisations running older versions of PHP are at the greatest risk. Failing to update regularly and weak access controls raise the exposure.
CERT-In's advisory asks organisations to run checks immediately, find unpatched systems and apply the fixes. The warning matters most for small businesses running websites, which often lack dedicated security staff.
Older, unpatched systems carry the greater risk. If the servers behind PHP websites are directly connected to the internet, attackers can take them over. Web administrators are therefore advised to run the latest version of PHP, keep their plugins updated and tighten access controls. Organisations are also being advised to have security experts audit their systems.
Web teams are advised to check their PHP version, apply the patches and review access logs for signs of intrusion.