CHENNAI: India’s cybersecurity agency has identified 60,000 websites running vulnerable PHP installations and alerted their operators, as government bodies race to fix security flaws that could expose systems to cyberattacks, Ministry of Electronics and Information Technology (Meity) Secretary S Krishnan said.
Responding to queries from TNIE on two critical vulnerabilities in PHP, a programming language widely used to run websites, Krishnan said the Indian Computer Emergency Response Team (CERT-In) had advised organisations to upgrade to the latest patched version, the only effective remedy.
“NIC, UIDAI and other government agencies are undertaking patching actions on a priority basis,” he said, referring to the National Informatics Centre and the Unique Identification Authority of India. The TN government has asked departments to consider taking applications running vulnerable PHP versions offline if patches cannot be applied immediately.
PHP flaw: Extent of impact on govt websites still unclear
State IT Secretary Atul Anand said departments had been told to check whether their applications use affected versions and to install security updates as a priority. Where immediate patching is not feasible, they may follow CERT-In’s mitigation measures or, with permission from the respective departments, disable internet access to the applications.
“Some of the departments, including HR&CE and Police, have started the patch updates,” Anand said. The state government has set a deadline tonight (October 22) for departments to complete assessment and remedial action.
Tamil Nadu is relaying alerts from CERT-In and NIC-CERT to departments through its TN-CERT project, run by the Tamil Nadu e-Governance Agency (TNeGA) and the Directorate of e-Governance.
The extent of the state’s exposure remains unclear. The assessment is under way, and the government has yet to establish how many state websites and portals use PHP, or how many run vulnerable versions. Anand said no exploitation attempts or security incidents had been detected in the state’s government IT infrastructure so far.
CERT-In issued a vulnerability note on October 21, urging organisations to apply security updates and mitigation measures. It has also advised central and state government bodies to assess their exposure, prioritise patch deployment, and secure vulnerable systems promptly.
The scale of exposure among government websites and critical information infrastructure remains unclear. CERT-In has not specified how many of the 60,000 websites fall into these categories.
