Experts warn India could be hit even harder. Governments and businesses worldwide are racing to fix two critical flaws in PHP, a programming language used by about 7 in 10 websites, including those built with WordPress.
The issue was so critical that Japan’s prime minister had to post on X about it, and many European sites took themselves down temporarily as a precaution so that attackers could not exploit those vulnerabilities before they were patched by security updates released by the PHP development team on October 21.
Organisations also need to find out whether they lost any data in any attack before they could patch their systems,” Dubey told NDTV Datafy, warning that many Indian companies and government departments might be ill-prepared to tackle security scenarios where time is key. Organisations with dedicated security teams may be better equipped to respond quickly. But universities, agricultural institutes and government departments with limited technical resources may need more time to identify affected systems and coordinate updates. They may face attacks before they could fix the issue. Linux distributors and commercial vendors may supply fixes Although hosting providers. Organisations without access to those fixes may need to move to a supported version. Thousands of private and government websites, including those of Kerala Police, FSSAI, Bhubaneswar Smart City and the Indian Railways Institute of Financial Management, and the West Bengal Health Department, are running older PHP versions in full or in part, Shodan records indicate. It’s not clear how many of them have already applied the security fix. “It’s not just about fixing the vulnerability.
Around 15 per cent of PHP websites still use older versions that no longer receive security updates from the PHP project, according to web technology survey platform W3Techs. Cloudflare, an internet security company, said it recorded thousands of exploit attempts across the network in the 10 hours before the loopholes were revealed publicly.
A scan on Shodan, a search engine for internet infrastructure, returned 53,019 results identifying PHP on servers located in India, including 234 associated with government domains ending in “.gov.in”, as of October 22, 2026. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now,” Matthew Prince, the CEO of internet security company Cloudflare, said on October 22.
