🚀 Science
CERT-In and states rush to patch PHP flaws on thousands of government websites
In 60 seconds: India's cyber agency CERT-In is working with state teams to quickly patch thousands of government websites after two critical flaws were found last week in PHP, a widely used programming language. The flaws were discovered with the help of AI. Health and banking sites holding citizens' personal data are being fixed first. Key national platforms such as Aadhaar and UPI do not run on PHP.
Why it matters
Government sites hold names, health records and bank details. An unpatched flaw could let attackers steal or alter that data.
Explain it simply
If the lock maker announces a flaw in a popular lock, every chai shop using it must change the lock quickly, starting with shops that keep the most cash. Patching is changing that lock.
The 3-minute read
What happened
CERT-In has held meetings with state Computer Security Incident Response Teams (CSIRTs) and IT departments, and with sectoral CSIRTs for finance, power and telecom. It advised organisations to apply security patches.
Background
Thousands of state portals, district websites, municipal services and grievance systems run on PHP-based software. The National Portal of India links to more than 6,700 government websites.
How it works
The IT ministry said the Aadhaar portal, the GST Network, UPI and the MCA21 company portal use Java, .NET or other stacks. A bigger worry is older PHP versions 5 and 7, used by some banks, telecom and power firms, which no longer receive fixes.
What's next
Agencies will keep watch and patch where needed. Experts say India must move from reacting to attacks towards detecting threats early, as AI lets attackers find weaknesses faster.
What it means for you
Keep your phone and browser updated, and be wary of messages asking you to log in to a government site through a link.
Key numbers
- 2: Critical PHP flaws found last week
- 6,700+: Government websites linked via the National Portal
- 5 and 7: Old PHP versions with no fix
Both sides
- IT ministry: Major national platforms are not built on PHP, and their operations are not disrupted.
- Security experts: India needs early threat detection, not just quick patches after each scare.
Key terms explained
- CERT-In
- India's national agency that responds to cyber security incidents.
- Patch
- A software update that closes a security hole.
The story so far
- 2004: CERT-In begins work as India's cyber emergency team. The Indian Computer Emergency Response Team started in 2004. The IT (Amendment) Act, 2008 made it the national agency for cyber incident response under Section 70B.
- Oct 2026: eMudhra digital certificate lapse flagged. Last week CERT-In flagged a digital certificate lapse at eMudhra. The IT ministry said domestic digital signature certificates were unaffected and ordered a probe into a key-generation failure.
- Today: CERT-In rushes patches for PHP flaws
Exam notes (UPSC, SSC, Banking, PSC)
- CERT-In is the national nodal agency for cyber incident response under Section 70B of the IT Act, 2000.
- CERT-In comes under the Ministry of Electronics and Information Technology (MeitY).
- A patch is a software update that fixes a security flaw.
- CSIRT stands for Computer Security Incident Response Team.
Likely exam question: What is the role of CERT-In? Why do outdated software versions pose a cyber risk to public services?