Tech News, October 22: php2shell Goes Global — Government Sites Go Dark, SBI Breach, and eMudhra’s Broken Certificates

The emergency PHP patches from yesterday turned into a rolling internet outage today, as governments across Europe and beyond pulled websites offline rather than risk them being exploited. India had two security disclosures of its own: a dark-web data dump tied to the country’s largest bank, and a certificate-authority breach that forced browsers to intervene. Today’s rundown: what broke, what the numbers say, and what to patch.

1. php2shell goes live: governments pull websites offline

Yesterday’s emergency PHP fixes became today’s live fire drill. After the PHP team released patched versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for the two critical remote-code-execution flaws, now tracked as CVE-2026-109618 and CVE-2026-109619 with a severity score of 9.2 out of 10, government agencies in the Netherlands, Finland, France, Denmark and Australia took websites offline as a precaution, according to Reuters and European press.

The Dutch government shut down its DigiD digital identity system and parliamentary portals; Finland’s state IT provider Valtori pulled public network services; France’s Interior Ministry put its prefecture websites into preventive maintenance. The fallout reached beyond government: the Wikimedia Foundation took some systems offline, affecting parts of Wikipedia, and the Internet Archive briefly went dark to patch. The Dutch prime minister said he was monitoring the situation, and Japan’s Prime Minister Sanae Takaichi told site owners on X to check whether their sites run PHP and prepare to apply the fix.

The flaw details are unsettling for the patching effort ahead. The bugs were found with AI assistance — cybersecurity firm Calif using a large language model on August 1, and independently Wiz using its Atlas tool plus Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol — and had sat in PHP’s codebase for over a decade. Wiz said the flaws would have been “extraordinarily complicated” for a human attacker to exploit, but AI removes that barrier: “Pre-AI, this manual work would be difficult to implement and even harder to scale. With AI, this is no longer a barrier.” Because the patch landed only after the details leaked on social media, that AI-assisted reversal now works for attackers too.

Evidence the race is already on: Amazon’s security chief said the company’s honeypot decoys detected an exploit attempt against the flaws on October 17, four days before public disclosure. Cloudflare said it was updating firewall rules as a stopgap only, urging everyone to patch. The hardest number: Censys data shows 1.5 million out of 2.6 million internet hosts report running a PHP version for which there is no fix — versions too old for the new patches. CISA has dubbed the pair “php2shell”, and the EU’s CERT advises isolating exposed applications from the internet if patching isn’t possible.

Why it matters: this is the sharp edge of AI-found vulnerabilities — discovery now outruns the patch pipeline, and for the long tail of unmaintained PHP servers there is no patch at all. If you run a WordPress site, note Wordfence’s warning: automatic updates will not apply this fix; the PHP version on the server has to be updated separately.

2. SBI confirms 3,897 customer records on the dark web

The State Bank of India, the country’s largest lender, disclosed to stock exchanges on Wednesday that personally identifiable information of 3,897 customers has been found on the dark web. The bank received alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency, and CERT-In. A preliminary review of 375,000 records found exposed data including customer names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers, and metadata tied to loan and lead records.

SBI said the incident had no material impact on operations and that core banking functions continue normally; an independent cybersecurity assessment is underway. The market reacted anyway: SBI shares fell 0.88% to ₹963.90. Analysts quoted in the Indian press noted that even the records without obvious PII should not be considered harmless, since lead IDs and loan metadata can enable targeted phishing and impersonation.

Why it matters: 3,897 confirmed records from a bank of SBI’s scale is small, but the exposure window and the 375,000-record pool under review suggest the count could move. For customers, the practical risk is social engineering: real names, phone numbers and loan details are exactly what phishing calls are built from.

3. CERT-In warns of fake websites after eMudhra certificate breach

India’s CERT-In warned on Thursday of website-impersonation and malware-signing risks after a security flaw at eMudhra, a digital security provider, compromised eight digital certificates whose private keys could be recovered. Recovered private keys can be used to create fraudulent website certificates or make malicious software appear to come from a trusted publisher — the kind of attack that defeats the browser padlock.

The incident was reported on October 17, and browsers moved fast: Google blocked the affected public-key hashes in Chrome and Mozilla implemented protections in Firefox. CERT-In’s warning keeps the risk window visible: any certificate issued before the block is still a candidate for abuse in less-maintained environments.

Why it matters: certificate authority failures are rare and high-leverage — one compromised key can impersonate any site. The quick browser response is the system working as designed, but it is worth checking that Chrome and Firefox on your machines are up to date.

4. Yonsei University breach exposes 10,000+ people

Yonsei University in Seoul announced Thursday that unauthorized access to its Yonsei Portal Service exposed personal information of more than 10,000 students and alumni, including student ID numbers, mobile phone numbers, email addresses and some system management data. The university said it blocked the access route, reported the incident to law enforcement, and apologized to those affected.

The breach continues a rough year for South Korean universities: Sogang University disclosed in August that roughly 180,000 records — names, IDs, departmental affiliations, emails, phone numbers and encrypted passwords — were compromised after attackers went undetected for three days.

Why it matters: universities hold decades of alumni identity data and often run legacy portals. Two breaches in two months at major Seoul institutions suggest attackers have noticed.

The numbers at a glance

Key takeaways

• If your stack runs PHP, the php2shell pair (9.2 severity, unauthenticated RCE) is patch-now territory — and WordPress auto-updates will not fix it for you; the server’s PHP version must be updated.
• AI now finds vulnerabilities faster than organizations patch them. The next wave of long-hidden bugs will arrive with the same compressed timeline.
• SBI and Yonsei customers should treat any unexpected calls or messages referencing real account or loan details as hostile until proven otherwise.
• Keep Chrome and Firefox updated after the eMudhra certificate block — unpatched browsers are the gap that remains.

References

• Government websites go dark after AI-discovered flaw sparks security scramble (Reuters via Daily Maverick)
• Global alert over two critical PHP flaws forces government websites offline (MercoPress)
• Europe takes government websites offline after AI uncovers critical PHP security flaws (News18)
• What is PHP software? Critical security flaw forces government websites to shut down (Times Now)
• SBI reports customer data breach, 3,897 records found on dark web (Telegraph India)
• Cyberattack hits SBI; nearly 4k customers’ data leaked to dark web (Deccan Herald)
• CERT-In flags website impersonation risks over eMudhra breach (Financial Express)
• Yonsei University data breach affects over 10,000 people (Aju Press)