Four Cybersecurity Alerts in Six Days: Are India’s Banks, Websites and Digital Systems at Risk?

Four major cybersecurity concerns reported in October 2026 have raised questions about the safety of India's digital infrastructure, with vulnerabilities affecting web software, digital certificates, AI tools and cloud platforms alongside a suspected State Bank of India (SBI) data leak.

The developments include two reported PHP vulnerabilities, a security failure involving eight eMudhra international digital certificates, malicious code allegedly inserted into an AI software package and claims of data theft involving SBI customers and Rajasthan Police.

While the incidents have exposed weaknesses across the digital ecosystem, there is no established evidence that they form part of a coordinated global cyberattack or that the internet is on the verge of collapse.

For Indian users, the immediate concern is whether personal information, online accounts and digital services are adequately protected against fraud and unauthorised access.

What Happened During the Six-Day Cyber Alert Period?

SBI investigated a suspected exposure of customer information, while security researchers identified weaknesses in international digital certificates associated with eMudhra. On October 21, reports of critical PHP vulnerabilities added to the concerns, followed by disclosures involving LiteLLM, cloud credentials and other software platforms.

A separate claim that Rajasthan Police data had been stolen also attracted attention, although the alleged breach remained unverified in the available material.

PHP Vulnerabilities Raise Alarm Across the Web

PHP is one of the most widely used programming languages for building websites and web applications. Estimates suggest it powers around 70% of websites, although the exact share varies according to the measurement method.

Two reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, triggered security concerns because they could allow unauthenticated attackers to execute arbitrary code on affected servers.

Associated with the name 'PHP2Shell', the flaws could potentially give attackers a route to compromise applications, steal information, install malicious software or gain further access to connected systems.

How were the vulnerabilities discovered?

Reports linked the discovery to AI-assisted security research involving cybersecurity companies Wiz and Calif. The supplied material also refers to OpenAI's reported 'Patch the Planet' initiative.

The reported discovery has drawn attention to the growing role of automated tools in identifying software weaknesses. However, the claim that the flaws had remained undetected for a decade requires independent verification.

What happened after the flaws were disclosed?

PHP developers released security updates for versions 8.5, 8.4, 8.3 and 8.2, according to the supplied reports. Website operators and hosting providers were urged to identify affected installations and apply the relevant patches.

Reports of increased scanning and attempted exploitation highlighted the urgency of the response. However, the vulnerability does not mean that 70% of websites have been hacked.

The actual risk depends on the software version, server configuration and whether the affected system has been patched. Administrators should also examine server logs for suspicious activity and replace credentials if they suspect unauthorised access.2. eMudhra Certificate Flaw Threatens Online Trust

A reported security failure involving eight international intermediate digital certificates issued by Indian company eMudhra raised concerns about the systems that help browsers verify website identities.

Digital certificates support HTTPS connections, which encrypt information exchanged between browsers and websites. They are used across banking, shopping, email and government services.

According to CERT-In's October 21 advisory, the affected certificates had private keys generated with insufficient cryptographic randomness. The weakness reportedly made the keys recoverable from their corresponding public keys.

If exploited, the compromised keys could potentially be used to create fraudulent certificates and impersonate websites to systems that continued to trust the affected certificate authorities.

How was the certificate problem contained?

The affected certificates were revoked on October 18. Google blocked the compromised public keys in Chrome, while Mozilla took steps to block the affected certificates and issued relevant security updates.

Google also announced plans to remove the associated root certificate from the Chrome Root Store, with the change scheduled for October 27 on supported devices. Website operators relying on affected certificate chains were advised to obtain replacements.

The available disclosures did not establish confirmed malicious exploitation of the compromised keys as of CERT-In's October 21 advisory.

Are Indian digital signature certificates affected?

CERT-In distinguished eMudhra's international website-security certificate business from its domestic digital signature certificate (DSC) and eSign services.

The advisory stated that India's domestic DSC and eSign infrastructure remained unaffected because it uses separate cryptographic keys and an isolated architecture. Digital signatures used for tax filings, government tenders and corporate transactions should therefore not be confused with the compromised international website certificates.

The incident nevertheless had major business consequences. On October 22, eMudhra announced its exit from the global website-security certificate business following the security lapse and the loss of trust from major technology companies.

The episode demonstrates how a failure in cryptographic key generation can damage confidence in a digital trust provider, even when the reported weakness is confined to a specific set of certificates.

AI Software and Cloud Platforms Face Security Threats

Cybersecurity risks extend beyond banks and government websites. Software developers increasingly depend on open-source packages, cloud infrastructure and AI tools, making these systems potential targets for attackers seeking access to sensitive credentials.

LiteLLM: Malicious code in an AI package

LiteLLM is an open-source platform that connects applications with large language models and other AI services.

Reports published on October 22 said attackers had compromised its software release process and inserted malicious code into version 1.107.0, distributed through Python package and container repositories.

The code was reportedly capable of stealing API keys, passwords and other credentials. Depending on the permissions attached to those credentials, attackers could potentially access AI services, databases and connected applications.

The affected release was withdrawn, but organisations that installed it may still need to investigate their systems. Removing the package alone will not protect credentials that may already have been stolen.

Developers should check affected installations, revoke exposed keys, replace passwords and review access logs for suspicious activity.

Railway: Cloud credentials potentially exposed

Cloud platform Railway disclosed a separate incident involving potential unauthorised access to customer environment variables.

These variables can contain database passwords, API keys and other confidential information used to operate applications. If exposed, they may provide attackers with access to connected services.

Railway reportedly reset certain customer credentials as part of its response. Customers were advised to review their systems and replace potentially compromised secrets.

The incident highlights the need to restrict access to cloud credentials and ensure that applications receive only the permissions they require.

GitLab and Node.js vulnerabilities

GitLab, a platform used to manage software development and code releases, was also mentioned in reports concerning vulnerabilities affecting older versions. The precise scope of the claim requires verification against the relevant security advisory.

Node.js also released security updates addressing vulnerabilities involving certificate verification and remote code execution, including changes related to the eMudhra incident.

These developments illustrate how a weakness in one software component can affect applications and services that depend on it.

SBI Data Leak: Thousands of Customer Records Reportedly Identified

The suspected SBI data leak has raised concerns about the security of customer information held by India's largest public-sector bank.

According to reports, a hacker using the alias 'Siriussim' claimed to possess information linked to approximately 375,000 SBI customer records.

SBI's preliminary analysis reportedly identified 3,897 customer records containing personal information in the dataset. The reported information included names, mobile numbers, email addresses, dates of birth, customer identifiers and loan-related details.

The two figures represent different claims: the number of records allegedly held by the hacker and the number of customer records reportedly identified through the bank's preliminary review.

SBI said its core banking operations were unaffected. The investigation focused on establishing the scope of the suspected exposure and the type of information involved.

How could the alleged leak affect customers?

Personal information can make fraud attempts more convincing. Criminals who obtain names, contact details and loan-related information may use them to impersonate bank employees or send targeted messages about loans, account verification and outstanding payments.

A data leak does not automatically give criminals access to bank accounts or enable them to withdraw money. The risk increases if exposed information is combined with stolen passwords, OTPs or other authentication details.

Congress leader Pawan Khera reportedly questioned SBI's internal audit and disclosure processes, raising concerns about how the suspected breach was detected and communicated.

Investigators need to establish how the information was obtained, whether the exposure is continuing and what safeguards may have failed. Customers also need clear guidance on the risks and any steps they should take.

Rajasthan Police Data Theft Claim Remains Unverified

A hacker group calling itself 'Scarlettgroup' reportedly claimed to have stolen 6.63 GB of data associated with Rajasthan Police.

The group allegedly claimed the dataset contained around 70,000 identity records, 59,460 mobile numbers, FIR copies, e-KYC records, email details and witness statements.

However, the available material does not establish that Rajasthan Police or an independent investigation agency has confirmed the breach.

A hacker's claim does not, by itself, prove that the data is authentic, that the stated number of records is accurate or that the information was obtained through the alleged intrusion.

If confirmed, the exposure of police records could have consequences beyond identity theft. FIRs and witness statements may contain sensitive information about complainants, witnesses and investigations.

Authorities would need to establish the authenticity of the material, identify the systems involved and determine whether any individuals face additional risks.

India's Data Protection Law and Potential Penalties

India's Digital Personal Data Protection Act, 2023, establishes obligations for organisations that handle digital personal data.

Reports have referred to penalties of up to ₹200 crore for certain failures to report personal data breaches. However, the applicable penalty depends on the relevant legal provision, the circumstances of the violation and the commencement of the applicable requirements.

The law is being implemented in phases, so specific deadlines should be checked against official government notifications rather than assumed to apply uniformly to every incident.

Banks, technology companies and public institutions must comply with the applicable data protection and security requirements. When breaches occur, timely investigation, appropriate reporting and clear communication are essential to protecting affected individuals.

Is the Internet Really on the Verge of Collapse?

The concentration of cybersecurity disclosures within a few days fuelled claims on social media that a massive global attack had brought the internet close to collapse.

One claim attributed to influencer Taegun Lee, whose account is identified as @TGletter in the supplied material, reportedly described an unprecedented attack unfolding within 48 hours.

The available evidence does not establish an imminent internet collapse or show that the reported incidents were coordinated.

A critical PHP vulnerability does not mean every website using PHP has been hacked. The compromise of eight intermediate certificates does not invalidate every certificate issued by eMudhra. Similarly, a hacker's claim to possess a database does not prove that every record is authentic or that the alleged breach has been confirmed.

Each incident requires a different response. Vulnerable software must be patched, compromised certificates revoked and replaced, exposed credentials rotated, and suspected data breaches investigated.

The internet is a distributed network of systems operated by different organisations. Individual services and networks can suffer serious disruption, but that is not evidence that the entire internet is about to fail.

Researchers can use AI-assisted tools to examine code, detect unusual patterns and identify vulnerabilities that conventional testing may overlook. Automation can also help developers investigate flaws and prepare fixes.

The same capabilities can help attackers automate reconnaissance, analyse exposed systems, develop malicious code and create convincing phishing messages.

How Can Users and Businesses Protect Themselves?

Most of the reported vulnerabilities require action from software developers, banks, cloud providers or website administrators. Individual users cannot repair vulnerable servers, but they can reduce their exposure to fraud.

• Update software regularly: Install security updates for operating systems, browsers, applications and devices. Businesses should identify affected versions and prioritise critical patches.
• Use strong, unique passwords: Avoid reusing passwords across services. A password manager and multifactor authentication can reduce the damage caused by stolen credentials.
• Never share OTPs or PINs: Fraudsters may use leaked personal information to impersonate bank officials. Do not disclose passwords, OTPs, PINs or full card credentials in response to unsolicited calls or messages.
• Check website addresses: A padlock indicates an encrypted connection, not that a website is necessarily genuine. Use verified addresses or trusted applications to access banking and government services.
• Replace exposed credentials: Organisations using affected software or cloud platforms should revoke potentially compromised keys, reset passwords and investigate unusual access.
• Report financial fraud promptly: Contact the bank through official channels and report unauthorised transactions to the appropriate cybercrime authorities.
• Secure software supply chains: Developers should use trusted package repositories, review dependencies, restrict permissions and monitor software releases for malicious changes.

Users should also avoid downloading untrusted software and take browser security warnings seriously.