303 Government Websites Vulnerable to PHP2Shell in India Explained: CERT-In's 60,000-Site Warning, What It Means and What to Patch (India Tech)

Image: Wikimedia Commons / Cvvaecc (freely licensed) — the PHP logo. PHP powers a large share of the world's websites, including many government portals.

TL;DR — 303 government websites vulnerable to PHP2Shell in India explained: CERT-In has flagged 303 government, state-owned and critical-sector websites as potentially vulnerable to PHP2Shell, the pair of critical PHP flaws rated 9.2 out of 10. The 303 sites are part of about 60,000 Indian websites flagged in total, and CERT-In has seen active attempts to exploit the flaws. The key caveat: "potentially vulnerable" does not mean hacked — the flagged sites must still verify their status and patch. If you run a PHP website, update to a fixed release now; everyone else should know why some government portals may briefly go offline while they patch.

📌 KEY HIGHLIGHTS

• The news: MeitY Secretary S Krishnan told The New Indian Express on 25 October 2026 that CERT-In flagged 303 government, state-owned and critical-sector websites as potentially vulnerable to PHP2Shell.
• The breakdown: 89 central government bodies, 80 state and union territory governments, 27 central public sector undertakings, 24 state-owned companies and 83 critical-sector organisations — 303 in total.
• The wider picture: the 303 are part of about 60,000 Indian websites CERT-In has identified as potentially vulnerable to the same two flaws.
• The caveat that matters: these are potentially vulnerable instances flagged for verification, not confirmed vulnerable installations — and not evidence of compromise.
• The urgency: CERT-In has observed, and received reports of, active attempts to exploit PHP2Shell, and has shared indicators of compromise with key organisations. How many sites are patched as of 23 October is still "under assessment".

What happened?

PHP2Shell is the name given to two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Exploiting either can let an attacker run code on a web server without logging in — the classic recipe for taking over a website and reaching the databases behind it. PHP released fixed versions on 21 October 2026, and our PHP2Shell patch guide covered what website owners needed to do that week.

The new development is the scale of India's exposure, revealed by S Krishnan, Secretary of the Ministry of Electronics and Information Technology (MeitY), in an interview published on 25 October 2026. CERT-In, India's national cyber agency, scanned for the flaws and flagged roughly 60,000 Indian websites — and within that total, 303 belonging to government, state-owned and critical-sector bodies. The National Informatics Centre (NIC) and UIDAI are patching on a priority basis, according to the earlier 23 October report, and Tamil Nadu told its departments to assess their applications by 22 October and take them offline if patches could not be applied immediately.

303 government websites vulnerable to PHP2Shell in India: the breakdown

Category	Websites flagged	What it covers
Central government bodies	89	Ministries and central departments
State and union territory governments	80	State government portals and services
Central public sector undertakings	27	Central PSUs
State-owned companies	24	State-level public enterprises
Critical-sector organisations	83	Banking, energy, telecom and other critical infrastructure
Total	303	Government, state-owned and critical-sector sites

Image: Wikimedia Commons / Yuri Samoilov, CC BY 2.0 — PHP code (illustrative; the flaws are in the PHP runtime itself, not in any single website's code).

Why it matters for India readers

Three things make this more than a routine patch notice. First, the target list is the country's own digital front door: government portals hold citizen records, applications and payments, so a compromised portal is a data-breach risk, not just a defaced homepage. Second, attackers are already trying: CERT-In says it has seen active exploitation attempts, so the window between disclosure and attack is already closed — unpatched servers are being probed now. Third, the numbers are still moving: with patch status "under assessment" as of 23 October, nobody can yet say how many of the 303 are fixed, which is why MeitY has separately directed industry bodies to tighten security certifications and audits, as Deccan Herald reported on 25 October.

There is also a practical consequence for ordinary users: some government services may briefly go offline while departments patch or, as Tamil Nadu advised, take vulnerable applications off the internet until they are fixed. A portal being temporarily unavailable can be a sign that it is being secured, not that it has been attacked.

Should you care?

✅ If you run a PHP website: patch today. Move to a fixed release — 8.5.12, 8.4.27 or 8.3.36, or your branch's patched build — restart the server, and check logs and CERT-In's indicators of compromise for signs of intrusion. If you cannot patch immediately, follow CERT-In's mitigation steps or take the application offline, as Tamil Nadu's departments were told to do. ⏳ If you only use government websites: nothing to patch yourself — but be patient with brief outages, and treat any "urgent security" message asking you to re-enter credentials on a government portal with suspicion until you have verified it through the official site.

FAQs

Have 303 government websites been hacked? No. CERT-In flagged 303 government, state-owned and critical-sector websites as potentially vulnerable to PHP2Shell. MeitY Secretary S Krishnan stressed that the figures "represent potentially vulnerable instances identified for further verification and do not constitute confirmed vulnerable installations" — they are a to-do list for verification and patching, not a list of breaches.

What is PHP2Shell? It is the collective name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Together they allow unauthenticated remote code execution: an attacker can run commands on a web server without a login, and potentially reach connected databases.

Which PHP versions fix PHP2Shell? The fixed releases published on 21 October 2026 include PHP 8.5.12, 8.4.27 and 8.3.36, with patched builds for other supported branches. CERT-In advises upgrading to the latest patched version as the only effective remedy — simply disabling a feature or blocking a page is not a fix.

What should website owners do besides patching? Check web-server logs and CERT-In's indicators of compromise for exploitation attempts, rotate any credentials the web server could read if you find signs of intrusion, and verify the fix by confirming the running PHP version. The same "patch first, verify after" pattern applies to other actively exploited flaws — see our coverage of the CISA KEV Collabora and VeloCloud flaws, where a KEV listing meant exploitation was already under way.

Takeaway: 303 flagged government sites out of 60,000 flagged Indian websites is a measure of exposure, not of damage — but with attackers already probing for PHP2Shell, every unpatched server is a live target. The fix exists and has existed since 21 October; the race now is verification and patching, and the public sign of progress may be a portal briefly going dark while it gets secured.

Follow India Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• The New Indian Express — MeitY secretary says 303 government websites are vulnerable (25 Oct 2026)
• The New Indian Express — India's cybersecurity agency has flagged 60,000 vulnerable PHP sites (23 Oct 2026)
• Deccan Herald — MeitY directs industry bodies to strengthen certifications, security audits (25 Oct 2026)