eMudhra, PHP security scare: Govt to hold high-level review, audit to assess potential damage

The central government is likely to soon hold a high-level review and audit meeting to assess potential damage to Indian enterprises following a series of cybersecurity incidents in recent days, including vulnerabilities in PHP, compromised digital certificate keys linked to eMudhra and warnings about artificial intelligence-powered agents accessing live corporate networks.

According to a report in Business Standard that cited sources, the review is expected to examine vulnerabilities in PHP, a widely used server-side scripting language, the leak of private keys associated with web security certificates issued by eMudhra, and a recent communication from the Indian Computer Emergency Response Team (Cert-In) warning that AI-powered agents had reached the live networks of Indian organisations.

MUST READ | BT BIG STORY: What happens when the keys to internet security are no longer secret

A senior government official told the financial daily that the incidents had highlighted weak cybersecurity preparedness among Indian enterprises, particularly micro, small and medium enterprises. Some organisations store credentials in plain text, while many continue using default passwords provided during installation, the official said.

Cert-In had warned earlier this week that providers of frontier AI models informed it and the Ministry of Electronics and Information Technology that their models and agents had reached the live systems of several Indian organisations during research and evaluation. The activity included accessing business records, personal data and confidential material through credentials and connection settings exposed in application configurations, public code repositories and permissive cloud-service roles.

DON'T MISS | From compromised certificates to malicious software: Inside October’s cybersecurity alerts

In a separate advisory, Cert-In said private keys used for eMudhra’s digital certificates had been generated with insufficient cryptographic randomness, leading to their compromise. The agency subsequently issued another advisory asking companies to install patches addressing PHP security flaws following a global outage linked to the vulnerabilities.

Bengaluru-based eMudhra, founded in 2008, has issued more than 60 million digital certificates. Such certificates help browsers verify website authenticity and establish secure connections.

On Thursday, eMudhra said it would voluntarily withdraw from the global SSL/TLS certificate business following the vulnerabilities. Google, Mozilla, Apple and Microsoft blocked certificates issued by the company after the flaws came to light.

MUST READ | What are eMudhra certificates? What to know about the security scare and could your data be at risk?

The company said it had withdrawn eight certificates, adding that its infrastructure had not been compromised and no data had been breached. It said the SSL/TLS business accounted for 1% of its revenue.

An independent cybersecurity researcher had found several weak certificates over the weekend, while Cert-In said some of eMudhra’s intermediate certificates were compromised. The company’s shares fell 40% over the two days after the vulnerability was disclosed.