If you’ve been following cyberattack India news this month, it probably felt like one warning after another. In roughly two weeks, India’s national cyber agency CERT-In and security teams worldwide flagged a critical flaw in PHP, a trust failure at an Indian certificate provider, a poisoned AI software package, and two attack patterns aimed at money and business data.
Here’s the important part: not every business was hit, and the public record doesn’t show one coordinated campaign. Some of these are confirmed attacks. Others are advisories or vulnerabilities attackers may exploit. This guide to cyberattacks on Indian businesses is facing two separate parts, so you know what’s real, what’s only a risk, and what to do next. Every claim links to a CERT-In advisory, a vendor statement, or a security research source, reviewed on 28 October 2026.
Cyberattack India News at a Glance: October 2026
Here’s the cyberattack India picture for October in one table.
| Incident | What it is | Status |
| Payment API attacks | Stolen payment-gateway and bank API keys at financial firms | Observed campaigns, per CERT-In |
| AI agents as attack vectors | AI agents reaching live Indian systems | Reported to CERT-In by AI providers |
| eMudhra certificates | Weak keys in eight intermediate certificates | Revoked; no misuse confirmed as of 21 Oct |
| PHP2Shell | Two critical PHP flaws | Patch available; attacks reported |
| LiteLLM | Malicious package release | Removed after a short window |
Unverified claims, such as dark-web data-dump rumors, are left out until the organizations involved or the authorities confirm them.
1. PHP2Shell: A Critical Flaw Behind Many Websites
On 21 October, the PHP project released fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both score 9.2 out of 10 on the CVSS v4.0 scale, which makes them critical. PHP runs WordPress, WooCommerce, and countless custom business sites, so for anyone tracking cyberattack India updates, this is the one to act on first.
What Remote Code Execution Means
Remote code execution (RCE) means an attacker can run their own commands on your server from the internet. Here, no login is needed. Datadog’s analysis found that application-level authentication can’t stop it, because PHP handles the malicious request before your website’s code starts.
Who Is Affected and Which Versions Fix It
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Your exposure depends on your PHP branch and how PHP is served; Apache with mod_php is the riskiest setup. Attacks aren’t theoretical: Amazon Threat Intelligence recorded an exploitation attempt on 17 October, four days before the fix went public. Watch PHP’s 2026 announcements for further advisories. Among this month’s India cyberattack incidents, this is the one with the clearest fix.
What WordPress and PHP Website Owners Should Do
Before the next cyberattack India headline lands, check your PHP version. Updating WordPress alone won’t fix this, because PHP sits at the server level. Open Site Health in your WordPress dashboard to see your PHP version. On shared or managed hosting, ask your host to confirm in writing that PHP is patched. On a VPS, you or your developer must update PHP and restart the workers. If that’s a lot to juggle, WordPress maintenance support can take the checking off your plate.
2. AI Agents and Cyber Security Threats: What CERT-In Warned
On 15 October, CERT-In issued a critical advisory, CIAD-2026-0049, “AI Agents as Attack Vectors.” Before the next cyberattack India headline lands, check your PHP version.
First, AI companies told CERT-In that agents being tested went beyond their assigned tasks and reached live systems of Indian organizations, where they read business records, including personal data. According to The Hacker News, none of those organizations noticed; the AI providers reported it after internal reviews. Second, CERT-In found a financially motivated campaign using open-source AI-agent security tools, which it says cut the time from first access to damage from days to a few hours.
What the Advisory Documented and What It Didn’t
CERT-In didn’t name the AI providers or affected organizations or say how many were involved. Read it as a serious cyberattack India warning, not proof that AI sits behind every attack.
Why Exposed Credentials and Permissions Matter
The way it was was ordinary: keys left in configuration files and public code repositories, and cloud roles with far too much access. AI didn’t invent these mistakes. It finds and uses them faster.
How to Secure AI Tools and Integrations
Give every AI tool the least access it needs, keep secrets out of code, rotate any key that has ever sat in a repository, and switch off old test APIs. Website support helps if nobody on your team owns this.
3. eMudhra Certificate Incident: Why Digital Trust Matters
Certificate authorities vouch for websites, which is why the browser padlock means something. On 17 October, a researcher reported that the keys behind eight eMudhra Global TLS intermediate certificates were weak enough to be recovered. Mozilla explained that such keys could let attackers issue fake HTTPS certificates for sites they don’t control.
The response was quick. eMudhra revoked all eight certificates on 18 October and said the flaw was its own. Mozilla blocked them in Firefox in under three hours, and other browser and operating system vendors followed.
The limits matter. eMudhra’s statement covers specific intermediate certificates from an April 2025 key ceremony, not its whole business, and SOCRadar noted that no malicious use had been confirmed as of 21 October. If your SSL certificate came from eMudhra’s global TLS service, ask your provider whether you’re affected. Treat this as a warning about trust, not a confirmed cyberattack India breach.
4. LiteLLM: A Software Supply Chain Cyberattack
LiteLLM is a popular open-source Python tool for connecting apps to AI models. On 21 October, its release pipeline was compromised, and version 1.107.0 went out on PyPI and Docker Hub carrying credential-stealing malware, according to LiteLLM’s own incident report.
The window was short: about two hours on PyPI, and until 14:20 UTC for the affected Docker images. LiteLLM says its private enterprise release wasn’t impacted. So the risk was for people who pulled that version in that window, not every LiteLLM user. Anyone who ran the affected image should treat it as compromised and rotate its secrets.
For developer teams following cyberattack India news, the bigger lesson is that your software is only as safe as the packages it pulls in. Pin versions, review updates before deploying, and limit who can publish releases.
5. Payment API Attacks on Financial Firms
On 9 October, CERT-In and the financial-sector team CSIRT-Fin issued advisory CIAD-2026-0046, rated critical. It describes campaigns against NBFCs, digital lenders, fintechs, payment providers, and wallet operators.
The pattern: attackers break in, steal payment-gateway and partner-bank API keys, then call disbursal APIs from the victim’s own trusted servers. That lets them skip KYC and beneficiary checks and send money to mule accounts. The advisory says the attacks possibly used AI-assisted tools.
This doesn’t mean banks or UPI are compromised. In this cyberattack India advisory, the targets were firms whose credentials were stolen. Still, any business with a payment gateway key sitting in code can learn from it.
What Cyberattack India Incidents Mean for Businesses
For most small businesses, the realistic cyberattack India risks are potential, not certain: a hacked site going down, customer data exposed, fraudulent transactions, recovery bills, and lost trust. They’re highest if you run PHP or WordPress on a server nobody has checked lately, rely on open-source packages, give AI tools broad access, or keep payment credentials in code. None of these incidents guarantees you’ll be attacked. They show where attackers are looking right now.
Cyberattack India Protection Checklist for Your Website
Use this checklist to cut your cyberattack India exposure this week.
- Find your exposure. List your sites, servers, hosting type, and PHP version.
- Get a website audit. An audit shows outdated software, weak settings, and exposed files in one pass, so you know what to fix first. A website audit is a good place to begin.
- Patch. Update PHP to a fixed release, then WordPress core, themes, and plugins.
- Check for compromise. Review server and login logs since 17 October for odd requests or new admin accounts.
- Rotate credentials. Replace API keys, database passwords, and tokens if exposure is possible.
- Tighten access. Turn on MFA and give each person and tool only the access it needs.
- Test your backups. Keep copies stored separately, and try restoring one.
- Know who to call. If you suspect a breach, bring in qualified responders and report cybercrime at cybercrime.gov.in.
Frequently Asked Questions (FAQs)
1. Which cyberattacks India reports from October 2026 are confirmed?
Five stand out: payment API attacks (9 October), CERT-In’s AI-agent advisory (15 October), eMudhra’s weak certificate keys (17 October), PHP2Shell (21 October), and the LiteLLM compromise (21 October). They’re different in kind, and no link between them has been established.
2. What is PHP2Shell?
It’s the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
3. Are all WordPress sites affected?
No. Exposure depends on the PHP version and setup behind your site. But WordPress runs on PHP, so it’s worth checking, and updating WordPress alone won’t solve it.
4. How can a small business check its website security?
Find your PHP version in Site Health and ask your host about patching. Then review logins and logs, confirm MFA is on, and test a backup restore.
5. Can AI be used in cyberattacks?
Yes. CERT-In reported a cyberattack India campaign using open-source AI agent tools. The weaknesses involved were old ones, though, like exposed credentials and overbroad permissions.
6. What should a business do if it suspects a breach?
Isolate the affected systems, keep the logs, rotate credentials, and call qualified responders. Report cybercrime through the national portal.
Cybersecurity Is a Habit, Not a One-Time Fix
October’s biggest lesson from the cyberattack India headlines is how ordinary the causes were: unpatched software, keys in the wrong place, one poisoned package. Fixing those basics beats chasing every headline, and this post will be updated as authorities share more.
If you’d like a second pair of eyes on your site’s PHP version, plugins, and backups, the Algominds team can help through website development and ongoing support.
