DC Edit | PHP Flaws, AI Prying Point At Need For Digital Security

Digital is the new critical superhighway for almost everything people need. It is used to fight wars, issue birth and education certificates, provide entertainment, collect road tolls and even certify a person’s death. If digital networks are compromised, essential services across the connected world could come to a standstill.

Data security, therefore, deserves the seriousness with which countries guard their physical borders. Yet recent incidents reveal elementary mistakes, inadequate safeguards and possible breaches of trust that expose sensitive information. As governments and businesses insist on taking more services online, their responsibility to protect the people using them must grow correspondingly.

The discovery of two critical vulnerabilities in PHP, a programming language underpinning much of the web, is alarming. The flaws could allow attackers to seize control of affected servers, steal or alter information and disrupt services without first obtaining authorised access.

Though emergency fixes were released on October 21 to address the issue, a large number of websites — at least 50 per cent of all — being run using older software will continue to remain vulnerable. A weakness in such widely used software can endanger numerous otherwise unrelated services simultaneously.

The growing capabilities of artificial intelligence introduce another threat. CERT-In has warned that AI agents undergoing research and evaluation exceeded their assigned authority and accessed live systems of Indian organisations. These autonomous agents, which can plan tasks, invoke tools and act online, accessed confidential records through exposed credentials, application settings and excessively permissive cloud access. But none of these organisations were aware of the intrusion, until the AI model providers informed them about the breach.

The lesson is simple: Giving AI agents unrestricted access and relying on written instructions to restrain them is inadequate. Their reach must be limited through enforceable technical controls, and organisations should store crucial data from tightly controlled spaces.

The eMudhra episode illustrates how a single failure can undermine digital trust. Weak private keys associated with eight intermediate certification authority certificates created the possibility of forged website credentials and forged digital signed documents. This is an easily avoidable incident, which was caused by negligence of its staff. The government must ensure that companies, who are considered gatekeepers of digital trust, must behave with utmost seriousness.

Banking incidents expose additional routes to compromise. State Bank of India said crucial data of nearly 4,000 of its customers was available on dark net, while Bank of Baroda acknowledged unauthorised access through an employee’s compromised email account. Reports allege issues of data security at HDFC Bank, which the lender denied. These incidents show why security must extend beyond transaction servers.

India, therefore, needs measurable security obligations: prompt repairs, independent audits, strict controls over employees and vendors, and clear disclosure of what an incident has exposed. Digital expansion must also be accompanied by reliable arrangements for recovery. If a hacker wipes out a university’s records, students should not be left struggling to prove their qualifications. Governments and institutions must maintain independently secured backups, test their restoration regularly and preserve physical records of crucial events. Digital systems deliver speed and efficiency, but convenience must never come at the cost of security or the ability to recover from failure.