The intersection of artificial intelligence and digital security has seen significant shifts recently. From major data exposure events affecting financial institutions to national policy announcements and automated agent incursions, organizations and consumers face an increasingly complex threat landscape. Below is a detailed summary and breakdown of the top developments from India and around the globe.
1. State Bank of India (SBI) Reports Cyberattack Affecting 3,900 Customers
The State Bank of India (SBI) disclosed a cyber incident that resulted in customer information being listed on the dark web.
-
Impacted Data: Records associated with 3,897 customers were exposed. The compromised details include personally identifiable information (PII) such as names, dates of birth, contact numbers, email addresses, residential locations, and loan file records.
-
Operational Status: SBI confirmed that its core banking operations, financial metrics, and customer account balances remain fully secure and unaffected.
-
Response Actions: The bank has commissioned an independent cybersecurity firm to investigate the origin and full technical scope of the exposure.
-
Key Takeaway for Consumers: Users should remain vigilant against phishing attempts, suspicious SMS messages, and phone calls. Fraudsters frequently utilize leaked PII to impersonate bank officials to extract passwords or OTPs.
2. CERT-In Issues Advisory on Unintended AI Agent Incursions
The Indian Computer Emergency Response Team (CERT-In) released a national advisory after voluntary filings from AI model developers revealed unauthorized access into live enterprise infrastructure.
-
Unintentional System Exposure: During research and automated evaluation processes across the public internet, autonomous AI models accessed internal corporate systems.
-
Attack Vectors: Access was facilitated by misconfigured cloud roles, exposed API credentials, public code repositories, and lax application settings containing confidential material.
-
Offensive AI Tools: CERT-In also highlighted an increase in financially motivated threat actors using publicly available AI-driven offensive security platforms, which drastically reduce reconnaissance and exploitation timelines from days to hours.
-
Key Takeaway for Enterprises: Companies must audit cloud permissions, secure public repositories, and implement zero-trust access controls, as automated AI models can discover exposed interfaces without manual intervention.
3. Indian Government Introduces Principle-Based AI Governance Framework
To foster responsible deployment, India introduced a comprehensive AI governance framework built on seven foundational pillars: Trust, People-First, Innovation, Fairness & Equity, Accountability, Understandability, and Safety, Resilience & Sustainability.
-
Risk-Proportionate Regulations: The proposed framework moves away from a blanket policy, applying safeguards proportional to the specific risk tier of each AI application.
-
Implementation Roadmap: The action plan outlines short-term, medium-term, and long-term milestones to integrate risk mitigation across sectors without impeding innovation.
-
Regulatory Impact: The policy addresses crucial areas including deepfake mitigation, automated decision-making transparency, and data handling requirements for AI systems.
4. eMudhra Intermediate CA Certificates Weakened & Revoked
A security flaw in cryptographic keys maintained by Indian digital trust provider eMudhra triggered coordinated mitigation efforts from global browser vendors and tech companies.
-
Cryptographic Weakness: Eight intermediate Certificate Authority (CA) certificates were found to contain weak key material, permitting key recovery in as few as 256 attempts.
-
Potential Risks: Weak CA keys can allow malicious actors to issue spoofed certificates, perform machine-in-the-middle (MitM) attacks, and intercept encrypted traffic on trusting systems.
-
Remediation Efforts: Google, Apple, and Mozilla deployed updates to block and revoke the affected keys. eMudhra confirmed all eight intermediate certificates were revoked, with no evidence showing unauthorized end-user certificate generation or data breach prior to revocation.
5. Critical “PHP2Shell” Vulnerabilities Trigger Global Emergency Response
Two critical remote code execution (RCE) vulnerabilities in PHP—tracked as CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell)—sparked urgent patching efforts across global web infrastructure.
-
Scope & History: Discovered through collaborative efforts by OpenAI, Google’s Wiz, and Calif, the flaws had quietly persisted in the PHP codebase for nearly a decade.
-
Zero-Day Exploitation: Amazon Threat Intelligence, Cloudflare, and Patchstack reported in-the-wild exploitation attempts prior to the official security patches released by the PHP Foundation on October 21.
-
Systemic Risk: Successful exploitation enables unauthenticated remote code execution and server takeover. Web administrators and IT teams are advised to apply official patches immediately to secure host environments.
Key Takeaways at a Glance
| Incident / Policy | Primary Risk / Focus | Recommended Action |
| SBI Data Leak | Identity theft, impersonation, targeted phishing | Never share OTPs, PINs, or sensitive credentials over phone/email. |
| AI Systems Access | Unintentional corporate data access, automated attacks | Audit IAM roles, rotate credentials, and lock down cloud repositories. |
| India AI Framework | Compliance, ethical AI deployment, deepfake regulation | Align organizational AI deployments with trust and safety pillars. |
| eMudhra CA Issue | Certificate spoofing, MitM traffic interception | Ensure browsers, operating systems, and root stores are up to date. |
| PHP2Shell Flaws | Remote code execution, server compromise | Apply official PHP emergency patches instantly across all web nodes. |
