Business and Market Briefing: PHP Vulnerabilities, eMudhra SIT Probe, and CoinDCX Wallet Security

Global PHP Vulnerabilities Prompt Urgent Patching in India

Indian companies, particularly micro, small, and medium enterprises (MSMEs), are actively rushing to patch websites following the discovery of two critical vulnerabilities in PHP, a programming language widely utilized for web development. These flaws could potentially allow unauthorized actors to take control of internet-facing servers without logging in, raising risks of data theft and malware installation. Approximately 67 percent of websites using India’s '.in' domain reportedly run on PHP. The Indian Computer Emergency Response Team (CERT-In) has urged organizations to identify vulnerable systems and apply the latest security fixes. According to government reports, most key public websites affected by the issue have already been patched, while the global discovery has triggered precautionary actions worldwide.

Government Explores Domestic Alternatives Following eMudhra Incident

The central government is exploring India-based alternatives to overseas audit firms within the digital certificate ecosystem. This initiative follows a security incident involving eMudhra, which resulted in the compromise of private keys linked to eight intermediate certificates that were subsequently revoked on October 19. The Ministry of Electronics and Information Technology (MeitY) has established a special investigation team comprising officials from the Controller of Certifying Authorities (CCA), CERT-In, Aadhaar, and the National Payments Corporation of India (NPCI). Meanwhile, eMudhra announced its decision to exit the global SSL/TLS certificate business, which accounts for about 1 percent of its global revenue. The company confirmed that its regulated Digital Signature Certificate and eSign operations remain unaffected and that no customer certificates were issued using the compromised keys.

Sugar Mills Barred from Diverting Juice and Molasses for Ethanol

The Centre has barred sugar mills and distilleries from producing ethanol using sugarcane juice, syrup, and B-heavy molasses during the 2026-27 Ethanol Supply Year. The Food Ministry has directed sugar-producing states to ensure strict compliance and monitor production closely. This decision comes in response to supply concerns following shortages during the 2025-26 season and expectations of tight supplies ahead. Previously, the government permitted duty-free raw sugar imports, with import permits valid until December 31, 2026. Production has commenced in Maharashtra, while crushing operations in Uttar Pradesh have encountered delays due to concerns regarding low sugar recovery rates.

India and Poland Push for Doubling Bilateral Trade and Early EU Trade Pact

Prime Minister Narendra Modi and Polish Prime Minister Donald Tusk have called for the early implementation of the India-EU Free Trade Agreement and agreed to work toward doubling bilateral trade by 2030. Both nations plan to deepen cooperation across manufacturing, defense, artificial intelligence, semiconductors, green energy, space, and nuclear energy. India noted that the proposed FTA could create export opportunities for machinery, chemicals, plastics, and engineering goods while attracting Polish investments. In FY26, India exported goods worth approximately $2.8 billion to Poland and imported $1.2 billion. The leaders also discussed direct flights, maritime cooperation, and connectivity through the India-Middle East-Europe Economic Corridor.

CoinDCX Confirms Rogue Wallets and $16 Million Operational Loss

Crypto exchange CoinDCX has confirmed an operational failure involving a compromised wallet that resulted in losses estimated at approximately $16 million. The exchange stated that certain users continued depositing funds into deprecated wallets associated with a security breach from July 2025, while its internal process for sweeping those deposits experienced a temporary failure. CoinDCX reported that affected users have been credited, customer funds remain secure, and the financial losses were absorbed entirely by the company. The incident has drawn renewed attention to security standards and regulatory oversight within India's digital asset sector.

"Recent developments across cybersecurity, digital infrastructure, and trade underline the critical need for robust operational compliance and risk management for businesses. Incidents involving software vulnerabilities and digital certificate compromises demonstrate that technology infrastructure requires continuous monitoring. As regulatory bodies step up oversight in sectors like digital assets and data security, companies must prioritize proactive system audits to safeguard operational integrity and maintain stakeholder trust." — Dr. Shishir Gupta, Founder & CEO, StartupLanes