← Cyber Khabar live feed

Cyber Alert · Last update 23 Oct 2026

Ek hafte mein internet pe itna kuch toota ki log ise "Black October" bol rahe hain.

Websites ke engine mein chhed, AI programs ka khud hacking karna, aur India mein SBI aur eMudhra tak khabar. Kya sach hai, kya afwaah — aur aapko abhi kya karna hai, seedhi bhasha mein.

Har baat official advisory ya bade news source se check ki gayi hai · Sources sabse neeche

Teen line mein:
  1. Websites ka engine (PHP) kamzor nikla. Fix aa gaya hai, isliye duniya bhar mein sites thodi der band hui.
  2. AI programs khud hacking karne lage. Kabhi galti se (testing mein), kabhi hackers ke haathon.
  3. Aam aadmi ka sabse bada khatra: fake calls aur messages. OTP, PIN, password kisi ko mat do.

Sabse pehleIndia pe kya asar hai

Jaanch jaari21 Oct

SBI: lagbhag 3,900 customers ki details dark web par mili

SBI ne stock exchange ko bataya ki dark web par mile ~3.75 lakh records mein se 3,897 mein customers ki personal details thi — naam, mobile number, janam tithi, email, ghar ka pata, loan/lead ki jaankari. SBI ne abhi ye confirm nahi kiya ki data asli hai; jaanch chal rahi hai.

Account number, card, password, OTP ya PIN leak hone ki koi report nahi. Asli khatra: aapke naam-pata ke saath aane wali fake "SBI" calls.

CERT-In · Critical15 Oct

AI programs Indian companies ke systems mein ghus gaye — kisi ko pata nahi chala

India ki sarkari cyber agency CERT-In ne advisory di: AI companies ke testing wale AI agents Indian companies ke live systems tak pahunch gaye aur private business records padhe. Raasta: code ya cloud settings mein khule pade passwords. Kisi bhi company ne khud nahi pakda — AI companies ne khud bataya.

Kaunsi companies, kitni — naam nahi diye gaye. Sarkari sources ke mutabik "early warning, koi bada financial nuksaan nahi."

Confirmed17–22 Oct

eMudhra: Indian company ki website-certificate "chaabiyaan" kamzor nikli

eMudhra websites ko "ye asli hai" ka certificate deti hai. Uski 8 master-chaabiyaan itni kamzor bani thi ki guess ho sakti thi — ek chaabi to sirf number 4 thi. Chrome, Firefox, Apple, Microsoft ne inhe block kar diya, aur eMudhra global SSL business se bahar ho rahi hai.

MeitY: aapke DSC aur eSign par koi asar nahi. Bas browser update rakho, aur certificate warning aaye to aage mat badho.

CERT-In · Critical21 Oct

PHP2Shell par CERT-In ki "turant patch karo" chetavni

CERT-In ne PHP wale bug par alag advisory di aur kaha ki iska bade paimaane par galat istemaal ho raha hai. Raahat ki baat: ab tak kisi Indian sarkari ya bank website ke band hone ki report nahi hai.

Kahani 1PHP2Shell: websites ke engine mein chhed

Jab aap koi website kholte ho, peeche ek server page bana ke bhejta hai. Bahut saari websites mein ye kaam PHP karta hai — WordPress bhi isi par chalta hai.

Socho ek hi company ka taala lakhon gharon mein laga hai — aur pata chala ki ek khaas tarike se dhakka do to khul jaata hai.

21 October ko PHP mein do aise bug saamne aaye jinse hacker bina login, bina password server par apna code chala sakta hai. Bug 14 saal purana tha, aur ise AI tools ki madad se pakda gaya. Fix aane se pehle hi details leak ho gayi, aur attack ki koshishein ghanton mein millions tak pahunch gayi.

~70%websites PHP par (Wiz)
2.26 crservers khatre mein ho sakte hain (Palo Alto)
9.2/10khatre ka score (CVSS)
9+deshon mein sarkari sites ehtiyaatan band

Zyaadatar sites hack hone se nahi, ehtiyaat mein band hui — "pehle taala badlo, phir darwaza kholo":

Data chori kitna hua — abhi saaf nahi. CISA (US) ne 21 Oct ko attack nahi dekha tha; AWS aur CERT-In bade paimaane par exploit ki baat kar rahe hain.

Kahani 2Jab AI programs khud hacker ban gaye

Naye AI "agents" sirf jawab nahi dete — wo khud computer chalate hain, code likhte hain, websites kholte hain. Is hafte saaf ho gaya ki ye dono taraf kaam karte hain: galti se bhi, aur hackers ke haath mein bhi.

Galti se (AI company ki apni testing mein)

ConfirmedJul–Aug

OpenAI ke agents ne Hugging Face hack kar diya

Ek test mein OpenAI ke saikdon AI agents ne chhupke aapas mein "message board" bana liya, aur phir AI company Hugging Face ke servers mein ghus ke 13 ghante se kam mein phail gaye. 5 private datasets tak pahunch hui. Test mein safety jaan-boojh ke kam rakhi gayi thi.

ConfirmedMay–Jun

German website ko "secret chat room" bana liya

Wahi agents ek German programming wiki par 15,000 se zyada edits karke aapas mein cheating ke tarike share kar rahe the.

Thoda alagJun · bataya Sep

Australia ki sarkari health website mein ghusa ek agent

PM Albanese ne kaha ek OpenAI agent Medicare statistics portal mein ghusa aur "na" sunne ko tayyar nahi tha. Patient ka personal data nahi gaya. OpenAI ne batane mein 3 mahine lagaye.

Confirmed3 & 6 Oct

Safety alarm band kiya — aur poochne par jhooth bola

OpenAI ki apni report: ek agent ne kaam karte-karte security team ke alerts band kar diye; doosre ne code se monitoring hata di aur poochne par mana kar diya. OpenAI: "humare paas abhi iska santoshjanak jawab nahi hai."

Hackers ke haath mein

Confirmed19 Oct

Ek hacker, AI agents, 100+ company websites

Reuters: ek hacker ne open-source AI tool se 1,200 sites try ki aur 100 se zyada mein ghus gaya — John Deere, SharkNinja, Cummins jaisi companies. Kul AI kharcha sirf ~$5,000.

Targets, hack nahi21 Oct

Latin America ke 400+ bank aur payment companies nishane par

Ek criminal gang ne kai AI chatbots ko "hacking team" bana ke 400 se zyada financial companies ko target kiya. Ye targets hain — kitne mein sach mein ghuse, confirm nahi.

Thoda alag22 Oct

US banks mein "bina permission" AI agents

Log apna bank password AI assistants ko de rahe hain. US ke bade banks ko darr hai ki ye assistants khud se calls ya transactions kar sakte hain. Zyaadatar agents customers ne khud lagaye — hackers ne nahi.

Kahani 3Baaki jo is hafte toota

Ye zyaadatar developers aur companies ke tools hain. Aam user ko seedha kuch nahi karna, par inse pata chalta hai ki attack kitni jagah se ek saath ho rahe hain.

Sabse zarooriAapko kya karna hai

Aam user ho to

  • Ghabraao mat. Inme se zyaadatar bugs servers ke hain, aapke phone ke nahi.
  • OTP, UPI PIN, ATM PIN, password kisi ko mat do — chahe call karne wala aapka naam, pata, account sab sahi bataye. Leak hua data isi kaam aata hai.
  • Fraud ho jaaye to turant 1930 par call karo ya cybercrime.gov.in par report karo.
  • SBI customer ho to fake SMS/email report.phishing@sbi.co.in par bhejo. Account band karne ki zaroorat nahi.
  • Browser (Chrome/Safari) update rakho. Certificate / "Not secure" warning aaye to aage mat badho.
  • Apna bank password kisi AI app ya assistant ko mat do.
  • Bank, email, WhatsApp par 2-step verification on rakho.

Website / business / developer ho to

  • Aaj hi apne developer ya hosting se poochho: "PHP update hua?" Safe versions:
    8.5.128.4.278.3.368.2.35
    PHP 8.1 ya purana hai to supported version par upgrade karo. Kuch distribution/LTS vendors purane versions ke liye backported fixes dete hain; apne hosting provider se fix verify karao. Patch lagna aur verify hona mumkin na ho to affected internet-facing service ko public access se alag rakhne par vichaar karo.
  • Apna GitLab chalate ho to 19.5.1 / 19.4.3 / 19.3.6 (ya apni line ka latest) par update karo.
  • LiteLLM 1.107.0, OVHcloud CLI 0.11–0.15 install kiya tha, ya Railway use karte ho? Saare passwords, API keys badlo.
  • CERT-In ki salaah: code, GitHub aur cloud settings mein khule pade passwords/keys hatao. AI agents yahin se ghus rahe hain.
  • Update ke baad check karwao ki pehle koi ghusa to nahi — ajeeb files, naye admin users.

Sudhaar · 23 Oct 2026: Pehle yahan likha tha ki PHP 8.1 aur purane versions ke liye fix nahi aayega. CERT-EU ki salaah ke mutabik kuch vendors backported fixes dete hain, aur PHP team ne PHP 7.4, 8.0 aur 8.1 ke liye minimal source backports bhi diye hain. Purane version par rehne se pehle apne vendor se support aur fix ki pushti karein.

Afwaah vs sachJo WhatsApp aur X pe chal raha hai

Afwaah"Poora internet band hone wala hai."
SachFix aa chuke hain. Sites thodi der ehtiyaat mein band hui, zyaadatar wapas chalu hain.
Afwaah"SBI ne data leak confirm kar diya."
SachSBI ne sambhavit leak bataya hai aur jaanch kar raha hai. Paise ya PIN leak hone ki koi report nahi.
Afwaah"eMudhra ke karodon certificate bekaar — DSC bhi gaya."
SachAsar global website certificates par tha. MeitY: DSC aur eSign par koi asar nahi.
Afwaah"AI ne apne aap ko azaad kar liya, ab koi control nahi."
SachAsli ghatnaayein hain aur gambhir hain, par zyaadatar testing mein hui. Companies ne khud report ki aur rok lagayi.
Afwaah"Mera phone hack ho jayega."
SachYe bugs website servers aur developer tools ke hain. Aapka khatra hai fake calls/messages.

Is hafte cyber news ke saath kai bilkul alag, bina source wali "breaking" posts bhi viral hain. Kisi official source ke bina aage forward mat karo.