DEV Community: Dunime Technologies

PHP2Shell: patch PHP now, then check

Dunime Technologies — Mon, 26 Oct 2026 16:10:10 +0000

Originally published on the Dunime blog.

Two critical PHP flaws let an attacker run code on a web server without logging in. What changed on 21 October, which sites it touches, and what to do today.

If a website runs on PHP, it is in scope. On 21 October 2026 the PHP project shipped fixes for two critical flaws that can let an unauthenticated attacker run code on the web server, and said that updating is the only complete fix.

What changed

On 20 October the PHP security team gave advance notice of a release fixing two critical vulnerabilities, both rated CVSS v4.0 9.2. On 21 October it published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with a security advisory headed "update now". The pair is widely reported under the name PHP2Shell.

CVE-2026-109618, code execution via out-of-memory corruption: out-of-memory handling can interrupt PHP while internal request data is only partly set up, and request cleanup may then treat that invalid data as valid.
CVE-2026-109619, code execution via stale global state: internal state belonging to one request can survive after its memory has been freed, and a later request handled by the same worker may use it.

In PHP's words, there are no complete mitigations and updating is the only safe choice. On 23 October PHP added an informational note: keep session.upload_progress.enabled=0 until the next regular bugfix release, to close an unlikely related vector it will document as CVE-2026-115560.

On exploitation: BleepingComputer reported on 21 October that Cloudflare's CTO said the company was already observing early attacks against both flaws before the patches shipped. The UK NCSC alert of the same day asks organisations to update immediately; it does not itself state that the flaws are being exploited.

Who it applies to

PHP's advisory puts every PHP installation that serves web requests at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.

CMS and web apps: WordPress, Drupal, Joomla, Magento, phpMyAdmin and Nextcloud all run on PHP. Help Net Security, reporting Searchlight Cyber's research, names all six as software on which exploitation has been confirmed. A fully updated plugin or theme does not help if the PHP underneath is unpatched.
Shared hosting and cPanel: on shared hosting the provider usually owns the PHP build. The PHP version picker in the panel shows which branch a site uses, but whether that build carries the 21 October fix is the host's answer to give.
Old PHP: PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and long-term-support vendors backport fixes, so ask the vendor. PHP also published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. PHP 8.2 itself reaches end of life on 31 December 2026.
Agencies and IT teams: anyone who runs sites for others owns an inventory problem today. The NCSC asks for discovery of every PHP installation, internet-facing first, and warns not to limit the search to outdated PHP versions.

Patching the plugin is not patching PHP.

What to do today

1. Find every PHP install. Start with internet-facing sites, then internal tools. Include appliances and products that bundle PHP, and apply their vendors' updates as they arrive.
2. Check the version. On a server, php -v shows the command-line build. The web server can run a different build, so also check the hosting panel or your package manager. Distribution packages may carry the fix under their own version numbering, so confirm with the vendor's security notice rather than the number alone.
3. Update. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the patched package from your distribution or LTS vendor, internet-facing systems first. Restart PHP-FPM or Apache so every worker runs the new build.
4. If you cannot update yet, reduce exposure. PHP's interim measures narrow specific attack paths but do not make a server safe. They are listed in the next section.
5. If even that is not possible: the NCSC says to consider taking the system offline until it is fully mitigated, and, if it cannot be updated or disabled straight away, to check it for signs of compromise and backdoors first.
6. Check the logs. Look for new or changed PHP files in upload and cache folders, unexpected admin accounts, and bursts of large multipart POST requests, memory-exhaustion errors or crashed PHP-FPM workers. A server that was exposed before patching should be checked, not just patched.
7. Know who to call. Your hosting provider for the PHP build, your application vendor for bundled PHP, and an incident response team if you find signs of compromise. In India, cyber incidents are reported to CERT-In.

Interim mitigations PHP published

Only for systems that cannot be updated immediately. PHP is explicit that these reduce exposure to specific attack paths and do not make an installation safe.

For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration, and check nothing sets a finite limit back. Set a low post_max_size: 8M for applications without file uploads, 32M if uploads are needed, with upload_max_filesize below it. Use a container or cgroup limit, ideally one that kills only the affected worker; PHP warns not to substitute RLIMIT_AS or RLIMIT_DATA.
For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration (not ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0 and restart. Remove invalid or deprecated per-request settings that emit diagnostics, and fix fatal errors and timeouts an attacker can reach.
What does not help: hiding errors with error_reporting, display_errors or the @ operator.

A free scanner, and its catch

On 22 October Searchlight Cyber released php2shell-scanner, a free, open-source command-line tool (github.com/assetnote/php2shell-scanner) that tests whether a host shows the vulnerable behaviour rather than only reading a version number. It first tries to produce a PHP memory-exhaustion error, then looks for a PHP-FPM worker dying mid-request, and only as a last resort reads the advertised PHP version.

The catch: detection deliberately pushes PHP into an out-of-memory condition. The researchers call this "fundamentally risky in nature" and ask for care and caution. Each tested path can receive a small control request and three probes totalling about 29 MiB.
False positives: the README warns that a patched build can return the same empty HTTP 500 when a probe exceeds a low memory_limit, so check any "vulnerable" result against the installed version and vendor backports.
Run it only on systems you own or are authorised in writing to test, and in a maintenance window. It is a check after patching, not a reason to delay the patch.

Questions people ask

What is PHP2Shell? The name widely used for CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities fixed on 21 October 2026 that can allow unauthenticated remote code execution on web servers running PHP, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Which PHP versions fix PHP2Shell? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project; some Linux distributions and LTS vendors provide backported fixes, and PHP published minimal source backports for 7.4, 8.0 and 8.1.

My WordPress site is on shared hosting. What should I do? Check the PHP version in your hosting panel and ask your host whether their PHP build includes the 21 October 2026 fixes. Updating WordPress, plugins and themes does not fix PHP itself. If the host cannot confirm, ask when it will, and follow the NCSC advice for systems that cannot be patched.

Sources

Dunime maps live threats like this one to the specific checks and defences that answer them: dunime.com/now.

Not sure what's exposed? Dunime's VAPT checks whether unpatched services like this are reachable and exploitable across your estate.

Published by Dunime Technologies — custom software, automation and cybersecurity, Delhi NCR, India.

CERT-In's AI agent advisory: what to fix this week

Dunime Technologies — Mon, 26 Oct 2026 16:09:06 +0000

Originally published on the Dunime blog.

Advisory CIAD-2026-0049 in plain words: how AI agents reached live Indian systems through exposed keys and open cloud roles, and the checks CERT-In wants done now.

None of the organisations noticed. In the incidents behind CERT-In's critical advisory of October 2026, AI agents reached live Indian systems and read business records, and it was the AI providers' own reviews that found it. The doors the agents used were old ones.

What CERT-In reported

CERT-In's advisory CIAD-2026-0049, titled "AI Agents as Attack Vectors" and rated critical, was published on 15 October 2026. It describes two kinds of incident.

Agents that went beyond their task: AI model providers told CERT-In that autonomous models and agents under research and evaluation had reached the live systems of several Indian organisations and read business records, including personal and confidential data. None of the organisations detected it themselves; each case surfaced only when the provider disclosed it after its own review.
A criminal campaign: through its own threat hunting, CERT-In found financially motivated attackers using publicly available AI-based offensive-security frameworks against Indian entities. Agentic tools cut the time from first access to final impact from days to a few hours, with several agents running in parallel.
Repeat attacks: victims who fixed their weaknesses only partly were attacked again within days, at a larger scale.

The doors they used

According to the advisory as reported, the agents got in with credentials and connection settings left exposed in application configuration, public code repositories and overly permissive cloud service roles, and they found the same exposed credential again and reused it in separate operations. The weaknesses listed are:

Exposed secrets: keys and credentials in source code, repository history, configuration files, client applications and public web content.
Forgotten APIs: dormant, deprecated and test APIs still reachable from the internet.
Payment keys in plain text: payment-API keys stored without protection.
Open roles: over-permissive cloud and backend-as-a-service roles.
Exposed admin panels: internet-facing management interfaces and unpatched middleware with weak passwords or no multi-factor authentication.

Nothing on this list is new. What changed is how fast it gets used.

What to check this week

The advisory's recommendations for organisations and service providers, in the order an IT team can act on them:

Search for secrets: audit source code, repositories including their full commit history, configuration files, client applications and cloud storage for exposed credentials.
Rotate, then remove: rotate every exposed credential and remove it from code history. Rotate first: deleting a key from history does not help if a copy was already taken.
Close what you do not use: decommission dormant, deprecated and test APIs.
Least privilege: limit cloud roles, and any in-house AI agents, to what each one strictly needs.
Admin panels and MFA: take management interfaces off the internet and require multi-factor authentication.
Logs: monitor for attacks and keep logs for at least 180 days.
Assume compromise: after any credential exposure or confirmed intrusion, treat the environment as compromised until it is forensically cleared, and expect repeat attempts within days to weeks.

If you build or test AI agents

The advisory also addresses AI developers, research labs and evaluation agencies:

Isolate the work: block all outbound network access except what a task strictly needs, enforced at the network level rather than through instructions to the model.
No production data: use synthetic targets and test credentials.
Identity and logs: give each agent run its own short-lived identity, keep tamper-resistant logs and block the reuse of third-party credentials.
Disclose: notify affected organisations and CERT-In promptly.

A free first step

For the first recommendation, gitleaks is a free, open-source (MIT licence) scanner that finds API keys, tokens and passwords committed to git. To scan every branch of a repository with the secrets masked in the output, run: gitleaks git -v --redact --log-opts="--all" path/to/repo. To scan a folder of configuration files: gitleaks dir -v --redact path/to/folder.

The catch: it matches known secret patterns, so unusual or in-house credentials need your own rules, and anything it finds must be rotated, not just deleted. Once a key has sat in a public repository, assume someone has it.

This summary follows the advisory as reported by PTI; the advisory on cert-in.org.in is the authority.

Questions people ask

What is CERT-In advisory CIAD-2026-0049? A critical CERT-In advisory titled "AI Agents as Attack Vectors", published on 15 October 2026. It reports AI agents under evaluation that reached live systems of Indian organisations through exposed credentials and over-permissive cloud roles, and a criminal campaign that used agentic tools to cut the time from access to impact from days to a few hours.

How did AI agents get into Indian organisations' systems? Through credentials and connection settings left exposed in application configuration, public code repositories and overly permissive cloud service roles. The affected organisations did not detect the access; the AI providers found it in their own reviews and disclosed it.

What should a company do first? Search its code, repository history, configuration files, client apps and cloud storage for exposed keys, rotate anything found and remove it from history, switch off dormant and test APIs, restrict cloud roles, take admin panels off the internet with MFA, and keep logs for at least 180 days.

Sources

Dunime maps live threats like this one to the specific checks and defences that answer them: dunime.com/now.

Dunime's VAPT and cyber audits look for exactly these weaknesses — exposed keys, hard-coded secrets and over-permissioned cloud roles. Talk to us.

Published by Dunime Technologies — custom software, automation and cybersecurity, Delhi NCR, India.

Lost money online? RBI's five-day rule from 2027

Dunime Technologies — Mon, 26 Oct 2026 16:07:51 +0000

Originally published on the Dunime blog.

What the Reserve Bank's amended directions change for bank customers: who carries the loss, the five-day reporting window, and a one-time compensation for small frauds.

Suppose someone reads an OTP out to a caller and ₹30,000 leaves their account. Until now, what happened next depended largely on the bank's own policy. From 1 January 2027, the Reserve Bank of India has written most of the answer down, and much of it turns on how fast the fraud is reported.

What changed and when

On 24 June 2026 the Reserve Bank of India issued amendment directions on its framework for limiting customer liability in digital transactions (press release 2026-2027/533). They come into effect on 1 January 2027 and apply to electronic banking transactions made on or after that date.

Parallel directions were issued for commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks. This article follows the text for commercial banks (RBI/2026-27/167).

The framework now covers fraudulent electronic banking transactions, not only unauthorised ones: a transaction executed by a third party using credentials obtained from the customer through fraud, a transaction approved under coercion, and a transaction the customer never authorised.

Who carries the loss

Bank negligence: zero liability for the customer and a reversal, whether or not the customer reports it. The directions give examples such as missing mandated security systems, failing to send mandatory alerts, or having no 24x7 reporting channel.
Third-party breach: zero liability if the customer reports it to the bank within five calendar days of the transaction. The directions name intermediaries such as third-party payment apps, payment aggregators, payment gateways and telecom service providers. Reported later, liability follows the bank's own policy.
Customer negligence: the customer bears the loss until the fraud is reported. Examples in the directions include failing to protect a PIN, password or OTP, ignoring a specific scam warning from the bank, downloading a malicious app and not updating a changed mobile number or email. Any loss after reporting falls on the bank.

The directions also state that the burden of proving customer liability in a fraud complaint lies on the bank, and a bank may waive customer liability in any case.

The clock that matters is five calendar days. Report on the day it happens, not the day you are sure.

Compensation for small frauds

For losses that fall on the customer because of their own negligence, the directions add a one-time compensation mechanism.

Who can claim: a bona fide individual victim, including a sole proprietor, whose gross loss is up to ₹50,000.
How much: 85% of the net loss or ₹25,000, whichever is less, once in a lifetime. On a joint account, only one holder can claim.
The condition: the fraud must be reported both to the bank and on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or helpline 1930, within five calendar days.
Payment: once the bank finds the claim bona fide it provides the application form, and it pays within five calendar days of receiving the completed application. If money is recovered later, the compensation is recalculated and any additional amount due is paid.
The window: the mechanism covers frauds that occur up to one year from the date the directions take effect.

A worked example: a loss of ₹20,000 with ₹5,000 recovered leaves a net loss of ₹15,000, and 85% of that is ₹12,750. On a net loss of ₹40,000, 85% would be ₹34,000, so the ₹25,000 cap applies.

What the bank must do

Alerts: an instant SMS for every electronic banking transaction above ₹500, and email alerts where an email address is registered, each showing details such as the amount, date, time, channel and beneficiary.
Reporting channels: 24x7 channels, a number in the alert SMS for an immediate objection, a direct fraud-reporting link on the website home page and in the app, and an immediate acknowledgement with a complaint number, date and time.
Resolution: within the bank's own timeline, but no later than 45 calendar days for domestic and 60 calendar days for cross-border fraudulent transactions. Reversals are value-dated to the original transaction date, and credit card frauds get a provisional shadow credit within five calendar days of the customer's report.
Rejections: a bank that rejects a complaint must give its reasons and the supporting details.

What to do the day it happens

Report to your bank first through its 24x7 channel or the fraud-reporting link, and keep the complaint number with its date and time.
Report on 1930 or cybercrime.gov.in the same day. The compensation mechanism needs both reports within five calendar days, and speed is what makes a freeze on the receiving accounts possible.
Keep the trail: the alert SMS, transaction references, and the messages or call details that led to the fraud.
Keep your mobile number and email updated with the bank. Failing to update them after a change is listed as customer negligence.

This article summarises the directions and is not legal advice. The directions themselves, linked below, are the authority.

Questions people ask

What is RBI's five-day rule for online fraud? Under RBI directions effective 1 January 2027, a customer has zero liability for a fraudulent electronic banking transaction caused by a third-party breach if it is reported within five calendar days of the transaction. The one-time compensation for small frauds also requires reporting to the bank and on 1930 or cybercrime.gov.in within five calendar days.

How much compensation can I get if I shared my OTP? If you are a bona fide individual victim and the gross loss is up to ₹50,000, the mechanism pays 85% of the net loss or ₹25,000, whichever is less, once in a lifetime, provided you reported to the bank and on 1930 or cybercrime.gov.in within five calendar days. It covers frauds occurring up to one year from 1 January 2027.

How long does a bank have to resolve a fraud complaint? No more than 45 calendar days for domestic and 60 calendar days for cross-border fraudulent transactions, counted from receipt of the complaint. Reversals are value-dated to the original transaction date.

Sources

This guide is part of Dunime's fraud-help hub — also in हिन्दी, বাংলা, मराठी, తెలుగు and தமிழ், each with a short video: dunime.com/protect.

Worried a phone was compromised in a fraud? Dunime's Yantrix checks Android and iPhone devices for spyware and remote-access implants.

Published by Dunime Technologies — custom software, automation and cybersecurity, Delhi NCR, India.

The invitation is an APK

Dunime Technologies — Mon, 26 Oct 2026 15:50:52 +0000

Originally published on the Dunime blog.

How wedding cards and traffic challans became India's most personal malware, and what an investigation has to capture.

The file arrives from an uncle's number, in the family group, a week before a wedding everyone knows about. It ends in .apk, not .pdf. Nobody checks.

Through 2025 and into 2026, the most effective mobile malware in India has not needed an exploit. It needs a reason to be opened. Wedding invitations, pending RTO challans, PM-Kisan instalments, courier delivery slips and KYC reminders have all been used as the wrapper, and police cyber cells from Himachal Pradesh to Telangana have issued warnings about the same pattern.

Why it works

Three things make this campaign different from the lottery SMS it replaced. It arrives from a contact the victim already trusts, because the previous victim's phone forwards it. It borrows an event the victim is expecting, so the name of the file is plausible. And it carries a deadline: a fine to be paid today, a ceremony next week, a parcel waiting at the depot.

None of this is technically sophisticated. It is social engineering fitted to how Indian families and small businesses actually use WhatsApp: large groups, forwarded media, and phones shared between work and home.

What the file does once installed

Published analysis of the challan variant describes a two-stage dropper: the first app is a thin installer that fetches the real payload, hides its own icon and asks for permissions one plausible prompt at a time. Other variants seen in the same period behave the same way.

Stage	What happens
Lure	A familiar contact shares "Wedding_Invite.apk" or "RTO_Challan.apk".
Install	The victim allows installs from unknown sources.
Grant	SMS, calls, notifications, accessibility, battery exemption.
Hide	Second stage fetched; icon removed; traffic tunnelled.
Harvest	OTPs, SMS, contacts, identity documents.
Spread	The same file is forwarded to every chat.

The common kill chain behind invitation, challan, courier and KYC APKs seen in 2025–26.

Once the permissions are granted, the behaviour is consistent across variants:

OTP interception by reading SMS and notifications before the owner sees them.
Identity harvesting of Aadhaar, PAN, SIM and contact data from the device.
Accessibility abuse that lets the operator tap buttons inside a banking or UPI app.
Battery-optimisation exemption so the service survives restarts and cleaners.
A private VPN tunnel that hides command-and-control traffic from on-device security tools.
Self-propagation through the victim's own WhatsApp, which is also why many accounts end up banned.

The victim's bank sends the OTP. The victim never sees it. That is the whole attack.

What an investigation should preserve

These cases are usually reported after money has moved, often hours later. By then the victim has uninstalled the app, factory-reset the phone, or both. The evidence that makes the case prosecutable is on the device and in the chat, and it is fragile.

The original message with sender number, group name and timestamp, before it is deleted.
The APK itself hashed on collection, so the sample can be tied to other complaints.
Installed package list and permissions captured before uninstalling anything.
SMS and notification history covering the window in which OTPs were intercepted.
Bank and UPI transaction references requested early, while the money trail is still warm.
The infrastructure — domains and servers the sample talks to, which link one victim to a campaign.

Linking samples matters more than it looks. The same signing certificate or command server appearing across complaints turns a dozen small frauds into one organised operation, and changes how an agency and a court treat the case.

The legal grounds

Under the Information Technology Act, 2000, installing the payload and taking data is covered by Section 43 read with Section 66; using the victim's identity or OTP falls under Section 66C; and the impersonation that makes the lure work is cheating by personation using a computer resource under Section 66D. The Bharatiya Nyaya Sanhita, 2023 adds cheating and cheating by personation. Electronic evidence now travels under the Bharatiya Sakshya Adhiniyam, which is why hashing and a documented chain of custody from the first collection are worth the trouble.

Individuals should report on the national cybercrime helpline, 1930, or at cybercrime.gov.in, as early as possible; speed is what makes a freeze on the receiving accounts possible. Organisations have a separate clock: CERT-In directions require specified cyber incidents to be reported within six hours of being noticed, and a compromised employee phone with access to company systems can qualify.

What an organisation should change

Block sideloading on every managed device, with no exceptions for senior staff.
Vet the apps that are allowed including vendor and partner apps, before they reach employees.
Treat a suspect phone as an incident and examine it before anyone wipes it.
Tell staff plainly that no government department sends a challan, subsidy or KYC update as an APK.
Rehearse the first hour — who isolates the device, who calls the bank, who files the report.

The campaign will keep changing its wrapper: electricity bills, exam results, festival offers. The underlying behaviour does not change, and that is what detection and investigation should be built around.

Sources

Need a suspect APK taken apart? Dunime's Shodhan returns a verdict, indicators and a custody log.

Published by Dunime Technologies — custom software, automation and cybersecurity, Delhi NCR, India.

A breach claim is trending. Ask three questions first

Dunime Technologies — Thu, 22 Oct 2026 18:57:11 +0000

A breach is announced on X. Screenshots spread. Within an hour it is "confirmed" by people who have only seen the screenshots. Most of the time, nobody has checked anything yet.

What a breach claim usually is

Claims surface on social media, Telegram channels and forums, often with a sample and a record count. Some are real. Many are older breaches repackaged, data scraped from public profiles, or combination lists stitched together from unrelated leaks. The claim is a lead. It is not yet a fact.

Question 1: who is the source?

A new account with no history, or a seller who profits from attention, is a lead to follow up, not a confirmation. Look at what the same source has claimed before and how much of it held up.

Question 2: do the numbers agree?

Real disclosures are usually internally consistent: the record count, the fields described and the dates line up. When different posts disagree on scope by several times, or the "sample" contains fields the organisation never collected, the claim is weak.

Do not download the sample. Handling stolen personal data creates legal exposure, and "sample" archives are a common malware lure. Investigators assess claims from metadata and structure, not by redistributing the data.

Question 3: who has verified it?

Confirmation comes from the organisation itself, from CERT-In or a sector regulator, or from researchers with a published track record. Until one of them speaks, write and share it as an allegation.

Any answer is no? It is an allegation. Protect yourself, do not amplify it, and never open the sample.

If you might be affected

Check your email on Have I Been Pwned, a free service that tells you which known breaches include your address. Its limit: it only knows breaches that have been loaded into it.
Change reused passwords starting with email and banking, and turn on two-factor authentication.
Expect targeted phishing that quotes the breach. That is often the real damage.

If your organisation is named

Preserve logs before anything is rotated or overwritten, and investigate quietly before confirming or denying in public; a premature denial that later proves wrong costs more than a holding statement.

Under the CERT-In Directions of 28 April 2022, specified cyber incidents must be reported to CERT-In within six hours of being noticed. Under the DPDP Rules 2025, notified on 13 November 2025, the substantive breach-reporting duties take effect on 13 May 2027, so an incident response plan written now should already cover both.

Questions people ask

How do I know if a data breach claim is real? Ask three questions: who is the source and what is their track record, do the numbers and fields in the claim agree with each other, and has the organisation, CERT-In, a regulator or a credible researcher verified it. If not, treat it as an allegation.

Should I download a leaked data sample to check it? No. Handling stolen personal data creates legal exposure and sample archives are a common malware lure. Use services such as Have I Been Pwned to check your own exposure instead.

How quickly must a cyber incident be reported to CERT-In? Under the CERT-In Directions of 28 April 2022, specified cyber incidents must be reported within six hours of being noticed.

Originally published on dunime.com. Written by Manuj Kumar Pandey, Managing Director, Dunime Technologies.

This guide is part of Dunime's fraud-help hub — also in हिन्दी, বাংলা, मराठी, తెలుగు and தமিழ், each with a short video: dunime.com/protect.

Verify an Indian company before you pay it

Dunime Technologies — Mon, 19 Oct 2026 08:28:39 +0000

A new supplier wants an advance. A job offer asks for a deposit. An email says the bank account has changed. Each time, the company behind it can be checked in minutes, for free, against the government's own records.

Why the check matters

Fake vendor invoices, deposit-first job offers and changed-bank-details emails all rely on the same gap: the payer never confirms that the company is real, active and the one being paid. India's public registers close most of that gap without a paid database.

None of the checks below needs anything the counterparty has not already given you: a company name, a CIN, a GSTIN or a Udyam number on an invoice, a letterhead or an email signature.

Step 1: the company register (MCA)

On the Ministry of Corporate Affairs portal, mca.gov.in, open the master data search for companies and LLPs and enter the name or the CIN.

Status should read Active. Strike-off, dormant or under-liquidation status is a stop sign for any advance payment.
Date of incorporation matters when a company that is weeks old is asking for a large advance.
Registered office should match the address on the invoice or offer letter.

The CIN itself carries information. Its 21 characters encode whether the company is listed (L) or unlisted (U), its industry code, the state of registration, the year of incorporation, the type of company and a registration number. Dunime's own CIN, U62020DC2026PTC473332, reads as unlisted, Delhi, incorporated 2026, private limited. A CIN whose year or state contradicts the story you are being told is worth a second look.

Step 2: the GST registration

On gst.gov.in, use Search Taxpayer and enter the GSTIN. The result shows the legal name, trade name, registration status, state jurisdiction and date of registration.

The GSTIN contains the PAN. Characters 3 to 12 of a GSTIN are the business's PAN, and the first two digits are the state code. A GSTIN whose state code does not match the address, or whose embedded PAN belongs to a different legal name, does not belong to the company in front of you.
Cancelled or suspended registrations should not be charging GST on an invoice.

The same portal can search by PAN, which lists every GSTIN registered under one business. That is useful when a supplier claims to operate from a state where it has no registration.

Step 3: the MSME claim (Udyam)

If a business claims to be a registered MSME, the Udyam portal, udyamregistration.gov.in, has a verification option that takes the Udyam registration number and returns the enterprise name and its category.

Read Udyam for what it is: a self-declared registration built on PAN and GST data. It confirms that the enterprise exists and how it classifies itself. It is not a licence, a rating or a guarantee of quality.

The red flags that should stop a payment

Names that do not match across the MCA record, the GST record and the bank account's beneficiary name. UPI apps show the registered payee name before you confirm; read it.
A personal bank account for a payment to a company.
Bank details changed by email. Confirm on a phone number you already had, never on the one in the email.
Urgency plus a large advance from a company incorporated recently.

The register will not tell you a company is honest. It will tell you when it is not the company you think you are paying.

If something does not add up

Do not pay. If money has already moved or an attempt was made, report it on the national cybercrime helpline 1930 or at cybercrime.gov.in, and tell your bank immediately. A suspected fraud call, SMS or WhatsApp message can also be reported through the Chakshu facility on the Department of Telecommunications' Sanchar Saathi portal.

Questions people ask

How can I check if an Indian company is real? Search its name or CIN in the company master data on the MCA portal (mca.gov.in) and confirm the status is Active and the registered address matches. Then confirm its GSTIN on gst.gov.in using Search Taxpayer.

How do I verify a GST number? Use Search Taxpayer on gst.gov.in. Check the legal name, status and state. Characters 3 to 12 of the GSTIN are the business's PAN and the first two digits are the state code, so both should be consistent with the company you are dealing with.

Does Udyam registration prove a business is trustworthy? No. Udyam is a self-declared MSME registration. Verifying the number confirms the enterprise exists and its category, not its quality or reliability.

Sources

Originally published on Dunime Insights. Dunime Technologies is a Delhi NCR software, automation and cybersecurity company: dunime.com.

Three checks before you trust a message asking for money

Dunime Technologies — Sun, 18 Oct 2026 08:15:14 +0000

By Manuj Kumar Pandey, Founder & Director, Dunime Technologies. This first appeared in The Investigator's Brief, his fortnightly LinkedIn newsletter on fraud and cyber developments in India.

Most frauds I look at do not need malware or a zero-day. They need one person to act on one message before checking it: a supplier's "new bank account", a video call from "the police", a screenshot claiming your company has been breached.

This first edition of The Investigator's Brief gives you the three checks I run before I trust any of them. They take minutes, cost nothing and use only government portals and free public services. First, two CERT-In advisories from this fortnight that every IT and finance lead in India should read.

This fortnight: what changed

1. AI agents walked into Indian systems through doors we left open

On 15 October 2026, CERT-In issued advisory CIAD-2026-0049, rated Critical. AI model providers told CERT-In that agents under evaluation had reached live systems of Indian organisations and read business records, including personal and confidential data. They got in with credentials exposed in application configuration and public code repositories, and through over-permissive cloud roles. None of the affected organisations noticed. The providers found it in their own reviews.

In a separate campaign, attackers used open-source agentic offensive tools against Indian entities. CERT-In says this cut the time from first access to impact from days to a few hours, and victims who fixed things only partly were hit again within days.

Why it matters: every weakness on CERT-In's list is old: exposed keys, forgotten test APIs, cloud roles anyone can read. What changed is speed. A gap you would have found in next quarter's audit can now be used this afternoon.

Do this week: scan your repositories, including history, for secrets and rotate anything you find; list every API and switch off test and dormant ones; check what an anonymous user can read and write in your cloud and backend-as-a-service roles; keep logs for at least 180 days.

2. Payment APIs are the new target in BFSI

On 9 October, CERT-In advisory CIAD-2026-0046 described attacks on NBFCs, digital lenders, fintechs, payment service providers and wallet operators. Attackers steal payment-gateway and partner-bank API credentials, call disbursal APIs from the entity's own whitelisted servers, skip KYC and beneficiary checks, and move money over IMPS and NEFT to mule accounts.

Do this week: MFA on payment platforms and bank APIs; no long-lived static tokens; maker-checker approval on fund movement; per-transaction and daily limits enforced at the API; real-time alerts on new beneficiaries and unusual velocity.

3. The scam now arrives as an ad

The Indian Cyber Crime Coordination Centre (I4C) has started an awareness drive on malicious social media ads: deals, jobs and dating offers that lead to unrelated websites, malicious apps or fake payment pages. A professional-looking ad on a familiar platform proves nothing about where it sends you.

The three checks

Check 1: Is the company the company?

Before an advance payment, look the counterparty up on the government's own registers.

MCA master data (mca.gov.in): search the name or CIN. Status must read Active, and the registered office should match the invoice.
GST Search Taxpayer (gst.gov.in): a GSTIN carries its own proof. The first two digits are the state code and characters 3 to 12 are the PAN. If the state does not match the address, or the embedded PAN belongs to another legal name, it is not this company's GSTIN.
Udyam verification: for any "registered MSME" claim on a quote or letterhead. It proves the business exists, not that it is honest.

Stop the payment if the MCA name, the GST name and the beneficiary name your bank or UPI app shows do not match, if a company asks to be paid into a personal account, or if bank details change by email. Confirm on a number you already had, never the one in the email.

Check 2: Is the authority real?

In October 2024, I4C said publicly that the CBI, police, customs, ED and judges do not arrest anyone on a video call. "Digital arrest" is a script: a parcel or SIM "linked to a crime", a uniform on screen, "tell no one", then money moved to "verify" you.

The isolation is the attack. Hang up, call the agency on a number you look up yourself, and tell one family member. If money has moved, call 1930 or file at cybercrime.gov.in at once; speed is what gets funds held. If nothing was lost, report the number on Chakshu, on the Department of Telecommunications' Sanchar Saathi portal.

Check 3: Is the breach real?

Breach claims arrive with a sample and a record count. Some are real. Many are older breaches repackaged, scraped public data, or lists stitched together from unrelated leaks. Ask three questions before you believe or share one:

Who is the source, and what is their track record?
Do the record count, the data fields and the dates agree with each other?
Has the company, CERT-In or a credible researcher verified it? If not, it is an allegation.

Never download the "sample": it is legal exposure and a common malware lure. If you might be affected, check your email on Have I Been Pwned (it only knows breaches that have been loaded into it), change reused passwords starting with email and banking, and turn on two-factor authentication. Expect phishing that quotes the breach; that is often the real damage.

For organisations, one rule matters most: CERT-In's Directions of 28 April 2022 require specified incidents to be reported within six hours of being noticed. Decide now who confirms, who files and what you send.

Free tool of the fortnight: gitleaks

For IT teams acting on the first advisory above. gitleaks is a free, open-source (MIT licence) scanner that finds API keys, tokens and passwords committed to git.

Scan every branch of a repository, with secrets masked in the output:

gitleaks git -v --redact --log-opts="--all" path/to/repo

Scan a folder of configuration files:

gitleaks dir -v --redact path/to/folder

The catch: it matches known secret patterns, so unusual or in-house credentials need your own rules. And anything it finds must be rotated, not just deleted from history. Once a key has sat in a public repository, assume someone has it.

Key takeaways

Attackers did not get new doors this month; they got faster. Close exposed keys and open cloud roles first.
Before paying anyone new: MCA status, GSTIN anatomy, beneficiary name.
No agency arrests anyone on a video call. Hang up, then report on 1930 or Chakshu.

Your turn

Tell me in the comments which scam or breach claim you saw most this fortnight. The next edition, on 3 November, is built from readers' answers.

If this was useful, subscribe to The Investigator's Brief on LinkedIn and forward it to the person who approves payments in your organisation. Between editions, Dunime Technologies posts scam alerts and field playbooks on its LinkedIn page.

Sources

CERT-In advisory CIAD-2026-0049, 15 October 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049
CERT-In advisory CIAD-2026-0046, 9 October 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0046
CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022 (six-hour incident reporting): https://www.cert-in.org.in
I4C advisory on "digital arrest", October 2024 (The Tribune): https://www.tribuneindia.com/news/india/cbi-ed-dont-nab-via-video-calls-advisory-to-curb-digital-arrest/
I4C awareness drive on malicious social media ads (ETV Bharat, 6 October 2026): https://www.etvbharat.com/en/bharat/i4c-launches-awareness-drive-as-fake-social-media-ads-become-the-new-cybercrime-trap-enn26100604507
GST Search Taxpayer: https://services.gst.gov.in/services/searchtp
National Cyber Crime Reporting Portal: https://cybercrime.gov.in
Sanchar Saathi (Chakshu): https://sancharsaathi.gov.in
gitleaks: https://github.com/gitleaks/gitleaks

Manuj Kumar Pandey, Founder & Director, Dunime Technologies. Full guides: dunime.com/insights

This guide is part of Dunime's fraud-help hub — also in हिन्दी, বাংলা, मराठी, తెలుగు and தমিழ், each with a short video: dunime.com/protect.

There is no such thing as a digital arrest

Dunime Technologies — Fri, 16 Oct 2026 09:13:33 +0000

“You are under digital arrest. Stay on video. Don't tell anyone.” Every line of that script is a tell, and none of it is how Indian law enforcement works.

How the script runs

It usually starts with a call about a parcel, a SIM card or a bank account linked to a crime. The caller transfers the victim to someone presenting as police, a central agency or customs, on a video call with a uniform, an office backdrop and official-looking documents.

The victim is told they are under “digital arrest”, must stay on camera, must not tell family, and must move money to a “verification” or “safe” account to clear their name. Calls can run for hours or days.

Why it keeps working

Authority borrowed from real agencies, with real-looking names and seals.
Fear of arrest, of a case against a child, of public shame.
Isolation. “Don't tell anyone” is not procedure. It removes the second opinion that would end the fraud in a minute.
Time pressure that leaves no room to check anything.

The uniform is a prop. The isolation is the attack.

The official position

In October 2024 the Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, issued a public advisory stating that the CBI, police, customs, ED and judges do not arrest anyone on a video call, and asked people to report such calls to 1930 or cybercrime.gov.in.

What to do during the call

Hang up. Do not stay on video, share your screen or install any app the caller asks for.
Verify independently. Call the agency on a number you look up yourself, never one the caller gives you.
Tell someone. One family member hearing the story usually ends it.
Never transfer money to “verify” an account or “clear your name”. No agency asks for this.

How to report it

If money has moved, call 1930 or file at cybercrime.gov.in at once and inform your bank; the sooner a report is made, the better the chance of the money being held.

Report the number even if you lost nothing. Chakshu, a facility on the Department of Telecommunications' Sanchar Saathi portal, takes reports of suspected fraud calls, SMS and WhatsApp messages. In February 2026 the government told the Rajya Sabha that 39.43 lakh mobile connections had been disconnected after analysis of citizen reports.

For organisations

Finance teams, senior staff and employees' families are all targets. A two-line rule in onboarding and awareness sessions, that no agency arrests anyone over video and no payment ever clears a case, does more than any tool.

Questions people ask

Is digital arrest legal in India? No. The Indian Cyber Crime Coordination Centre has publicly stated that the CBI, police, customs, ED and judges do not arrest anyone on a video call. A 'digital arrest' is a fraud.

Where do I report a digital arrest call? Call the national cybercrime helpline 1930 or file a complaint at cybercrime.gov.in. Suspected fraud calls and messages can also be reported through Chakshu on the Sanchar Saathi portal, even if no money was lost.

What is Chakshu? Chakshu is a facility on the Department of Telecommunications' Sanchar Saathi portal for reporting suspected fraud calls, SMS and WhatsApp messages. It is meant for suspected fraud communication; frauds that have already happened go to 1930 or cybercrime.gov.in.

Sources

Originally published on Dunime Insights. Dunime Technologies is a Delhi NCR software, automation and cybersecurity company: dunime.com.