India’s central bank builds cyber defences as hidden-code flaws put patching to the test

The bank building its own defences

The Reserve Bank of India has inaugurated a new data centre and a cybersecurity training institute in Bhubaneswar. The new data centre is designed to enhance the capacity, resilience, and security of the RBI's critical systems, and it will house mission-critical systems including RTGS and NEFT. m:…7547 m:…6160

The training side matters as much as the building. The IT training centre will support skill development in cybersecurity, data science, cloud computing, and AI for RBI and banking sector officials, and the Cybersecurity Training Institute will build expertise in cybersecurity, AI, and other emerging technologies. m:…7547 m:…6160

The RBI is also setting rules for how the technology is used. It has implemented frameworks for IT governance, cyber resilience, outsourcing, third-party risk, and digital payment security, and it is encouraging the use of artificial intelligence based on principles of accountability, fairness, and explainability. Sanjay Malhotra of the RBI stated the bank is committed to supporting India's aspiration to become a developed nation by 2047, and Narendra Modi described the new facility as a reflection of India's changing approach to governance focused on regional economic development. m:…7547 m:…6160

The flaw hiding inside other software

Tanium reports that CVE-2026-111497 is an out-of-bounds write vulnerability in Google's Brotli decoder, scored 9.2 under CVSS v4.0, affecting Brotli library versions 1.0.3 through 1.2.0. The vulnerability allows remote, unauthenticated attackers to crash a process, read its memory, or potentially run code, and exploitation can occur via inbound requests or outbound fetches, putting build agents, scrapers, and developer tools at risk. m:…9521

The practical problem is inventory, not awareness. Tanium reports that finding vulnerable copies is difficult because Brotli is often bundled inside other software, runtimes, or container images. The fix exists in specific releases: Node.js versions 26.12.1, 24.22.1, and 22.23.4 contain the fix, Brotli and brotlicffi packages require version 1.2.1 and 1.2.1.0 respectively, and Bun requires version 1.4.4. But version checks can mislead, because Tanium reports that Node.js reports process.versions.brotli as 1.1.0 or 1.2.0 even on fixed releases. m:…9521

Tanium also reports two facts that should temper any claim that the issue is closed. The fix was committed to the Brotli repository on February 27, 2026, but not labeled as a security issue until later, and as of October 24, 2026, CVE-2026-111497 is not listed in CISA's KEV catalog, with no public indicators of compromise released as of that date. As a temporary mitigation, Tanium recommends rejecting Content-Encoding: br at the WAF or reverse proxy. Imperva demonstrated code execution on the official Node.js 24.22.0 image for Linux arm64, according to Tanium, which is a reminder that demonstration and exploitation are different stages of the same risk. m:…9521

The flaw hiding inside the web stack, flagged again

Oracle has also flagged the same pair of PHP flaws. Oracle reports that CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, may allow unauthenticated remote code execution, and it puts the highest CVSS v3.1 base score for the pair at 9.8. Oracle has released security alerts for both vulnerabilities and recommends that customers apply the available security patches without delay. m:…1464

The advisory itself is a moving target: Oracle says its Security Alert Advisory will be updated as additional product patches become available, with detailed guidance on the advisory site. For a bank running PHP anywhere in its stack, the practical point is that the vendor treats patching here as urgent rather than routine, since the flaws need no login to exploit. m:…1464

What a bank should check first

Read together, these items point to the same operational question: do you know what code you are actually running, and who on your team can judge it? The RBI answer is institutional, with a data centre for its own critical systems and a training institute for its own people and banking sector officials. The Tanium and Oracle answers are practical, with version numbers to check and patches to apply without delay, rather than assurances to accept. m:…7547 m:…9521 m:…1464

This suggests a sensible order of work for a bank. First, inventory bundled libraries rather than only directly installed ones, since the Brotli flaw hides inside components that teams may not list as dependencies. Second, treat a vendor patch recommendation marked urgent as a deadline, not a suggestion, given that the PHP flaws need no authentication. Third, treat a version number as a clue rather than proof, given the Brotli reporting quirk Tanium describes. m:…9521 m:…1464