Cybersecurity is a matter of national security and geopolitical resilience. PHP (Hypertext Preprocessor), the programming language behind a large share of websites, is part of the digital infrastructure on which economies and public services depend. On October 21, 2026, two critical flaws were disclosed in PHP.The flaws, known as PHP2Shell, allow an attacker to run code on a web server without logging in, and were found by security firms with the help of advanced AI models. Exploitation attempts began before the fix was released, and about eight lakh servers still run PHP versions that will never receive an official fix.With frontier AI models having reduced the time and effort needed to prove the flaws exploitable, AI has to be seen as shortening the interval between vulnerability discovery and attack, forcing governments and cyber defenders to rethink their cyber defence strategies.Following the event, most governments and companies patched rapidly or switched systems off. The US National Security Agency told organisations to patch or take servers offline and Japan announced a team to simulate AI-driven attacks. Many other governments went offline as a precaution. India’s CERT-In issued a critical advisory on the day of the patch. In China, official alerts came first, followed by commercial remediation strategies.The China National Vulnerability Database (CNVD) rated the flaws as high risk, and the threat-sharing platform of the Ministry of Industry and Information Technology (MIIT) urged inspections and upgrades, suggesting interim steps such as taking services offline and isolating networks. Tencent and Alibaba alerted customers within hours, and Chinese internet security company Qihoo 360 made its AI vulnerability agent free for enterprises. Although about 75% of China’s identifiable PHP installations utilise legacy software, leaving over 10 lakh systems vulnerable, no domestic platforms were openly disclosed as compromised or forced offline.China’s pattern of quiet, state-directed remediation rests on five features of its cyber governance that set it apart from other national systems. The first is state control of vulnerability intelligence. Since 2021, companies in China have been required to report vulnerabilities to the MIIT within 48 hours of discovery and may not publish exploit code before a patch is available. The EU’s Cyber Resilience Act also sets a 24-hour deadline, but only for flaws already being exploited, while in the US, disclosure remains largely voluntary and led by vendors. In China, the obligation arises at discovery rather than exploitation, and the state, not the software vendor, is its first recipient.The second is the reporting clock. Critical infrastructure operators must report serious incidents within one hour, compared with six hours in India and a 72-hour rule in the US, which is still not final. As these reports go to regulators rather than the public, the western outages were visible, while any Chinese incidents were not.The third is an institutional architecture that keeps security agencies closely connected to vulnerability reports and technical information used for cyber defence. Alongside the China National Vulnerability Database, run by the national emergency response team, China maintains a parallel database linked to the Ministry of State Security, responsible for external intelligence operations. In most countries, vulnerability coordination is the work of civilian response teams and is usually separated from intelligence agencies.The fourth is a mandatory technical baseline. The Multi-Level Protection Scheme requires every network to be graded on five levels and registered with the police, giving authorities a register of graded systems when a flaw like PHP2Shell appears. Under the Xinchuang programme- China’s state-backed initiative to replace foreign hardware — software, and IT infrastructure with self-reliant domestic alternatives — state agencies are also moving off Windows to domestic Linux systems, reducing the use of foreign proprietary code in government.Fifth, China has developed a domestic AI-based cyber-defence industry that works closely with the state. For instance, after being excluded from Anthropic’s Mythos programme, Chinese cybersecurity firms such as 360 and Qianxin developed their own AI tools to identify software vulnerabilities. Since many websites rely on a small number of cloud service providers, a single security advisory can reach a large number of website operators.The most crucial debate about the Chinese model concerns centralisation. About 1,400 vulnerabilities were listed in Chinese databases before public disclosure, which supports a common argument that the 48-hour rule also feeds China’s security services. With Microsoft attributing AI-automated intrusions to a China-aligned group, the question is whether the model strengthens domestic defence at the expense of international threat-sharing.Another debate concerns sovereignty over code. Given that the majority of local operating platforms rely on Linux architecture and Chinese servers deploy identical PHP software to global infrastructure, such technological substitution merely replaces the vendor without eliminating fundamental reliance on common open-source code.India responded promptly to the situation, but its existing regulatory structure addresses only a fraction of the broader challenge. CERT-IN’s directions require incident reports within six hours, yet India has no statutory channel for reporting vulnerabilities, no binding patch deadlines for critical infrastructure, nor public estimates of its exposure. A recent CERT-In advisory found that AI agents had entered Indian systems without the knowledge of affected organisations. A national vulnerability database and mandatory remediation timelines would, therefore, close much of that gap.China’s case shows that remediation comes from institutions that learn about flaws early. India can build that capacity while keeping disclosure open to vendors, researchers and the public.By arrangement with the Centre of Excellence for Himalayan Studies, Shiv Nadar University, Delhi-NCR