Centre weighs binding CERT-In powers to make government bodies patch flaws on deadline

The Centre is considering giving the Indian Computer Emergency Response Team (CERT-In) powers to legally require government organisations to patch critical software vulnerabilities within fixed deadlines, Elets eGov reported on Tuesday, citing officials. CERT-In's advisories are not mandatory at present, although Section 70B(6) of the IT Act allows it to issue binding directions, a power the report said has rarely been used. The proposal has not been notified and no draft has been published.

What prompted it

The discussion follows a fast-moving flaw in PHP, the scripting language behind a large share of websites. CERT-In's advisory on the issue, nicknamed "PHP2Shell", says an unauthenticated remote attacker could run arbitrary code on an affected server by sending a specially crafted request, and rates the risk of remote code execution and complete system compromise as high. The advisory was issued on 22 October 2026 for MSMEs and covers PHP 8.5 versions before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35. It carries a note that "multiple reports confirm large scale exploitation in the wild".

CERT-In's advice is to identify whether a site or hosting account uses PHP, upgrade to the fixed versions, patch internet-facing systems first, move off PHP 8.1 and earlier, which no longer get upstream fixes, restrict access if patching is delayed, and check logs for signs of compromise, reporting incidents to incident@cert-in.org.in.

What officials told Elets

According to Elets, CERT-In flagged 303 government and critical-sector websites as potentially exposed to the flaws, and MeitY Secretary S Krishnan said on 24 October that about 60,000 Indian websites had been flagged as potentially vulnerable. Officials said the framework could begin with government organisations. Because one-time security audits before launch can miss flaws later found with AI tools, continuous vulnerability-disclosure programmes are also being considered. The report noted that the National Portal of India links to more than 6,700 government websites, many of them running PHP-based content-management systems.

The wider rules

The Digital Personal Data Protection Rules already require a detailed breach report to the Data Protection Board within 72 hours, with penalties of up to Rs 200 crore, Elets reported. CERT-In has also published guidelines on information-security practices for government entities, and a blueprint on defending against AI-assisted exploitation of vulnerabilities, both listed on its website.

Why deadlines matter

The PHP2Shell case shows the gap. CERT-In published fixed versions and urged urgent patching, but an advisory cannot compel a department or a state portal to apply it, and many government sites run on older software. A binding rule would turn patching into a compliance duty for state IT departments, which Elets said are in some cases already building capacity.

What happens next

Elets said further discussion is expected after MeitY releases its consultation paper on AI regulation, and that sector regulators such as TRAI are moving ahead with their own AI-governance rules for telecom networks. Until a binding order is issued, patching deadlines for government bodies remain a recommendation. The details of the powers, deadlines and penalties, if any, have not been made public; the Elets report is based on unnamed officials, and the Centre has not issued a statement on it.