The Centre is considering CERT-In enforcement powers that would legally require government organisations to patch critical software vulnerabilities within fixed deadlines, officials told The Economic Times on 3 November 2026. The move follows two AI-discovered flaws in the PHP programming language that left 303 government, public-sector and critical-sector websites in India potentially exposed.
The Indian Computer Emergency Response Team (CERT-In), the national nodal agency for cyber incident response under the Ministry of Electronics and Information Technology (MeitY), currently issues advisories that organisations are not obliged to follow. Officials said a binding framework could start with government bodies, an area where recent incidents such as the suspected ransomware attack on Telangana’s TG-iPASS portal have shown how exposed public digital services can be.
Why CERT-In enforcement powers are on the table
In October 2026, two critical PHP flaws, known as PHP2Shell, allowed attackers to run code remotely and take control of web servers. Governments including the US, UK, France, Germany and Japan took public websites offline as hackers targeted them millions of times.
MeitY Secretary S Krishnan said on 24 October 2026 that CERT-In had flagged about 60,000 Indian websites as potentially vulnerable. Of these, 303 belonged to the government and critical sectors:
- 89 instances of central government bodies
- 80 of state and Union Territory governments
- 27 of central public sector undertakings and 24 of state-owned companies
- 83 of critical-sector organisations
The National Informatics Centre (NIC) found 14 of its 112 critical systems vulnerable and has patched them, Krishnan said. No deadline was set for other central and state agencies to finish assessment and patching.
What a binding patch mandate could look like
“This could begin with government organisations being brought under a framework that legally ensures they comply with CERT-In instructions to patch critical vulnerabilities within fixed timeframes,” an official said. Officials added that the PHP crisis had revived earlier proposals to let the agency issue binding directives during cyber emergencies, along the lines of approaches in the US and the European Union.
CERT-In already has some statutory teeth. Section 70B(6) of the Information Technology Act, 2000 lets it call for information and issue binding directions to service providers, intermediaries, data centres and body corporates, while Section 70B(7) provides for up to one year in prison, a fine of up to ₹1 crore, or both, for non-compliance. The agency has used this sparingly, most notably in its 2022 cyber security directions, which require 20 types of incidents to be reported within six hours.
Officials said one-time audits of portals before launch may miss zero-day flaws found by AI models, so continuous vulnerability disclosure programmes are being considered. CERT-In’s recent blueprint for defending against AI-assisted exploitation already urges rapid, continuous patching of internet-facing systems.
What it means for state e-governance
Thousands of state portals, district websites, municipal services and grievance systems in India run on PHP-based content management systems, and the National Portal of India links to more than 6,700 government websites. A deadline-bound mandate would make patching a compliance duty for state IT departments, many of which are already building capacity, such as the ₹104-crore Cyber Security Operations Centre cleared by the Uttar Pradesh Cabinet.
The proposal would add to tighter breach reporting under the Digital Personal Data Protection Rules, under which a detailed breach report must reach the Data Protection Board within 72 hours, with penalties of up to ₹200 crore. Officials expect further discussion after MeitY releases its consultation paper on AI regulation, as sector regulators such as TRAI move ahead with their own AI governance rules for telecom networks.
Key takeaways
- The Centre is weighing binding CERT-In powers to make government bodies patch critical flaws within set timeframes.
- CERT-In flagged 303 government and critical-sector websites as potentially exposed to the PHP2Shell flaws.
- Existing IT Act powers under Section 70B allow binding directions but have rarely been used.
FAQ
Are CERT-In advisories mandatory today?
No. CERT-In advisories are not mandatory, though the agency can issue binding directions under Section 70B(6) of the IT Act, 2000.
Who would the new powers apply to first?
Officials said the framework could begin with government organisations, requiring them to patch critical vulnerabilities within fixed timeframes.
Featured image: MeitY Secretary S Krishnan at a media briefing in New Delhi, 22 August 2025. Photo: Ministry of Electronics and Information Technology / Wikimedia Commons (GODL-India)