MediumII Cyber Warfare & Critical Infrastructure3 November 2026, Tuesday
India weighs giving CERT-In power to force patching on state bodies
New Delhi is considering powers that would let CERT-In, its cyber response team, compel public bodies to close critical flaws within set deadlines, officials told the Economic Times on 3 November. The trigger is 303 government and critical-sector websites exposed to the PHP2Shell flaws.
S. Krishnan, Secretary at the IT ministry, said on 24 October that CERT-In had flagged around 60,000 Indian websites as potentially vulnerable. Of these, 303 belong to the government and critical sectors: 89 central bodies, 80 state and union territory bodies, 51 public sector companies and 83 critical-sector entities. The National Informatics Centre found 14 of its own 112 critical systems vulnerable and patched them; no deadline was set for other bodies.
PHP2Shell is the name given to two critical PHP flaws that allow code to run on a server without logging in: CVE-2026-109618 and CVE-2026-109619, each scored 9.2 on the CVSS 4.0 scale. PHP developers released an emergency patch on 21 October; there is no official patch for version 8.1 and earlier. According to the Free Press Journal, there are no confirmed victims in India. The Netherlands, Finland, France and Denmark took some public websites offline as a precaution.
The constraint is legal. CERT-In advisories are not binding today, so the speed of patching is left to each body's discretion. Sources differ on the number of the CERT-In notice; one gives CIVN-2026-0510 dated 21 October, another CIAD-2026-0052 dated 23 October.
Talay assessment
Bottom line
India is debating a move from cyber advisories to cyber mandates. That 303 critical sites remained exposed shows the voluntary patching regime is not working in the public sector. Binding deadlines would raise IT budgets and supplier workloads for public bodies; without them, the next critical flaw will repeat the same picture.
Likely effects
- Public sector ITUncertain1–6 months
Binding patch deadlines would bring forward budget and staffing needs across 89 central and 80 state bodies, and make upgrades from old PHP versions mandatory.
- Critical infrastructure riskNegativeWeeks
Even without confirmed victims, the exposure of 83 critical-sector entities carries remote code execution risk into energy and financial systems.
- Cyber insuranceUncertain6 months+
A statutory patch deadline would clarify cover disputes over losses from known vulnerabilities; a body that misses the deadline would have a weaker claim.
Possibilities, ranked
- 1Draft emerges, deadlines vague50%
The IT ministry puts binding powers into draft rules, but exact patch deadlines are left to negotiation with public bodies.
Watch: A draft notification from the IT ministry on CERT-In rules
- 2Rapid mandate30%
A PHP2Shell breach is confirmed on a public website and the ministry issues a time-bound patching order at once.
Watch: A CERT-In notice of a confirmed PHP2Shell incident
- 3Voluntary regime stays20%
The debate is shelved and advisories keep their non-binding status.
Watch: The IT legislative agenda for the winter session
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Exposed public sites▼ 303
- Flagged sites▼ ≈60,000
- NIC vulnerable systems▼ 14/112