CERT-In Binding Powers India Explained: Government Patching May Soon Become Mandatory

Illustrative image: server infrastructure of the kind that runs government portals and public services. Image: NERSC / Wikimedia Commons.

TL;DR: CERT-In binding powers India, explained: the Centre is considering giving India's cyber agency enforceable powers to make government organisations patch critical software flaws within fixed deadlines. Today its advisories are only advisory. The trigger was October's PHP2Shell crisis, which left 303 government and critical-sector websites potentially exposed. Nothing is law yet — this is a proposal under discussion, starting with government bodies first.

📌 KEY HIGHLIGHTS

• The Centre is considering enforceable CERT-In powers, officials told The Economic Times on 3 November 2026.
• Today, CERT-In's advisories are not mandatory — a gap exposed when the PHP2Shell flaws hit in October 2026.
• CERT-In had flagged about 60,000 Indian websites as potentially vulnerable; 303 belonged to government and critical sectors.
• The proposed framework would start with government organisations, with fixed patching deadlines modelled on US and EU approaches.
• CERT-In already has rarely used binding-direction powers under Section 70B of the IT Act, 2000 — the proposal would make patching duties routine, not exceptional.

What CERT-In binding powers in India would actually change

India's national cyber agency, the Indian Computer Emergency Response Team (CERT-In), sits under the Ministry of Electronics and Information Technology (MeitY). It issues advisories on threats and vulnerabilities, coordinates incident response, and tells organisations what to patch. The catch: those advisories are not mandatory, so compliance depends on each organisation getting around to it.

According to officials familiar with the matter, quoted by The Economic Times on 3 November, the government is now considering changing that. "This could begin with government organisations being brought under a framework that legally ensures they comply with CERT-In instructions to patch critical vulnerabilities within fixed timeframes," one official said. The model, officials added, draws on global precedents in the United States and the European Union, where cyber agencies can set binding patching deadlines.

The proposal is exactly that — a proposal. No draft law, deadline length, or penalty structure has been announced, and officials expect further discussion after MeitY releases its consultation paper on AI regulation. But the direction is clear: patching would stop being advice and start being a compliance duty, at least for government bodies first.

Why PHP2Shell changed the debate

The trigger was October 2026's PHP2Shell crisis. Two critical flaws in the PHP programming language (CVE-2026-109618 and CVE-2026-109619), discovered with AI assistance, let attackers run code remotely and take over web servers. Hackers targeted vulnerable servers millions of times, and governments including the US, UK, France, Germany and Japan took public websites offline as a precaution.

In India, MeitY Secretary S Krishnan said on 24 October that CERT-In had flagged about 60,000 Indian websites as potentially vulnerable. The 303 government, public-sector and critical-sector cases broke down as follows:

Category	Websites flagged
Central government bodies	89
State and Union Territory governments	80
Central public sector undertakings	27
State-owned companies	24
Critical-sector organisations	83

The National Informatics Centre (NIC) found 14 of its 112 critical systems vulnerable and has patched them. But no deadline was set for other central and state agencies to finish even assessing their exposure. Officials also pointed to the suspected ransomware attack on Telangana's TG-iPASS portal as a reminder of how exposed public digital services can be. CERT-In held meetings with state response teams and prioritised health- and banking-related websites, yet, as the ET report notes, advisories "could not ensure complete compliance from government agencies running myriad, potentially affected, websites."

Illustrative image: code on a monitor. The PHP2Shell flaws were found in the PHP language that powers a large share of government and public websites. Image: Unsplash / Wikimedia Commons.

Why it matters for India readers

This is not an abstract policy debate — it touches the portals Indians use every day. Thousands of state portals, district websites, municipal services and grievance systems run on PHP-based content management systems, and the National Portal of India links to more than 6,700 government websites. When one of those runs an unpatched flaw, citizen data and public services are in the firing line.

A deadline-bound mandate would also land on state IT departments that are still building capacity — Uttar Pradesh's Cabinet, for example, has cleared a ₹104-crore Cyber Security Operations Centre. And it would sit alongside tighter rules already in motion: under the Digital Personal Data Protection Rules, a detailed breach report must reach the Data Protection Board within 72 hours, with penalties of up to ₹200 crore. The bigger structural problem, experts warned during the PHP crisis, is legacy systems: bank, telecom, power and consumer applications running older PHP versions that have no fix at all, where patching on this scale could run into 2027.

There is also a nuance worth knowing. CERT-In is not actually powerless today. Section 70B(6) of the Information Technology Act, 2000 lets it issue binding directions to service providers, intermediaries, data centres and body corporates, and Section 70B(7) punishes non-compliance with up to one year in prison, a fine of up to ₹1 crore, or both. But the agency has used that power sparingly — most notably in its 2022 directions requiring 20 types of incidents to be reported within six hours. The new proposal would turn an exceptional power into a routine patching duty, and officials are also considering continuous vulnerability disclosure programmes, since one-time audits before a portal launches cannot catch zero-day flaws later found by AI models.

Should you care?

✅ Verdict: Yes — but watch what actually gets proposed. If you run or use a government website, this could turn "patch when you can" into "patch by this date, or else." For ordinary citizens, the payoff is quieter but real: fewer unpatched portals holding your data. The honest caveat: this is officials discussing a proposal, reported on 3 November — not a law, not a deadline, and not yet a CERT-In order. Treat any claim that "CERT-In can now force patching" as premature until the framework is announced.

FAQs

Are CERT-In advisories mandatory today?
No. CERT-In's advisories are not mandatory to comply with, though the agency can issue binding directions under Section 70B(6) of the IT Act, 2000 — a power it has used sparingly, most notably in its 2022 incident-reporting directions.

Who would the new powers apply to first?
Officials said the framework could begin with government organisations, requiring them to patch critical vulnerabilities within fixed timeframes. Private companies are not named in the proposal as reported so far.

What is CERT-In?
CERT-In, the Indian Computer Emergency Response Team, is India's national nodal agency for cyber incident response under MeitY. It collects and analyses information on cyber incidents, issues advisories and vulnerability notes, coordinates incident response across sectors, and can take emergency measures during critical incidents.

What were the PHP2Shell flaws that triggered this?
Two critical flaws in the PHP programming language (CVE-2026-109618 and CVE-2026-109619), discovered with AI assistance in October 2026, allowed remote code execution on web servers. Attackers targeted vulnerable servers millions of times, several governments took public sites offline, and CERT-In flagged about 60,000 Indian websites as potentially vulnerable.

Takeaway: CERT-In's advice is about to get teeth — at least for government bodies. The PHP2Shell scare showed that advisories alone do not get 60,000 websites patched; fixed deadlines might. Until the framework is formally proposed, though, this remains a plan under discussion, not a rule you can be fined under.

Follow India on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• The Economic Times — "Govt mulls giving Cert-In enforceable powers to mandate patching" (3 Nov 2026)
• Elets eGov — "CERT-In May Get Binding Powers to Force Govt Patching" (3 Nov 2026)
• DPDP India — CERT-In cybersecurity incident reporting and obligations under Section 70B

Related TechByCountry coverage: CERT-In's AI agents advisory: rogue test agents read confidential records unnoticed; CERT-In's GoAhead web server flaws warning for routers, firewalls and factory gear; the WS_FTP critical flaw patched under a CISA deadline.