PHP2Shell left hundreds of government and critical-sector websites exposed, and advisories alone did not get them fixed fast enough.
Key takeaways
- The Centre is considering giving CERT-In powers to legally require government bodies to patch critical flaws within fixed deadlines, officials said on 3 November 2026.
- The trigger is PHP2Shell, two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution without logging in.
- About 60,000 Indian websites were flagged as potentially vulnerable, including 303 government or critical-sector sites.
- The National Informatics Centre found 14 of its 112 critical systems vulnerable and has patched them.
- In the US, CISA gave federal agencies just three days to patch the same flaws.
What are CERT-In’s proposed binding powers? The Centre is weighing a framework that would let CERT-In order government organisations to patch critical software vulnerabilities within a fixed deadline, instead of only issuing advisories they can ignore. Officials say it could start with government bodies and later extend further, alongside continuous vulnerability disclosure programmes.
Why is the government considering this now?
The short answer is PHP2Shell. In October 2026, two critical flaws in PHP, the language that powers a large share of the world’s websites, were disclosed and patched. Both carry a severity score of 9.2 and let an attacker run code on a vulnerable server without any login.
PHP released fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on 21 October. Exploitation started quickly. Amazon’s threat intelligence team saw attempts as early as 17 October, and researchers running honeypots recorded successful attacks within days of the patch.
On 24 October, MeitY Secretary S Krishnan shared the scale of India’s exposure: roughly 60,000 Indian websites were flagged as potentially vulnerable, and 303 of them belonged to government bodies or critical sectors. No deadline was set for central and state agencies to finish assessing and patching their systems. That gap is what the new proposal is meant to close.
Which Indian organisations were exposed?
The 303 government and critical-sector sites break down as follows, according to figures reported by Elets eGov based on the Secretary’s numbers.
| Type of organisation | Sites flagged |
|---|---|
| Central government bodies | 89 |
| State and Union Territory governments | 80 |
| Critical-sector organisations | 83 |
| Central public sector undertakings | 27 |
| State-owned companies | 24 |
| Total | 303 |
Separately, the National Informatics Centre (NIC), which runs much of the government’s IT backbone, found 14 of its 112 critical systems vulnerable and has patched them. For context, the National Portal links to more than 6,700 government websites.
What powers does CERT-In already have?
CERT-In is not powerless today. Section 70B(6) of the IT Act, 2000 lets it call for information and issue binding directions to service providers, intermediaries, data centres and body corporates. Under Section 70B(7), ignoring those directions can lead to up to one year in prison, a fine of up to ₹1 crore, or both.
In practice, CERT-In has used these powers sparingly. Its best-known use is the 2022 directions that require 20 types of cyber incidents to be reported within six hours. For routine vulnerabilities, it publishes advisories, and organisations decide for themselves how fast to act.
The new idea is different in two ways. It would set clear patching deadlines for critical flaws, and it would explicitly cover government bodies, which have often been slow to update ageing websites. Officials have also revived older proposals for binding directives during cyber emergencies.
How does India compare with the US response?
The contrast with the US is striking. CISA, the US cyber defence agency, added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalogue on 26 October and told federal civilian agencies to patch by 29 October, a three-day window under Binding Operational Directive 26-04.
| India | United States | |
|---|---|---|
| Agency | CERT-In | CISA |
| Current tool | Advisories; binding directions used sparingly | Binding Operational Directives |
| PHP2Shell patch deadline for government | None set | 29 October 2026 (3 days) |
| Status | Binding powers under consideration | Already in force |
Globally, the patching gap is wide. Kaspersky, citing Censys data, said about two weeks after the patches, 29 million of 46 million scannable servers running vulnerable PHP versions still had the flaws. No mass breach has been confirmed so far, partly because working exploits often need to match the exact PHP build and server setup.
Where does AI fit into this?
Officials quoted by The Economic Times argued that one-time security audits before a website goes live may miss zero-day flaws that AI tools can now find, which is why continuous disclosure programmes are on the table. Researchers have also noted that fresh PHP2Shell exploits kept appearing in batches with help from AI.
In a related development, IT Ministry sources told PTI on 3 November that CERT-In has gained access to Mythos, an AI model from Anthropic that is available only to a limited set of organisations because of its cyber capabilities. The sources said CERT-In will test it slowly and carefully, first to understand what it can do and what risks it carries, before considering wider use.
The ministry is also preparing a consultation paper on AI regulation. Officials expect the patching powers to be discussed further once that paper is out. No date has been given for either.
What should you do now?
Whether or not the new rules arrive, the PHP2Shell episode is a clear signal for anyone running a website in India.
- Patch PHP now. Move to the latest builds on your branch, including the second round of builds dated 25 October or later, which also fix a related Brotli library flaw.
- Check for compromise, not just the version. Review logs for unusual multipart/form-data POST requests, sudden bursts of large requests and HTTP 500 errors with PHP out-of-memory messages.
- Close admin panels to the internet. Firewall and device management interfaces should be reachable only from trusted internal IPs.
- Know your reporting duties. CERT-In’s six-hour rule already applies to many incidents, and under the DPDP Rules a personal data breach must be reported to the Data Protection Board within 72 hours, with penalties of up to ₹200 crore for failures.
- For government IT teams, start keeping a patch log with dates now. If deadlines become binding, evidence of timely patching will matter.
FAQs
What is PHP2Shell?
PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. They allow an unauthenticated attacker to run code on a vulnerable PHP server. Fixes were released on 21 October.
Has CERT-In been given new powers already?
No. As of 3 November 2026, officials said the Centre is only considering binding patching powers. No draft rule, deadline or decision has been announced.
How many Indian websites were affected by PHP2Shell?
About 60,000 Indian websites were flagged as potentially vulnerable, according to MeitY Secretary S Krishnan. Of these, 303 were government or critical-sector sites.
What is the penalty for ignoring CERT-In directions today?
Under Section 70B(7) of the IT Act, failing to comply with CERT-In’s binding directions can lead to up to one year in jail, a fine of up to ₹1 crore, or both. These directions apply to service providers, intermediaries, data centres and body corporates.
Does this affect private companies?
The proposal would start with government organisations, according to officials, and could be extended later. Private firms are already covered by CERT-In’s existing 2022 incident reporting directions.
Is my small business website at risk?
If it runs on PHP and has not been updated since 21 October 2026, it may be. Update PHP through your hosting provider or server, and ask your host to confirm they have applied the latest builds.
Sources
- CERT-In May Get Binding Powers to Force Govt Patching, Elets eGov
- CISA confirms PHP2Shell exploitation and gives federal agencies until Oct. 29 to patch, MarketScale
- PHP2Shell: what we know about the threat two weeks later, Kaspersky
- CERT-In gets Mythos access; to assess its use in measured manner, ThePrint (PTI)
