The government is considering granting enforcement powers to India's nodal cybersecurity agency, Cert-In - similar to the approach taken by the US and the European Union - after an unprecedented increase in cyberattacks carried out with artificial intelligence, officials familiar with the matter told the Economic Times.
Today, Cert-In issues advisories on cybersecurity threats, but compliance is not mandatory. That could change first for government organisations, which may be legally required to patch critical vulnerabilities within fixed timeframes. "This could begin with government organisations being brought under a framework that legally ensures they comply with Cert-In instructions," an official said, citing global precedents.
The immediate trigger was last month's PHP crisis. Two critical flaws in the PHP programming language - discovered with the help of AI - were targeted by hackers millions of times, prompting governments including the US, UK, France, Germany and Japan to take public websites offline. PHP powers 69.3% of websites worldwide, and India's exposure is structural: thousands of state portals, district administration sites and grievance systems run on PHP-based systems, with the National Portal of India alone linking to more than 6,700 government websites. Elets eGov reported 303 government, public-sector and critical-sector websites were left potentially exposed.
Cert-In advised organisations to patch quickly, but officials conceded advisories could not ensure compliance. Experts warn the deeper problem is legacy: bank, telecom, power and consumer applications running older PHP versions have no fix, and patching at this scale is a long haul.
One existing lever is Section 70B(6) of the IT Act, 2000, which lets Cert-In issue binding directions, with non-compliance punishable under 70B(7) by up to one year's imprisonment, a Rs 1 crore fine, or both. The provision has been used sparingly - most notably in 2022, when Cert-In mandated reporting of 20 types of cyber incidents within six hours.
FundForge Insight: this is India moving cybersecurity from advice to obligation, and the sequencing matters - government systems first, because that is where the state can legislate compliance fastest. For companies, the direction of travel is clear: patching and incident reporting will become enforceable duties with penalties, not best practices. Anyone running legacy PHP infrastructure should treat this as a board-level risk item now. Sources: Economic Times (November 3, 2026), Elets eGov (November 2026).
