A patch released is not a problem solved. Discuss the challenges of patch management for India's MSMEs and government websites.

A patch is the vendor's fix for a software weakness. A system is protected only once the patch is actually installed. On October 21, the PHP team disclosed two serious flaws that let attackers break into web servers remotely, without a password, and released fixes at the same time [1]. PHP runs online shops, news sites and business tools, so many Indian websites were exposed. The gap between a fix being available and a fix being applied is now the main source of risk.

Challenges for MSMEs

• Disclosure gives attackers a target: once a fix is announced, attackers know where the weakness lies. Owners who have not updated become easier targets [1].
• Shared-hosting dependence: small shops on cheap shared hosting cannot upgrade PHP themselves. They often do not even know which version their site runs [1].
• Patching does not remove an intruder: experts advised owners to update and check for signs of a breach [1]. A compromise assessment needs skilled staff that small firms rarely have.
• Too many warnings: in 2025 CERT-In issued 1,530 alerts and 390 vulnerability notes [2]. These are written for experts, not for a blog or store owner.
• Legal exposure: the DPDP Act, 2023 requires reasonable security safeguards [4], so an owner who ignores a public fix risks liability.

Challenges for government websites

• No asset inventory: a department cannot patch a server it does not know it runs.
• Rules act after the attack: the CERT-In Directions (2022) require incidents to be reported within 6 hours [3]. They set no deadline for fixing a known weakness before an attack.
• Scale of threat: CERT-In handled over 29.44 lakh incidents in 2025 [2], which stretches the capacity of departments to respond.
• Rights at stake: leaks from citizen portals affect the Right to Privacy under Article 21 (Puttaswamy, 2017).

Flaw disclosed → Patch released → [Exposure window] → Patch applied → Breach check
                                   ↑ risk is highest here

Fig: Where patch management fails

Way forward

• Hosting providers upgrade PHP for all their customers in one go.
• CERT-In sends plain-language "what to do" alerts through hosting companies and MSME bodies.
• The government sets time-bound patching norms and requires departments to keep an asset inventory.

Releasing a patch only starts the job. It is finished when the fix is applied, verified and followed by a breach check. Combining provider-level patching, simpler alerts and deadlines for fixing known flaws would make India's digital ecosystem secure-by-design and protect citizens' constitutional right to privacy.