Vulnerabilities in widely used open-source software create systemic cyber risk. Examine with reference to recent incidents, and suggest an institutional response for India.

Open-source components such as PHP and Log4j are reused by millions of systems. A flaw in one shared component therefore becomes a flaw in all of them. On 21 October 2026 the PHP team disclosed two flaws that allow remote server takeover without a password [1]. This shows how one weakness becomes systemic risk.

How open-source flaws become systemic

• Concentration: PHP runs online shops, blogs, news sites and business tools. One defect exposes everyone, from small shops on shared hosting to firms with hundreds of servers [1].
• Severity: Unauthenticated Remote Code Execution puts passwords, private data and the servers themselves at risk [1].
• Precedent: CERT-In rated Log4Shell (2021) critical. It warned that the flaw was being actively exploited and could give attackers full control of a system [2].
• Patch gap: Disclosure tells attackers where to look, so unpatched sites become easy targets. Patching also does not remove an intruder who is already inside [1].

The other side

• The PHP flaws were found, disclosed and fixed by the maintainers themselves [1]. The real weakness is under-funded upkeep and slow patching, not openness.

Gaps in India's framework

• In 2025, CERT-In handled over 29.44 lakh incidents and issued 1,530 alerts and 390 vulnerability notes [3]. Small site owners cannot follow that volume.
• The 2022 CERT-In Directions require incidents to be reported within 6 hours [4]. They set no deadline for fixing known flaws.

Institutional response for India

• CERT-In outreach: plain-language action alerts, sent out through hosting firms and MSME bodies.
• Patch-time norms: extend the Section 70B Directions [4] to set fix deadlines for critical flaws in government systems.
• Software inventories: require departments to list the components their portals run on.
• Accountability: treat ignoring a public patch as a failure of "reasonable security safeguards" under Section 8(5), DPDP Act 2023, which carries a penalty of up to ₹250 crore [5].
• Commons funding: a public fund to audit the open-source components used in Digital Public Infrastructure.

Open-source software is shared infrastructure, so its risk is shared too. India should not abandon it. Instead it should fund its upkeep, enforce timely patching and make sure warnings reach the smallest site owner. This would protect the privacy right upheld in Puttaswamy (2017) and help build a safe, trusted internet.