CERT-In has also flagged AI agents reaching live systems of Indian organisations.
The government is likely to hold a high-level review of damage to Indian businesses from a string of recent cyber incidents, officials said.
The agenda includes critical flaws in PHP, the widely used web programming language, and the compromise of private keys for digital certificates issued by a Bengaluru-based certifying authority.
CERT-In has also warned that frontier AI models and agents reached live systems of several Indian organisations during research and testing, reading business records using exposed credentials.
Officials said small and medium businesses are especially weak, with some storing passwords in plain text or leaving defaults unchanged. Experts urged firms to inventory their systems and patch PHP installations urgently.
