By Roy Denish
Sri Lanka PHP security vulnerabilities have prompted government action after critical flaws threatened websites and public-sector applications.
COLOMBO – Sri Lanka’s ambitious digital transformation programme is confronting a major cybersecurity challenge following the discovery of critical vulnerabilities in PHP, the widely used server-side programming language supporting government websites, commercial platforms and online public services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry severity ratings of 9.2 out of 10 under the Common Vulnerability Scoring System.
Cybersecurity authorities have warned that attackers exploiting vulnerable systems may be able to execute malicious code remotely without first obtaining legitimate access credentials.
The potential consequences include unauthorised access to sensitive information, website manipulation, disruption of public services and further compromise of connected infrastructure.
Government Issues Security Instructions
A significant development was reported on 25 October 2026 when Newsfirst disclosed that the Government had issued a circular addressing the PHP vulnerabilities affecting state websites and applications.
The report indicated that more than 70% of websites and web applications operated by state institutions in Sri Lanka had been developed using PHP.
This figure highlights the potential scale of the challenge, although the use of PHP does not automatically establish that a particular website remains vulnerable.
The actual exposure depends on the PHP version, server configuration, installed security updates and other technical safeguards.
The Government’s response follows warnings issued by Sri Lanka CERT and international cybersecurity agencies.
Sri Lanka CERT Issues Critical Alert
On 21 October, Sri Lanka CERT published a critical security advisory identifying the two vulnerabilities and recommending urgent action by organisations operating PHP-based systems.
The advisory urged administrators to identify affected installations, monitor official security announcements, update vulnerable software and investigate possible evidence of compromise.
It also recommended restricting access to systems where immediate remediation was not possible.
The warning applied not only to conventional websites but also to applications and software products incorporating PHP within their operational environments.
Emergency Security Patches Released
The PHP development team released security updates on 21 October following the disclosure of the vulnerabilities.
International cybersecurity organisations, including the European Union Agency for Cybersecurity and national computer emergency response teams, urged organisations to install the fixes immediately.
At the time of the initial emergency response, patched releases included PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Further security developments subsequently emerged.
On 23 October, European cybersecurity authorities reported the disclosure of an additional PHP remote code execution vulnerability, identified as CVE-2026-115560.
This development reinforced the importance of checking current vendor advisories rather than assuming that an earlier update had permanently resolved every relevant exposure.
International Websites Temporarily Taken Offline
The vulnerabilities triggered a significant international response.
Government websites and other online services in parts of Europe were temporarily taken offline while administrators assessed their exposure and deployed security updates.
The incidents demonstrated how weaknesses in widely used software can affect institutions across multiple countries simultaneously.
Cybersecurity researchers also reported observing attempted exploitation of the vulnerabilities.
The threat therefore extends beyond a theoretical weakness in software.
Sri Lanka’s Digital Ambitions Under Scrutiny
Sri Lanka has made digital transformation a central element of its programme to modernise public administration and improve service delivery.
The expansion of online government platforms, electronic documentation, financial services and integrated databases has increased the importance of effective cybersecurity controls.
A compromised public-sector system could potentially expose personal information, interrupt services or undermine public confidence.
However, there is presently no independently verified evidence establishing that the newly disclosed PHP vulnerabilities have resulted in a successful compromise of a specific Sri Lankan government website.
The Challenge of Ageing Government Systems
The latest warning also highlights longstanding concerns surrounding outdated software, insufficient security maintenance and inadequate cybersecurity resources.
Earlier incidents involving Sri Lankan public institutions have demonstrated the financial consequences that can arise when legacy systems remain operational without appropriate updates.
A sustainable digital transformation programme therefore requires more than developing new platforms.
It demands continuous security monitoring, comprehensive software inventories, vulnerability assessments, patch management, incident-response capabilities and clearly assigned institutional responsibility.
Questions Remain Over Compliance
The Government’s reported circular represents an important response to the immediate threat.
Nevertheless, several critical questions remain unanswered.
Authorities have not publicly provided a comprehensive breakdown of how many government systems were affected, how many have been patched and whether any compromise has been detected.
Without such information, the effectiveness of the remediation programme cannot be independently assessed.
The vulnerabilities have created a practical test of Sri Lanka’s ability to protect its expanding digital infrastructure.
The outcome will depend not merely on the issuance of official instructions, but on whether government institutions implement and verify the necessary security measures.
Sources
- Sri Lanka CERT — Critical PHP Security Alert, 21 October 2026
- Newsfirst — Government Issues Circular to Address PHP Vulnerabilities, 25 October 2026
- European Union Agency for Cybersecurity — Joint Statement on Critical PHP Vulnerabilities
- CERT-EU — Security Advisory 2026-018
- Google Cloud — Responding to Critical PHP Vulnerabilities
- Palo Alto Networks Unit 42 — Technical Threat Brief
