PHP security scare puts Sri Lanka’s digital systems under scrutiny

A global security alert involving two critical vulnerabilities in the widely used PHP programming language has prompted urgent action in Sri Lanka, with government institutions instructed to check their websites and applications for possible exposure.

The concern is particularly significant for Sri Lanka, where more than 70% of state institution websites and web applications reportedly use PHP. The Ministry of Digital Economy has issued a circular directing public institutions to identify affected systems and take corrective measures to prevent possible cyberattacks.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to remotely execute malicious code on affected servers without requiring login credentials. In practical terms, a successful attack could give an intruder access to information, allow changes to website content or disrupt services.

Sri Lanka CERT issued an advisory on 21 October, warning organisations operating PHP-based websites, applications and hosting environments to assess their exposure and prepare for security updates. The alert comes at a time when Sri Lanka is placing greater reliance on digital services, from government portals to online banking, business transactions and customer-facing applications.

The immediate question is how many systems remain vulnerable and how quickly they can be secured.

Reports published over the weekend indicated that several government websites were operating on outdated PHP versions. Research conducted between 22 and 24 October reportedly identified 80 state-linked websites running potentially vulnerable versions, including 61 using software no longer supported through standard security updates.

Although running PHP does not automatically mean a website has been compromised, the findings raise concerns about how frequently public institutions review and update their software. For older applications, applying a security patch may not always be straightforward.

Some systems depend on outdated software or third-party developers, making upgrades more complicated than installing a routine update.

Global cybersecurity company Sophos has cautioned that this lack of visibility could complicate the response. Don Smith, VP Threat Intelligence, Sophos Counter Threat Unit, said, “The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running. The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third- party products, sometimes without even being obvious to the organisation using it.

“Threat actors move fast, especially with the help of AI and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold.”

Security updates addressing the two vulnerabilities were released on 21 October. The UK’s National Cyber Security Centre has urged organisations to identify all PHP installations, prioritise internet-facing systems and update them to supported versions.

International authorities have also cautioned that installing a patch does not necessarily establish whether a system was compromised before the update. Organisations have therefore been advised to examine system logs and investigate suspicious activity.

The latest developments have brought renewed attention to the condition of Sri Lanka’s existing digital infrastructure. While considerable attention has been given to introducing new digital services, maintaining older platforms remains equally important. Websites developed several years ago may continue operating without regular security reviews, particularly where institutions have limited technical resources or depend on external service providers.

The vulnerabilities also come as Sri Lanka seeks to expand digital payments, improve online public services and attract investment into its technology sector. These ambitions depend on the reliability of the systems supporting them. Even a temporary disruption to an essential online service can affect customers, businesses and institutions that rely on it.