Sri Lanka CERT has issued a cybersecurity alert warning of critical security vulnerabilities in PHP-based systems, urging public and private sector organizations and website developers to take immediate action to protect their systems.
In a statement, Sri Lanka CERT said the vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 pose risks of unauthorized system access, data theft and disruption of services.
The organization has called on relevant institutions and developers to identify all systems and web applications running PHP and verify their software versions.
Affected systems should be updated promptly by applying the relevant security patches, following the instructions provided on the official PHP website, www.php.net, Sri Lanka CERT said.
Organizations have also been advised to examine system logs for unusual activity that could indicate potential security breaches.
Sri Lanka CERT further recommended restricting internet access to critical, high-risk systems that cannot be updated immediately.
The alert emphasizes the need for organizations to address the reported vulnerabilities without delay to minimize potential cybersecurity risks and safeguard their systems and data.
