The Ministry of Digital Economy has directed government institutions across Sri Lanka to urgently address critical security vulnerabilities identified in PHP software, warning that the flaws could expose systems to unauthorised access, data theft and service disruptions.
According to a statement issued by Sri Lanka CERT, the Ministry issued a circular on October 23, 2026, identifying the vulnerabilities as CVE-2026-109618 and CVE-2026-109619 and calling for immediate corrective action.
The directive covers ministries, provincial councils, commissions, government departments, corporations, statutory bodies and government-owned companies.
Under the instructions, institutions must identify all PHP-based systems and web applications and verify the software versions currently in use. Affected systems must be updated promptly using the relevant security patches and following the official guidance available at www.php.net.
Institutions have also been instructed to review system logs for suspicious activity and investigate any unusual incidents. Systems that cannot be updated immediately should have their internet access restricted or be disconnected from the internet where necessary to minimise potential risks.
Meanwhile, GovTech Sri Lanka, which operates under the Ministry of Digital Economy, has developed a vulnerability detection tool to help identify PHP-related security weaknesses in websites.
The tool is available at www.govtech.lk/cvesecure, and technical personnel responsible for government websites have been encouraged to use it to check for potential vulnerabilities.
The Ministry has further instructed relevant officials to facilitate the use of the tool and coordinate with Sri Lanka CERT to obtain technical assistance where required.
Government institutions have been urged to treat the matter as a priority and implement the necessary security measures without delay to protect digital infrastructure, safeguard information assets and minimise the risk of cyber incidents., the Ministry of Digital Economy added.
