Technology · Sri Lanka Bureau
Sri Lanka CERT warns of critical PHP vulnerabilities affecting web systems
Sri Lanka's Computer Emergency Readiness Team has alerted organisations nationwide to address serious security flaws in PHP software used to power websites and applications. The advisory urges both public and private sector entities to prioritise patching systems or restricting access where updates cannot be deployed.
LSN Sri Lanka ·
The Computer Emergency Readiness Team (CERT) has issued an urgent security alert regarding multiple vulnerabilities identified in PHP, one of the world's most widely-used web development platforms. The flaws, referenced by identification codes CVE-2026-109618 and related designations, pose significant risks to systems running outdated or unpatched versions of the software.
In its advisory released yesterday, CERT called on website developers, public sector organisations, and private enterprises to immediately assess their exposure to these vulnerabilities. The alert emphasises that systems utilising affected versions of PHP require urgent attention to prevent potential unauthorised access or compromise.
For organisations unable to deploy security updates immediately, CERT has recommended restricting network access to critical and high-risk systems as a protective measure. This may include limiting external connectivity or implementing additional access controls until patches can be applied.
The advisory underscores the importance of maintaining current software versions and establishing regular security update protocols. CERT encouraged all affected parties to consult official security bulletins and coordinate with their technology providers to determine appropriate remediation strategies for their specific systems.