Sri Lanka urges government agencies to patch critical PHP security flaws

The Ministry of Digital Economy has instructed government agencies to take immediate remedial action against critical security vulnerabilities discovered in PHP, the widely-used programming language powering websites and web applications throughout Sri Lanka's public sector, according to a statement from Sri Lanka CERT.

A circular issued by the Ministry on 23 October identified two high-severity vulnerabilities designated as CVE-2026-109618 and CVE-2026-109619. These flaws present substantial security risks to government institutions reliant on PHP-based systems for digital services and internal operations.

The directive emphasizes the urgency of patching affected systems to prevent potential exploitation by malicious actors. Government agencies have been advised to conduct immediate audits of their web infrastructure and apply available security updates to eliminate the identified vulnerabilities.

PHP remains one of the most prevalent programming languages used in web development globally. The identified vulnerabilities underscore the importance of maintaining vigilant cybersecurity protocols across government digital infrastructure in Sri Lanka, particularly as the country continues to digitize public services.

Photo: PHP source code open in a code editor, May 2020. Yuri Samoilov via Wikimedia Commons (CC BY 2.0).