The Ministry of Digital Economy has taken note of the discovery of several critical security vulnerabilities within the PHP programming language a tool widely used for the development of websites and web applications for government institutions. It is reported that all government institutions have been instructed to address this matter immediately and implement necessary remedial measures. This warning has been issued via a circular signed by Ministry Secretary Varuna Sri Dhanapala to the heads of all ministries, provincial councils, departments, statutory boards, and state-owned enterprises.
The circular highlights that serious security vulnerabilities, identified by the codes CVE-2026-109618 and CVE-2026-109619, pose a significant risk. These vulnerabilities could facilitate unauthorized access to government web systems, the theft of sensitive state data, and the disruption of system operations.
Taking these precautionary measures has become essential in light of recent cyberattacks and data leaks targeting public sector websites. The Ministry Secretary has issued instructions to implement several measures, effective immediately, to promptly mitigate these risks. 'GovTech Sri Lanka' an initiative operating under the Ministry of Digital Economy has developed a vulnerability detector, accessible via 'www.govtech.lk/cvesecure', to check for such security weaknesses in relevant websites. Furthermore, heads of government institutions have been instructed to ensure that the technical personnel responsible for these websites are given the opportunity to contact the Sri Lanka Computer Emergency Response Team (Sri Lanka CERT) should they require technical assistance.