• SLCERT warns but cannot enforce
• Expert says attack could come ‘next week’

The Sri Lankan Government has yet to say how it is shielding state systems from two critical flaws in PHP, the programming language behind roughly seven in 10 of the world’s websites, even as Governments from Tokyo to Washington demanded urgent fixes and told organisations to pull unpatched sites offline.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 in severity, allow attackers to seize a web server remotely without a password. Government websites across Europe went dark on Wednesday (21) as operators raced to patch.

“This could be maybe next month or next week, because we are seeing the bad guys do their exploits already,” cybersecurity and digital policy expert Asela Waidyalankara told The Daily Morning Business yesterday (22). “If you are using PHP as a programming language in your systems, you are considered compromised.”

The Ministry of Digital Economy had not responded to queries from The Daily Morning Business on how many state agencies have been patched, as at press time.

Warning without teeth

The Sri Lanka Computer Emergency Readiness Team (SLCERT) issued a critical alert urging public and private institutions to identify every system running PHP and install the security updates without delay, warning of unauthorised access, data theft and disruption. Like its counterparts abroad, it is urging those unable to patch immediately to take their websites offline.

That is as far as its power goes. SLCERT has no statutory authority to compel an organisation or its hosting provider to take a website down, nor the technical authority to pull one down itself. It operates as a company under the Companies Act, and its Acting Chief Executive Officer has conceded that it lacks a legal mandate to enforce its directives.

“CERT can’t compel organisations to do it,” Waidyalankara said, noting that the agency was contacting state agencies to press and help them to patch. “But is that enough?” The long-delayed Cyber Security Bill, which would create a regulator with enforcement powers, is meant to close that gap. 

In August, Digital Economy Ministry Secretary Waruna Sri Dhanapala said a gazette was expected within a month. Waidyalankara called for the bill to be brought in “as soon as possible, provided of course the concerns that we have are addressed”.

The Treasury lesson

The cost of leaving known weaknesses unattended is already on the record. Hackers who breached the Treasury’s email system in December 2025 diverted nearly $ 2.5 million meant for an Australian creditor, and SLCERT later told Parliament’s Committee on Public Finance that the system had been outdated since 2019.

“These may sound technical, but a lot of our infrastructure, payments and other activities rely on these programming languages. From a policy point of view, you must take it as a critical situation,” Waidyalankara said, adding that policymakers had shown little grasp of the threat, which had yet to be raised in Parliament.

Banks in the frame

He called on the Central Bank of Sri Lanka (CBSL) to direct commercial banks, which he said run many payment and customer systems on PHP, to confirm that they have been patched. “Should the Central Bank send an alert to at least the commercial banks asking, ‘Have you done this patching as a matter of urgency?’ These are the kind of policy levers that you can use,” he said.

Global scramble

Japanese Prime Minister Sanae Takaichi personally urged users to patch and advised suspending website functions where prompt patching was not possible, while cloud provider Sakura Internet suspended some of its services. The US National Security Agency and the Federal Bureau of Investigation told organisations to take systems offline if they could not update at once, a call echoed by cybersecurity agencies in the UK, Canada, Australia and the European Union.

China’s Industry Ministry urged organisations to upgrade immediately and change passwords and keys, and South Korea raised its private sector cybersecurity alert level and activated emergency response measures. The flaws had lain undetected in PHP for years before being uncovered with the help of artificial intelligence.