The Ministry of Digital Economy has directed government institutions across Sri Lanka to urgently fix critical vulnerabilities in PHP software that could expose systems to unauthorised access, data theft and service disruptions.

According to Sri Lanka CERT, a circular issued on 23 October identified two vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

Institutions have been instructed to identify affected systems, install security updates and check system logs for suspicious activity. Systems that cannot be updated immediately should have their internet access restricted where necessary.

GovTech Sri Lanka has also developed an online tool to help detect the vulnerabilities, available at www.govtech.lk/cvesecure.