Sri Lanka CERT has warned of critical security vulnerabilities in PHP-based systems that could expose organisations to unauthorised access, data theft and service disruptions.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have prompted a call for public and private sector organisations and website developers to check their PHP systems and install relevant security patches.

Organisations have also been advised to review system logs for suspicious activity and restrict internet access to high-risk systems that cannot be updated immediately.