Sri Lanka’s ambitious digitalisation drive faces a potentially serious security test as two critical vulnerabilities in PHP, a programming language powering a large proportion of the world’s websites, expose government institutions, financial systems and private businesses to remote cyberattacks.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have reportedly received a severity rating of 9.2 out of 10, raising concerns about the security of systems that depend on the widely used technology. Attackers could exploit the flaws to gain control of vulnerable web servers without requiring a password, creating risks extending far beyond website defacement to sensitive information, public services and digital transactions.
The immediate concern is not simply the existence of the vulnerabilities but whether Sri Lanka’s public institutions have acted quickly enough to address them. The Ministry of Digital Economy had not responded to questions about the number of State agencies that had installed the necessary security updates by press time .
That absence of an official response leaves an important question unanswered: how much of the Government’s digital infrastructure remains exposed?
Digital expansion, security uncertainty
Sri Lanka has positioned digital transformation as an important instrument for improving public administration, expanding electronic services, modernising financial transactions and reducing bureaucratic inefficiencies. However the benefits of this transformation depend on the reliability and security of the systems supporting it.
A compromised government server could expose personal information, interrupt essential services and undermine public confidence in online government platforms. If vulnerable technology is also embedded in payment systems and customer-facing applications, the consequences could extend into commercial transactions and the wider economy.
Cybersecurity and digital policy expert Asela Waidyalankara warned that exploitation was already taking place. He told The Daily Morning Business that organisations using PHP should treat the threat with extreme urgency rather than assume they have time to respond.
The Sri Lanka Computer Emergency Readiness Team (SLCERT) has issued a critical warning to public and private institutions, urging them to identify all systems running PHP and install security updates immediately. Organisations unable to patch their systems have been advised to take affected websites offline.
However, issuing a warning does not guarantee compliance.
SLCERT lacks statutory authority to compel organisations or hosting providers to shut down vulnerable websites. Nor can it independently disable those websites under its present mandate. Its role is consequently dependent on cooperation from institutions that may have inadequate technical capacity, weak internal controls or competing operational priorities.
This creates a fundamental weakness in Sri Lanka’s cybersecurity arrangements: the agency responsible for raising the alarm cannot necessarily ensure that the institutions receiving it act.
A digital economy needs enforceable safeguards
The long-delayed Cyber Security Bill is intended to establish a regulator with stronger enforcement powers. Its implementation could help close the gap between identifying a threat and compelling organisations to address it.
Nevertheless, legislation alone will not guarantee secure digital infrastructure. Effective protection also requires regular security audits, asset inventories, vulnerability testing, trained personnel, incident-reporting procedures and clearly assigned accountability within government agencies.
The Treasury email breach in December 2025 provides a sobering reminder of the financial consequences of inadequate protection. Hackers diverted nearly US$2.5 million intended for an Australian creditor, while SLCERT subsequently informed Parliament’s Committee on Public Finance that the compromised system had been outdated since 2019.
That episode demonstrated how neglected technical weaknesses can translate into direct losses of public money.
The latest PHP vulnerabilities should therefore be treated as a test of the Government’s capacity to deliver secure digitalisation, not merely another technical warning. Until the authorities establish which systems have been patched, which remain exposed and who is accountable for delays, confidence in the safety of Sri Lanka’s digital transformation will remain vulnerable.
The post Digitalisation at Risk as Critical Cyber Flaws Threaten Sri Lanka appeared first on LNW Lanka News Web.
