A researcher has told Prime Minister Dr Harini Amarasuriya and Opposition Leader Sajith Premadasa that 80 websites run by the Sri Lankan state, or by state-owned utilities and companies, use PHP software that needs urgent fixing.
In an open letter, the researcher said 61 of the 80 sites, more than three quarters, run versions so old that their makers no longer support them. Those sites cannot be made safe with an update, the researcher said. The 80 sites include ministries, provincial bodies, municipal councils and the health sector.
The researcher said only sites that publicly show their software version could be counted, so 80 is a minimum figure. A site that hides its version, the researcher said, tells outsiders nothing about whether it has been patched.
Several of the systems are working applications rather than public information pages, the researcher said. They include health sector staff systems, a portal where doctors log in with their National Identity Card numbers, and systems linked to the identity registry. The researcher also named websites in sectors such as electricity, ports, telecommunications, transport, disaster management and defence, and said it was unclear whether they connect to systems behind them.
The researcher asked the Prime Minister to direct every affected institution to install the fix or switch on temporary protections within 48 hours, and to take a site offline if it can do neither. Within a week, the researcher said, each institution should check whether it has already been compromised, and Sri Lanka CERT should publish which institutions it has notified and their progress. Sites on retired software should move to a supported version or close within three months, the researcher said.
Background
PHP is software used to build web pages and is run on a large share of the world’s websites. The researcher said that on 21 October its developers disclosed two severe defects, since nicknamed PHP2Shell, that could let an outsider take control of the computer behind a website without a password.
The researcher said the United States National Security Agency told organisations that cannot fix their systems to take them offline, and that the South African Presidency, the Finnish government and the UK government did so after attempts to exploit the flaws began.
In Sri Lanka, the Ministry of Digital Economy issued circular MODE/2026/03, signed by Ministry Secretary Waruna Sri Dhanapala, to state institutions. It refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and tells institutions to identify systems that use PHP, check their software versions and install security updates immediately. It also tells them to examine system logs for suspicious activity and restrict internet access to high-risk systems that cannot be updated. GovTech Sri Lanka has built a detection tool at www.govtech.lk/cvesecure, and institutions have been advised to seek help from Sri Lanka CERT.
The researcher said Sri Lanka CERT issued a general advisory on 21 October that named no institution, and that no public evidence exists that anyone has since checked which state websites are affected. The researcher recalled the August 2023 ransomware attack on the Lanka Government Cloud, which destroyed three months of email across an estimated 5,000 government accounts after an upgrade from obsolete software had been delayed since 2021.
What it means
Many state websites hold or link to personal information about citizens and public servants. The Personal Data Protection Act places a duty on public authorities to keep personal data secure, as the researcher noted when raising the health and identity systems.
For members of the public, the circular does not change how government services are used, but any state portal that asks for a National Identity Card number or other personal details is among the systems institutions have been told to check. Readers who use such portals can look for notices from the institution concerned and report problems to Sri Lanka CERT.
The researcher said a compromised official website could also be used to spread false information, which is why the researcher called for the affected sites to be fixed or taken offline quickly.
