MONETABRIEF – Sri Lanka's state Cyber Security unit has issued a critical security alert for websites developed using PHP urging public and private organizations running the software to fix the vulnerabilities.
Sofware patches were available from www.php.net.
The full statement is reproduced below:
CYBER SECURITY ALERT : CRITICAL
Urgent attention is required regarding critical security vulnerabilities in systems developed using PHP.
Sri Lanka CERT requests public and private sector organizations, as well as website developers, to pay attention to security vulnerabilities identified in relation to the PHP software commonly used for developing websites and web applications.
Due to the security vulnerabilities referenced by the identification codes CVE-2026-109618 and CVE-2026-109619, there is a severe risk of unauthorized system access, data theft, and disruption of functionality.
Under such circumstances, Sri Lanka CERT urges the relevant parties to promptly take the following measures to minimize the risk.
• Identify all systems and web applications using PHP and verify their running versions.
• Immediately update systems and web applications in accordance with proper procedures using the software patches released for these security flaws. For this purpose, update instructions provided on the official PHP website (https://www.php.net) must be followed.
• Check system logs to monitor for any unusual activity.
• Restrict internet access to critical, high-risk systems that cannot be updated.
Sri Lanka CERT