Sri Lanka CERT has requested public and private sector organisations, as well as website developers, to pay attention to security vulnerabilities identified in relation to the PHP software commonly used for developing websites and web applications.
The text of CERT statement issued yesterday: “Due to the security vulnerabilities referenced by the identification codes CVE-2026-109618 and CVE-2026-109619, there is a severe risk of unauthorised system access, data theft, and disruption of functionality.
Under such circumstances, Sri Lanka CERT urges the relevant parties to promptly take the following measures to minimise the risk.
= Identify all systems and web applications using PHP and verify their running versions.
= Immediately update systems and web applications in accordance with proper procedures using the software patches released for these security flaws. For this purpose, update instructions provided on the official PHP website (https://www.php.net) must be followed.
= Check system logs to monitor for any unusual activity.
= Restrict internet access to critical, high-risk systems that cannot be updated.”