Sri Lanka CERT Warns Organisations to Lock Down Internet Access on Systems Running Vulnerable PHP Software

Sri Lanka's national cybersecurity authority has issued an urgent advisory calling on both public and private sector organisations, as well as web developers across the country, to take immediate steps to address critical security vulnerabilities discovered in PHP — one of the most widely used programming languages for building websites and web applications.

What Is the Threat?

The Computer Emergency Readiness Team of Sri Lanka, commonly known as Sri Lanka CERT, has identified significant security flaws within PHP software that could potentially expose vulnerable systems to malicious actors. PHP powers a vast number of websites and online platforms, meaning the scope of organisations at risk is considerable.

In its official advisory, CERT has specifically urged organisations to restrict internet access to any critical or high-risk systems that are unable to be updated or patched at this time. This precautionary measure is intended to limit the attack surface available to cybercriminals who may seek to exploit the identified vulnerabilities.

Who Is Affected?

The advisory is directed at a broad range of stakeholders, including:

• Government ministries and public sector institutions operating web-based systems
• Private sector companies whose digital infrastructure relies on PHP-based platforms
• Independent website developers and software development firms

What Organisations Are Being Asked to Do

CERT is urging all affected parties to prioritise patching and updating their PHP installations to the latest secure versions wherever possible. For systems that cannot immediately receive updates — due to compatibility issues, legacy infrastructure, or operational constraints — the recommendation is to isolate those systems from public internet access until remediation can be carried out.

Organisations managing critical digital infrastructure are encouraged to treat this advisory with the highest level of urgency and act swiftly to protect sensitive data and services.

Why This Matters for Sri Lanka

As Sri Lanka continues to advance its digital economy and e-government services, cybersecurity threats targeting widely used platforms such as PHP represent a growing concern. A successful exploit of these vulnerabilities could result in data breaches, service disruptions, or unauthorised access to sensitive government and corporate systems.

Sri Lanka CERT has encouraged all organisations to remain vigilant, monitor their systems closely, and report any suspicious activity to the relevant authorities without delay.