Sri Lanka CERT warns of critical security vulnerabilities in PHP systems
Sri Lanka CERT has urged public and private sector organisations and website developers to take immediate action to address critical security vulnerabilities identified in systems developed using PHP. SL CERT warned that the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could expose systems to unauthorised access, data theft and disruption of services. The agency called on…
Sri Lanka's Computer Emergency Response Team (CERT) has issued a warning about critical security vulnerabilities in systems built using PHP. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow unauthorized access, data theft, and service disruptions. The CERT agency has urged all organizations, both public and private, to identify and verify the PHP versions currently in use on their systems.
It is recommended that system administrators and developers promptly apply the necessary security patches, following the official procedures outlined by the PHP website. Users are advised to adhere to the update instructions provided by PHP when installing these patches. Organizations should also monitor system logs for any unusual or suspicious activity that might suggest attempts to exploit these vulnerabilities.
As a precaution, it is suggested that access to critical or high-risk systems be restricted if they cannot be updated immediately. The CERT emphasizes the importance of taking swift action to minimize the risk posed by these vulnerabilities and safeguard systems and data from potential attacks.
Written by urgent.news from The Island Sri Lanka's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
