PHP security scare puts Sri Lanka’s digital systems under scrutiny

What it is

Lanka Business Online's 2 November 2026 report on CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws that allow remote code execution without credentials. The page gives response guidance from Sophos, the UK National Cyber Security Centre (NCSC) and Sri Lanka CERT. It does not give affected or fixed version numbers, or the mechanism of either flaw.

Preconditions / Affected

• Any server running PHP is in scope. Don Smith of Sophos' Counter Threat Unit says PHP can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without the operator knowing.
• Systems on versions no longer receiving standard security updates are the hardest case. Of 80 state-linked Sri Lankan sites found on potentially vulnerable versions between 22 and 24 October 2026, 61 were on unsupported software.
• Older applications may not take a patch easily. Some depend on outdated software or on third-party developers.

What to do

• Inventory every PHP installation, including those embedded in products and hosting environments. Sophos names this as the main challenge, ahead of installing the patch.
• Prioritise internet-facing systems and update them to supported versions. This is the NCSC's advice. Security updates were released on 21 October 2026.
• Monitor PHP and web-server processes for unusual processes, command execution or other signs of a foothold. Smith expects attackers to target these flaws quickly, and says AI helps them move fast.
• Review system logs and investigate suspicious activity, even on patched hosts. International authorities note that a patch does not show whether a system was compromised before the update.

Caveats

• Running PHP does not mean a site is compromised. The 80-site figure counts "potentially vulnerable" versions, and the page does not say how that was determined.
• Sri Lanka CERT issued its advisory on 21 October 2026. The Ministry of Digital Economy circular tells public institutions to identify affected systems and take corrective measures, but the page gives no deadline.
• Smith's forecast of rapid attacker interest is an opinion. The page cites no confirmed exploitation.