The Ministry of Digital Economy has taken note of the discovery of critical security vulnerabilities in the PHP programming language a tool widely used for developing websites and web applications for state institutions. It is reported that all state institutions have been instructed to address this matter immediately and implement remedial measures.
This warning was issued via a circular signed by Ministry Secretary Varuna Sri Dhanapala to the heads of all ministries, provincial councils, departments, statutory boards, and state-owned enterprises. The relevant circular points out that these serious security vulnerabilities identified by the codes CVE-2026-109618 and CVE-2026-109619 pose a severe risk of unauthorized access to government web systems, the theft of sensitive state data, and the disruption of system operations.
Taking these precautionary security measures has become essential, given the recent surge in various cyberattacks and data leaks targeting public sector websites. The Ministry Secretary has issued instructions to implement several measures, effective immediately, to promptly mitigate these risks.