Sri Lanka’s Computer Emergency Response Team has issued a critical alert over security flaws in PHP, the programming language behind a large share of the country’s websites, as organisations in several countries take their own sites offline rather than run them unpatched.
CERT told public and private sector organisations and website developers that the vulnerabilities could expose affected systems to unauthorised access, data theft and disruption of operations, the Daily Mirror reported on Thursday afternoon.
Its instructions are specific: identify every system running PHP, check which version is in use, and install the relevant security updates promptly, following the guidance published on the official PHP website. Newswire adds two further recommendations absent from the Daily Mirror’s account — review system logs for unusual activity, and restrict internet access to critical, high-risk systems that cannot be updated immediately.
The local alert is one arm of a global scramble
The Sri Lankan advisory reads as routine housekeeping. The international picture around it is not.
NewsFirst reported at 11.37 a.m. that governments and agencies worldwide have urged websites to address two critical flaws in PHP, with a fix issued on Wednesday afternoon. Agencies have told organisations that cannot patch in time to consider taking their sites down altogether.
Several have done exactly that. Finland has temporarily shut down its government’s public web services, and the Netherlands’ cyber-security agency took its own website offline. Edinburgh council and the BBC have pulled pages. Hiru News carried the same account in Sinhala at 12.14 p.m., reporting that institutions across many countries had temporarily disabled their sites.
The flaws were found by AI. The cyber-security firm Wiz described them as the “most severe vulnerabilities ever discovered” by the technology.
Why the exposure here is wide
PHP underpins a large proportion of Sri Lankan government, media and small-business websites, including most WordPress installations. An organisation that does not know which of its systems run PHP cannot act on CERT’s advice at all — which is why the first instruction is an inventory rather than a patch.
Not reported
The Sri Lankan filings give no CVE identifiers, no severity score and no affected version numbers, so a local administrator cannot tell from them which PHP releases are at risk or whether their own is among them. None sets a deadline.
No filing reports any Sri Lankan government, bank or utility website taken offline as a precaution, and CERT has not said whether any local system has been compromised, or whether it has contacted specific agencies directly.
