The Ministry of Digital Economy has issued a circular directing every state institution to address security vulnerabilities in websites and web applications built with the PHP programming language, NewsFirst reported on Sunday morning.
The circular has gone to ministry secretaries, provincial council chief secretaries, commission secretaries, department heads, and the heads of corporations, statutory bodies and state-owned enterprises — effectively the whole of the public sector’s senior administration.
The exposure figure is the significant disclosure
More than 70 per cent of state institution websites and web applications in Sri Lanka are built with PHP, the ministry says.
That is the first official estimate of the government’s exposure to this class of flaw, and it is the reason a circular was issued rather than an advisory. The ministry warns the vulnerabilities could expose systems to unauthorised access, data theft and operational disruptions, and the circular sets out measures institutions should take to reduce the risk.
This escalates a warning first issued three days ago
The circular is a distinct government action, not a restatement. On 22 October, Sri Lanka CERT issued a critical alert over the same PHP vulnerabilities as websites went dark in the UK, Japan and Europe — the flaw cluster reported internationally under the name PHP2Shell.
The difference between the two is a matter of instrument and reach. Sri Lanka CERT is the national computer emergency response team, and its alert was technical guidance addressed to organisations generally, public and private. A ministry circular addressed to secretaries and department heads is an administrative instruction within the state sector, which creates an expectation of compliance that an advisory does not.
The sequence — global outages, then a national CERT alert, then a formal circular to every state body three days later — is consistent with the government concluding that the advisory alone had not produced the remediation it wanted.
Not reported
The filing does not give the circular’s number or date, name the official who signed it, or set a deadline for compliance. It does not say what the prescribed measures are beyond the general categories, whether institutions must report back, or what follows if they do not act.
Crucially, it does not say whether any Sri Lankan state system has actually been compromised, or whether any government website went offline in the episode. It also does not identify the specific vulnerabilities by CVE reference or name the affected PHP versions, which is the information a system administrator would need in order to act on it.
No parallel account of the circular had appeared on the Daily Mirror or Hiru News at the time of writing.
