Organizations and website developers using PHP should check their systems and apply security updates immediately, Sri Lanka CERT has warned.
The cybersecurity alert covers two critical vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
Sri Lanka CERT said these vulnerabilities could allow attackers to gain unauthorized access to systems. They could also lead to data theft and service disruption.
The warning covers public and private sector organizations. It also applies to developers who manage websites and web applications that use PHP.
Organizations should check their PHP systems now
Sri Lanka CERT has asked organizations and developers to identify all systems and web applications that run PHP.
They should then check the PHP version used by each system. After that, they should apply the relevant security patches.
Organizations should follow the update instructions available on the official PHP website.
Sri Lanka CERT has urged organizations to take these steps without delay. This is especially important for systems that connect to the internet.
Organizations should also check their system logs for unusual activity.
These checks can help identify signs of unauthorized access or other suspicious activity. They can also help organizations find possible security problems that may already have affected their systems.
What should organizations do if they cannot update a system?
Some critical systems may not allow an immediate software update.
In such cases, Sri Lanka CERT recommends restricting internet access to critical and high-risk systems until organizations can apply the required patches.
This step can reduce the chance of attackers reaching vulnerable systems while organizations work on the updates.
Organizations should also review which systems have access to sensitive information. They should give priority to systems that connect to the internet or support important services.
The alert also highlights the need for organizations to keep track of the PHP versions used across their systems. Developers and IT teams should not assume that all websites use the same version.
A system may also run an older PHP version without the organization being aware of it. Checking each system can help identify software that needs attention.
The next step is immediate action
Sri Lanka CERT is urging organizations, developers and system administrators to act on the alert without delay.
They should first identify their PHP-based systems and web applications. They should then check the software versions and apply the relevant security patches.
Organizations should also review their system logs for unusual activity. If they cannot update a high-risk system immediately, they should restrict its internet access.
Taking these steps can help reduce the risk of unauthorized access, data theft and service disruption.
Organizations using PHP should therefore check, update and review their systems now, rather than waiting for a security incident to occur.
AI & Technology Online Scam Public Notice
Last modified: October 22, 2026
