Govt. silent on measures to protect state infrastructure from critical software flaws

Sri Lankan authorities are facing growing scrutiny after failing to detail measures taken to secure public infrastructure against two high-severity global software vulnerabilities.

The silence from the Ministry of Digital Economy comes as cybersecurity agencies across Europe, North America, and Asia order immediate system updates or full offline suspensions to prevent remote server takeovers.

Global emergency triggers mass offline suspensions

International intelligence agencies and heads of state from Washington to Tokyo have issued emergency advisories regarding the two defects in the PHP programming language.

Rated at a critical severity level of 9.2 out of 10, the technical flaws allow unauthorised threat actors to gain full administrative control of web servers without requiring access credentials.

Governments in Europe temporarily deactivated state portals on Wednesday, while cloud infrastructure providers in Japan suspended selected services to prevent potential breaches.

The flaws had remained hidden within the code for years before being identified through artificial intelligence tools, prompting China and South Korea to elevate national cyber readiness levels.

Statutory limitations hamper local response

Sri Lanka's national cyber security body issued an urgent directive instructing both public and private entities to apply official vendor patches immediately or disconnect vulnerable systems.

However, the agency operates as a registered company under corporate law and possesses no statutory powers to enforce compliance or pull compromised websites offline.

Industry experts note that the lack of regulatory enforcement authority exposes critical sectors to heightened risk, particularly following past security failures where outdated state IT systems led to multi-million dollar financial diversions.

Calls have intensified for the Central Bank to intervene by mandating commercial banking institutions to verify the security status of their PHP-reliant customer portals and payment gateways.

Regulatory delay heightens infrastructure vulnerabilities

The ongoing crisis has renewed focus on the delayed legislative framework intended to establish an independent cyber security regulator with legally binding enforcement powers.

Although ministerial officials had signaled that the enabling legislation would be gazetted within weeks, the statutory mechanism required to compel state agencies to act remains unpassed.

With foreign threat actors actively scanning for unpatched servers, analysts warn that failure to act could disrupt online payment systems and public services across the country.

The Ministry of Digital Economy has yet to confirm how many public sector websites have successfully applied the security updates.