On 21 October, the developers of PHP – the engine behind around 70% of the world’s websites – disclosed 2 severe flaws, since nicknamed PHP2Shell, that could let a stranger with no password take control of the computer behind a website. The US National Security Agency then told organisations unable to fix their systems to take them offline, and the South African Presidency, the Finnish Government and the UK Government did exactly that within hours, if not days. Sri Lankans got a general advisory from SL-CERT the same day, naming no institution. Not a single site was taken offline.
Over next 3 days that followed I checked around 640 live gov.lk sites I could discover. I was searching for critical PHP vulnerabilities, but came back with a far more disturbing picture of, and appreciation for the incredible fragility of our public digital, and critical national infrastructure.
80 vulnerable sites, and likely much more
At least 80 websites run by the state, or by the utilities and companies it owns, run vulnerable versions of PHP, and 61 of them run versions so old that the makers stopped fixing them years ago, which means they carry every flaw discovered since and have no official repair available. This isn’t a complete number since for a lot of technical reasons, including by measures established to thwart potential hackers, it’s often impossible to determine specific vulnerabilities that exist within websites as an outsider. Accordingly, I could only count sites that announced their software version.
The list reads like an organisational chart of the state, running from the Ceylon Electricity Board and the Disaster Management Centre, both on a version released in June 2013, through LECO, the Sri Lanka Ports Authority, SLT Mobitel, the Telecommunications Regulatory Commission, the National Transport Commission, the Sri Lanka Air Force and the Department for Registration of Persons, which holds the national identity card registry, to the Ministries of Health, Mass Media and Justice, a Prime Minister’s Office system, the Bribery Commission, the Department of Government Information, the National Police Commission, 8 of the 9 provinces, 3 municipal councils and several Pradeshiya Sabhas. These are not random or peripheral sites.
Worse still, the Ministry of Health’s human resources systems, which handle transfers, post-intern appointments and appeals for health workers, run on a version released in July 2010, while a ministry portal asks doctors to log in with their national identity card numbers, and the Bribery Commission takes complaints from the public, so NIC numbers, employment records and the details of those who report corruption all sit behind architectures no one has updated or maintained in years.
It truly beggars belief.
The rot beyond PHP
Updating PHP won’t fix what ails many official websites. 9 state sites, including the CEB and the Air Force, publish diagnostic pages that display their entire server configuration to anyone who looks, and the login pages of database administration tools, which are by definition doors to databases, are reachable on the Sri Lanka Police, Ministry of Defence, Disaster Management Centre and LECO sites, with LECO’s dating from 2017. The Railway Department, the Auditor General’s Department and the Director General of Merchant Shipping share a server whose public status page leaks the address of a machine inside the Government network, while a Pradeshiya Sabha site briefly exposed the kind of file that typically holds passwords and keys. The Auditor General’s Department, whose job is to hold the rest of the state to account, is amongst them.
Other countries try their best to secure this sensitive information by layer upon layer of safeguards, including regular updates to the underlying code. The situation in Sri Lanka is vastly different, and stolen data held to crypto-currency ransoms we simply can’t afford to pay may actually be the least of our worries. In a country with a long and recent history of disinformation driving offline violence, a compromised official website is the most credible vehicle for falsehood imaginable. A forged flood warning on the Disaster Management Centre’s site during a cyclone, or a false tariff notice on the CEB’s, would be believed precisely because of where it appeared. Nor do attackers usually stop at the website. Once they control it, they can use it as a way into the databases and internal Government networks that sit behind it.
Gmail, the Fuel Pass and a culture of convenience
The state of our servers are a symptom of absolutely rotten institutional cultures decades in the making. In March I wrote about the National Fuel Pass, whose rollout failed to recognise newly issued NIC numbers, sent one-time passwords after they had expired and showed second-hand vehicles under their previous owners, while for over 48 hours no ministry or development team said anything online, leaving Asela Waidyalankara, an independent cybersecurity expert, to field public complaints on Twitter/X, and act as a conduit to the authorities.
You couldn’t make it up.
Earlier this month, I went through the first 500 search results for gmail.com (the commercial Gmail domain) on official gov.lk domains. I found state bodies advertising consumer Gmail addresses for right-to-information requests, procurement, health appointments and child protection, with the Department of Census and Statistics directing confidential survey returns to district addresses, many of them Gmail, and the Registrar General’s website displaying an official address whose link opens a Gmail one.
Consumer Gmail accounts leave citizens’ identity, health and bank details dependent on whoever holds the password, with no institutional control over custody, retention or continuity when staff move on. All this, with the Personal Data Protection Act (PDPA) becoming fully operational on 1 January 2027. I have yet to hear the President, or Dr. Hans Wijayasuriya as Chief Presidential Adviser on Digital Economy, speak to any of it.
Photo-opportunities vs ground realities
The public are regularly shown photographs of meetings with the Indian High Commissioner, the UN system, the World Bank and other bilateral and multilateral partners about funding or supporting digitalisation, from the Sri Lanka Unique Digital Identity scheme to GovPay, whereas the rot in the foundations these platforms are being retrofitted onto, and the cultures that produced it, never feature. Nor does the fact that no single body is mandated to keep the state’s systems current, since SL-CERT can advise institutions but cannot compel them, as Deputy Minister of Digital Economy Eranga Weeraratne told Parliament in March 2025, and as late as May 2026 no law required institutions to report incidents to it.
Countries that have more successfully address this Gordian Knot of issues have established a dedicated institution, with a clear mandate for 5 years or more, with the people, processes and regulatory authority to build what was missing, and not just by issuing advisories. The expertise to help exists, including within the UN system, if the Government asks for it directly, and means it. It may be that the President, Deputy Minister Weeraratne, and Dr. Wijayasuriya somewhat grasp the problem. But the true state of even critical national infrastructure suggests they may under-appreciate how fundamentally flawed the foundations really are, including beyond Government.
Infrastructure this brittle can quickly turn any small, sustained shock into a major socio-economic, and political crisis – and we are sitting ducks.
Parliament’s blind spot
Earlier this month, I published a report on a study of 173 Hansards, from January 2025 to September 2026, focussing on digitalisation, and AI. MPs did discuss cybersecurity, and often in ways that bear out what I found last week. Ajith P. Perera pressed for cybersecurity legislation in drafting since 2019, Chathura Galappaththi urged a security framework and bug-bounty testing before any biometric data is collected, and Ravi Karunanayake sought a forensic audit after the October 2025 Lanka Government Cloud disruption, which the Deputy Minister attributed to a full disk on a platform with no centralised backup. The Deputy Minister later told the House that the 2023 ransomware attack permanently erased emails linked to around 5,000 Government addresses because institutions lacked offline backups, and in August 2026 the Leader of the Opposition cited weak passwords and missing multi-factor authentication behind the US$2.5 million lost during a debt repayment to Australia. The floor debate, though, was around fraud, deepfakes and online harms rather than the upkeep of the state’s own systems. MPs need to better understand ground realities – software unpatched for decades, exposed private data – as well as emergent developments, where AI makes finding, and exploiting vulnerabilities cheaper, faster, more automated, and available to anyone, anywhere. The resulting risks, threats, and harms to Sri Lanka will grow exponentially.
Foundations before facades
We are being promised skyscrapers built on quagmires.
The fixes are unglamorous, but urgent. They include, but aren’t limited to a complete inventory of state systems with a named official accountable for each, and a binding rule that institutions run only supported software. Every second more with foundations this fragile, and institutional cultures this frightful invites a collective national grief we can ill afford after 2022.