🚨 Critical Cyber Vulnerabilities Threaten Sri Lanka's Public Digital Infrastructure

An investigation into ~640 live government (.gov.lk) websites reveals severe, unpatched security vulnerabilities across critical national infrastructure, risking national security, public trust, and data privacy. Key Findings & Security Risks: • Widespread Software Flaws: At least 80 state, utility, and state-owned corporate websites run vulnerable versions of PHP (including exposure to the severe PHP2Shell flaw). • Outdated Systems: 61 sites run unsupported PHP versions phased out years ago. Examples include CEB and Disaster Management Centre (PHP released June 2013), and Ministry of Health HR systems (PHP released July 2010). • Sensitive Data Exposure: Vulnerable architectures impact high-risk systems holding NIC numbers, doctor logins, and corruption complaints (e.g., Bribery Commission, Department for Registration of Persons, Sri Lanka Police). • Server Misconfigurations: 9 state sites publicly display full server configurations, while database administration login pages remain publicly accessible (e.g., Ministry of Defence, LECO, Disaster Management Centre). Institutional & Structural Failures: • Use of Personal Email: Widespread reliance on commercial Gmail addresses by government entities for official services, including confidential Census and Statistics surveys and Right-to-Information requests. • Lack of Central Governance: SL-CERT can issue advisories but lacks legal mandate or authority to compel state bodies to secure or update systems. • Recent Incidents: Includes the October 2025 Lanka Government Cloud disruption (caused by a full disk without centralized backup) and a 2023 ransomware attack that permanently deleted emails across ~5,000 official accounts due to missing offline backups. National Impact: • Unpatched systems threaten national security and increase exposure to data theft, ransomware, and disinformation campaigns via hijacked state portals prior to the Personal Data Protection Act becoming fully operational on 1 January 2027.