Unpatched, and unsupported: Sri Lanka’s government websites after PHP2Shell

This morning I wrote to the Prime Minister, Dr Harini Amarasuriya, and the Leader of the Opposition, Sajith Premadasa, about 80 websites run by the Sri Lankan state, or by the utilities and companies it owns, that I found running software the world’s leading cybersecurity agencies have told every organization to fix immediately or take offline, spanning ministries, provinces, municipal councils, the health sector and, most worryingly, institutions that form part of the country’s critical national infrastructure. 61 of the 80 – over three quarters – run versions so old that the makers stopped fixing them years ago, which means the websites, and all their content were exposed to cybercriminals, and other unauthorized domestic, and foreign entities long before this week’s alarm, and remain exposed now with no official repair available. Sri Lanka’s digitalization foundations remain incredibly weak, and potentially severely compromised. The software generating headlines this week was PHP, an engine of sorts that assembles the pages visitors see on around 70% of the world’s websites. On 21 October its developers disclosed 2 severe defects, since nicknamed PHP2Shell, that could let a stranger on the internet, with no password, take control of the computer behind a website. The US National Security Agency told organizations unable to fix their systems to take them offline, and the South African Presidency, the Finnish government and the UK government did exactly that, since attempts to exploit the flaws began 4 days before they were made public and climbed to millions within a day.

Sites on supported versions can be made safe with an update, whereas sites on retired versions cannot, much as a carmaker eventually stops issuing recalls for a model it no longer builds, and some Sri Lankan state sites run versions abandoned more than a decade ago, so they carry every flaw found since, not just this week’s. I could only count sites that publicly reveal their software version, so 80 is a floor rather than a total, and a site that hides its version tells us nothing about whether it has been patched.

• Data, disinformation and critical infrastructure

Several of the exposed systems aren’t just front-facing sites but working applications holding information about citizens and public servants, including health sector staff systems, a portal where doctors log in with their national identity card numbers, and systems linked to the identity registry itself, which sits uneasily with the duty the Personal Data Protection Act places on public authorities to keep personal data secure. Given Sri Lanka’s long and recent history of false information driving offline harm, a compromised official website is also the most credible vehicle for disinformation imaginable, since a forged flood warning, a fake government circular or a falsified tariff notice would be believed precisely because of where it appeared.

The sites belonging to critical national infrastructure (CNI), spanning electricity, ports, telecommunications, transport, disaster management, national identity and defence, are the most concerning. I cannot say whether these websites connect to the billing, grid, port or network systems behind them, but this is exactly the question Parliament should ask, since attackers rarely stop at the website. To wit, even as Japan’s SoftBank suspended its critical earthquake and tsunami alerts this week while it secured its systems, Sri Lanka’s disaster response runs its public website on, incredibly, software more than a decade old.A government that asks citizens to trust it with their identity, health records and payments online can’t leave its own front doors in this condition.

• The official response so far

SL-CERT issued a general advisory on 21 October urging institutions to patch or restrict access, which was the right advice, though it named no institution, and I can find no public evidence that anyone in government has since checked which state websites are affected, told the institutions concerned, set a deadline or taken a single site offline. We have been here before, in August 2023, when a ransomware attack on the Lanka Government Cloud destroyed 3 months of email across an estimated 5,000 government accounts after an upgrade from obsolete software had been delayed since 2021, and 3 years on, 61 government websites show how little has been learnt about abandoned software, which, left running because upgrading is nobody’s priority, nobody’s budget line and nobody’s brief, will eventually be found.

I urged the Prime Minister to direct every affected institution, within 48 hours, to install the fix or switch on temporary protections, and to take its site offline if it can do neither. Within a week, each should check whether it has already been compromised, and SL-CERT should publish the institutions it has notified, their progress, and a fresh scan of every government website, including those that hide their versions. Every site on retired software should move to a supported version or close within 3 months, a question of budget and accountability rather than technical effort, which is why it belongs in Parliament.The government is pressing ahead with digitalization at speed, from the Sri Lanka Unique Digital Identity (SL-UDI) scheme to GovPay for state services, each asking citizens to entrust the state with more of their personal information than ever before, and digital ambition built on this foundation is risk dressed as modernization, transferred quietly from the state to its citizens, on official websites that remain – as far as anyone outside government can tell – unpatched and unchecked.