A cybersecurity researcher has raised urgent alarm bells over the digital security of Sri Lanka's public sector, warning that at least 80 government websites are currently exposed to significant cybersecurity risks. The findings, published by Dr. Sanjana Hattotuwa, highlight a troubling pattern of unpatched software, outdated systems, and unsupported web technologies that leave critical government infrastructure dangerously vulnerable to malicious actors.
The Scale of the Problem
According to Dr. Hattotuwa's research, the vulnerabilities stem primarily from the widespread use of outdated PHP versions and the presence of PHP2Shell-related weaknesses across dozens of government-operated websites. PHP2Shell is a type of web shell tool that, when exploited, can allow unauthorized users to gain remote access to a web server, execute commands, and potentially extract or manipulate sensitive data. The fact that such vulnerabilities exist across 80 government portals simultaneously points to a systemic failure in how Sri Lanka manages and maintains its digital public infrastructure.
The researcher personally wrote to the Prime Minister's office to draw attention to these findings, underscoring the seriousness of the situation and the need for immediate government-level action. The move reflects growing frustration among cybersecurity professionals who have long warned that Sri Lanka's digital governance frameworks are not keeping pace with evolving cyber threats.
Unpatched and Unsupported: A Dangerous Combination
At the heart of this cybersecurity crisis is a dual problem: unpatched software and unsupported platforms. Unpatched software refers to systems that have not received critical security updates, leaving known vulnerabilities open for exploitation. Unsupported software, on the other hand, refers to platforms that have reached end-of-life status, meaning developers no longer release security patches or updates for them at all.
Running unsupported software on government websites is particularly dangerous because, even if administrators wanted to apply a fix, none may be available. Cybercriminals actively scan the internet for websites running outdated or end-of-life software, knowing these are easier targets. For government websites, which often store citizen data, administrative records, and sensitive communications, the consequences of a successful breach could be severe.
Experts in the cybersecurity community have long emphasized that regular software updates and timely migration away from unsupported systems are among the most basic and effective defenses against cyberattacks. The situation in Sri Lanka suggests these fundamental practices are being neglected at scale across the public sector.
Why Government Websites Are High-Value Targets
Government websites are not simply informational portals. They frequently serve as gateways to citizen services, housing personal identification data, tax records, immigration information, health data, and more. A successful cyberattack on even one of these platforms could expose thousands or millions of citizens to identity theft, fraud, or privacy violations.
Beyond individual harm, cyberattacks on government infrastructure can disrupt essential public services, erode public trust in digital governance, and in extreme cases, compromise national security. State-sponsored hacking groups from various countries routinely target government websites of smaller nations, viewing them as softer entry points into broader regional intelligence networks.
Sri Lanka, like many developing nations, has been rapidly expanding its e-government services in recent years. While this digital expansion improves accessibility and efficiency, it also dramatically increases the attack surface if cybersecurity measures do not scale proportionally.
Calls for Immediate Action
Dr. Hattotuwa's warning is not the first of its kind directed at Sri Lanka's digital infrastructure, but the sheer number of affected websites — 80 — makes this disclosure particularly alarming. Cybersecurity researchers and digital rights advocates are now calling on the Sri Lankan government to take immediate and concrete steps to address the vulnerabilities identified.
Recommended actions include conducting a comprehensive security audit of all government-operated websites, immediately patching or taking offline any sites running vulnerable or unsupported software, establishing a centralized cybersecurity oversight body with enforcement authority, and developing a clear national cybersecurity policy that mandates regular software updates and security assessments for all public sector digital assets.
There are also calls for greater transparency and accountability. Citizens deserve to know whether the websites they use to access government services are secure. Publishing regular cybersecurity audit reports and establishing clear incident response protocols would be meaningful first steps toward rebuilding digital trust.
A Wake-Up Call for Digital Governance
The exposure of 80 Sri Lankan government websites to potential cyber threats is more than a technical problem — it is a governance failure that demands urgent political attention. As Sri Lanka continues its journey toward a more digitally connected public sector, ensuring the security and integrity of that infrastructure must be treated as a national priority, not an afterthought.
Dr. Hattotuwa's findings serve as a critical wake-up call. The window to act before a serious breach occurs may be narrow, and the cost of inaction could far outweigh the investment required to fix these vulnerabilities today.