Sri Lanka's government on Wednesday acknowledged “major” lapses over its failure to prevent the horrific Easter attacks that killed more than 350 people, despite prior intelligence warnings.

Recriminations have flown since suicide bombers blew themselves up in packed churches and luxury hotels on Sunday, in attacks claimed by the militant Islamic State (IS) group.

Overnight, security forces using newly granted powers under the country's state of emergency arrested 18 more suspects in connection with the attack, as the toll rose to 359.

Police have so far arrested 58 people, all Sri Lankans, and security remains heavy, with bomb squads carrying out several controlled explosions of suspect packages on Wednesday.

But the government faces anger over revelations that specific warnings about an attack went ignored.

Sri Lanka's police chief issued a warning on April 11 that suicide bombings against “prominent churches” by the local Islamist group National Thowheeth Jama'ath (NTJ) were possible, citing information from a foreign intelligence agency.

CNN reported that Indian intelligence services had passed on “unusually specific” information in the weeks before the attacks, some of it from an IS suspect in their custody.

But that information was not shared with the prime minister or other top ministers, the government says.

“It was a major lapse in the sharing of information,” deputy defence minister Ruwan Wijewardene conceded at a press conference on Wednesday.

“The government has to take responsibility.”

Chilling footage

President Maithripala Sirisena, who is also defence and law and order minister, pledged on Tuesday to make “major changes in the leadership of the security forces in the next 24 hours”.

“The restructuring of the security forces and the police will be completed within a week,” he said.

He also called an “all party conference” with the country's political parties for Thursday, and will meet with religious leaders too.

New details emerged about some of the bombers on Wednesday, with Wijewardene saying one had studied in Britain and then did post-graduate studies in Australia before returning to Sri Lanka.

“Most of them are well-educated and come from middle, upper-middle class families, so they are financially quite independent and their families are quite stable financially, that is a worrying factor in this,” the minister added.

And chilling CCTV footage emerged showing one of the attackers calmly patting a child on the head and shoulder moments before he walked into the packed St Sebastian's church and detonated his bomb.

A US FBI team is now in Sri Lanka, Wijewardene said, and Britain, Australia and the United Arab Emirates have all offered intelligence help.

Experts say the bombings bear many of the hallmarks of IS attacks, and the government has suggested local militants could not have acted alone.

But it has not yet officially confirmed any IS role in the blasts against three churches packed with Easter worshippers and three high-end hotels.

A desperate search was underway for other suspects linked to the blasts, including the head of the local extremist group believed to have played a key role in the attacks.

The government has said the NTJ group was behind the attack, perhaps with international help, and its leader Zahran Hashim remains unaccounted for.

He appears to be among eight people seen in a video released by IS on Tuesday, leading seven others in a pledge of allegiance to IS chief Abu Bakr al-Baghdadi.

It was not yet clear whether Hashim was among the suicide attackers or had escaped after the blasts.

Multiple attackers

Government officials have said they cannot rule out further attacks while suspects remain at large.

In all, nine people are believed to have blown themselves up on Sunday, either during attacks or when police attempted to arrest them.

Sri Lankan police sources have told AFP that two Muslim brothers, sons of a wealthy Colombo spice trader, blew themselves up at the Shangri-La and the Cinnamon Grand hotels.

Their father is now one of the 58 in custody.

The Kingsbury hotel in the capital was the last one hit. A fourth planned attack on a hotel failed, authorities said. The would-be attacker was followed back to a Colombo lodge, where he blew himself up, killing two people.

Sources close to the investigation said two more people — a man and a woman — blew themselves up at another location as security forces launched a raid. Those blasts killed three police.

Work was continuing to identify foreign victims in the blasts.

A Danish billionaire lost three of his children in the attacks, a spokesman for his company said.

Eight Britons, 10 Indians, four Americans and nationals from Turkey, Australia, Japan and Portugal were also reported killed.

The United Nations said at least 45 children, Sri Lankans and foreigners, were among the dead.