Critical PHP Vulnerabilities Briefly Knock Out Many Latvian Government and Municipal Websites
On Wednesday evening, 21 October, access to many Latvian state and municipal websites was restricted after critical security flaws were found in the PHP programming language. By about 22:10, access to several sites had been restored.
On Wednesday evening, 21 October, access to several websites of Latvian state and municipal institutions was restricted. The cause was critical security vulnerabilities discovered in PHP, a programming language widely used to build websites. The news agency LETA reported the situation. The disruption affected public access to government information and services, including the sites of emergency services.
What happened
The cyber incident response institution Cert.lv first said that several Latvian digital resources had temporarily restricted access from abroad. The State Chancellery later said it had decided to temporarily suspend access to the unified website platform (TVP in Latvian) to protect it from possible cyberattacks. As a result, the affected sites were unavailable both in Latvia and abroad.
Which sites were affected
LETA observed that the websites of the State President's Chancellery, ministries, state institutions and services, and some municipalities were down. The sites of Latvian Public Media, the Children's Clinical University Hospital and the official gazette Latvijas Vēstnesis were also unavailable. Others included the State Fire and Rescue Service, 112.lv, the Ministry of Defence, the National Armed Forces and the State Police.
The E-health, Latvija.lv and eParaksts.lv sites were working, at least from within Latvia. Most major Latvian online shops were also reachable.
Recommendations
Cert.lv said PHP developers have published guidance for reducing the impact of the vulnerabilities in unsupported software versions. However, these measures only partly limit possible attacks and do not replace security updates. Systems that cannot be upgraded to a secure PHP version should be cut off from public internet access until the risks are resolved.
Private companies were also urged to check their systems immediately and install available updates, paying particular attention to public websites, online shops and client portals. They should contact their IT maintainers or hosting providers to confirm which PHP versions they use.
Access restored
Around 22:10, access was restored to several sites on the TVP platform. Ministry and agency websites resumed operation, including the State Fire and Rescue Service, 112.lv, the Ministry of Defence, the National Armed Forces and the State Police.
