Latvia restores access to government websites shut down over security flaws
Access to Latvian state and municipal websites on the shared government web platform was restored on Wednesday evening after being suspended over critical PHP vulnerabilities. Some sites, including Latvijas Vēstnesis and the public broadcaster's pages, remained offline.
Latvia gradually restored access to government websites on Wednesday evening, after they were suspended following the discovery of two critical security vulnerabilities in the PHP programming language. PHP is widely used to build websites, so the flaws put a large number of systems at risk.
Shortly after 10 p.m., access was restored to all sites on the government's unified website platform (known as TVP), which hosts 165 websites of state institutions and municipalities. Pages of ministries and agencies are working again, including the State Fire and Rescue Service, the emergency portal 112.lv, the Ministry of Defence, the National Armed Forces and the State Police.
What is working and what is not
Laura Krastiņa, press secretary of the Cabinet of Ministers, said the platform is again available from Latvian internet resources, while access from abroad remains restricted and is being monitored. She said the PHP flaws did not affect the platform; its operation was halted temporarily as a precaution against possible cyberattacks. Gatis Ozols, deputy state secretary for digital transformation at the Ministry of Smart Administration and Regional Development, warned that some other individual pages might still be unavailable.
The news agency LETA observed that at about 10:45 p.m. websites and mobile apps run by the state company Latvijas Vēstnesis were still down, including the official gazette Latvijas Vēstnesis and the Likumi.lv legal portal. Sites of Latvian public media and Latvian Radio had not been restored either.
About the vulnerabilities
Cert.lv, Latvia's cyber incident response body, first reported limited access from abroad, and the State Chancellery later announced a temporary suspension of access to the platform. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under the CVSS v4.0 standard. They could let an attacker run commands on a system without authentication. The PHP security team said it would release fixes on Wednesday at 5 p.m. Latvian time.
Cert.lv urged companies to check their systems immediately and install security updates, especially for websites, online shops and customer portals. Systems that cannot be updated should be disconnected from public internet access. Many foreign websites were also disrupted by the vulnerabilities.
