Latvia restores access to government websites, some resources still restricted from abroad

Latvia was gradually restoring access to government websites on Wednesday evening, after they were restricted because two critical security vulnerabilities were disclosed worldwide in PHP, a programming language widely used to build websites. Latvia's cyber incident response institution Cert.lv says some digital resources remain restricted from abroad.

What has been restored

The necessary security updates have been installed on the Unified Web Platform (TVP), which hosts the websites of 165 state institutions and municipalities, and its availability from Latvia has been restored. By 11 p.m., the public broadcaster's portal Lsm.lv and the emergency services site 112.lv were working again. The Latvija.gov.lv platform is available from Latvia but not from abroad. Around midnight, websites and mobile apps run by the state company Latvijas Vēstnesis, including the portal Likumi.lv, were still down.

Access to TVP was initially suspended by decision of the State Chancellery to protect it from possible cyberattacks, so many sites were unreachable both in Latvia and abroad.

Risks and outlook

About 6,000 resources in Latvia have been identified as potentially affected, and only a few hundred of them are in the public sector. Automated attempts to exploit the flaws have been detected, but there are no reports of successful attacks.

Cert.lv deputy head Varis Teivāns said on a Latvian Television special broadcast that some resources could remain unavailable until Monday, 26 October. Owners sometimes depend on third parties and developers who cannot always react quickly. Security updates have not been issued for all PHP versions, so resources running older versions face a harder situation. Teivāns said other EU member states have chosen a similar strategy: "Better such availability disruptions than stolen data."

Edgars Tavars (Progressives), the minister for smart administration and regional development, said cyber threats will only grow in future.

About the vulnerabilities

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under the CVSS v4.0 standard. They could let an unauthenticated attacker run arbitrary commands on an affected system. The PHP security team said it would release fixes at 5 p.m. Latvian time on Wednesday.

Private companies are urged to check their systems immediately, install updates and contact their IT maintainers or hosting providers. Systems that cannot be updated should be cut off from internet access.