11 Latvian government and municipal websites still down; restrictions may last until Monday
After two critical PHP vulnerabilities were disclosed, access to Latvian state and municipal websites from abroad has been restricted. Some sites remain unavailable, and the limits will most likely stay in place until next Monday.
Eleven Latvian government and municipal websites remain unavailable after access to part of the country's online resources was restricted following the discovery of critical security flaws in the PHP programming language. The restrictions apply to access to Latvian resources from abroad. Expert Teivāns estimates they will most likely last at least until next Monday, and Edgars Tavars (AS), Minister for Smart Administration and Regional Development, also said everything should be back in order by then.
What happened
Two critical vulnerabilities were found in PHP, which is widely used to build websites. They are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 under the CVSS v4.0 standard. They could allow an unauthenticated attacker to run arbitrary commands on an affected system.
About 6,000 resources in Latvia have been identified as potentially exposed, of which only a few hundred are in the public sector. On Wednesday evening the State Chancellery decided to temporarily suspend access to the unified website platform (TVP), which hosts the sites of 165 state institutions and municipalities. Access was later restored gradually, but some sites are still unavailable.
Attack situation
Teivāns said the attacks currently seen are mostly by bots and small groups, and are not highly targeted or elaborate. In his view, attacks will continue, hopefully with limited impact, although some sites with weaker security may fall victim. Tavars described the threat level as very serious.
Recommendations from Cert.lv
Cert.lv, Latvia's cyber incident response institution, says the mitigation advice from PHP developers for unsupported versions only partly limits attack methods and does not replace security updates. Systems that cannot be updated should be cut off from public internet access. Companies are urged to check their systems immediately, install updates and contact their IT maintainers or hosting providers, paying particular attention to websites, online shops and customer portals. Cert.lv continues to monitor the situation with the responsible authorities.
