LSM website offline for several hours over critical PHP vulnerabilities

On Wednesday, 21 October, many Latvian public institution websites became unavailable, including the portal lsm.lv of Latvian Public Broadcasting (LSM). The cause was cybersecurity risk: the Cabinet of Ministers announced that the unified website platform (TVP) had been suspended because of critical vulnerabilities in PHP software disclosed worldwide. The loss of access prompted debate on social media, since LSM is one of the sources people turn to for information during crises.

What happened

A notice was posted on the LSM website saying it was closed temporarily due to cybersecurity risks. It was among the first sites to go offline. Because the unified platform was suspended, users also could not open the websites of the police, emergency medical services and the rescue service, among others.

CERT.LV, Latvia's cyber incident response institution, had issued a warning on Wednesday about two critical security vulnerabilities in the PHP programming language. They are designated CVE-2026-109618 and CVE-2026-109619, and both were rated 9.2 out of 10 under the CVSS v4.0 standard. Such flaws could allow an attacker to run any commands on an affected system without prior authentication.

Restoration

Late on Wednesday evening, access to all TVP websites was restored. The lsm.lv portal came back online at 22:57.

Public reaction

The website's several hours of unavailability caused confusion among social media users, given the portal's role in crises and its annual funding of 61 million euros. Some commenters mocked the situation, while others voiced concern about readiness for a real emergency. One user recalled that during the Barricades of 1991, engineers who were radio enthusiasts built a reserve broadcasting station for Latvian Radio, and asked why a simple backup website with minimal information cannot be launched today.