Has it begun? Access to a number of websites is restricted due to critical vulnerabilities, including in Latvia

The restrictions have been implemented deliberately to protect state information systems from potential cyberattacks. As explained by Cert.lv, preventive security measures will be applied selectively to reduce the threat and ensure timely installation of security updates. It is expected that residents using state digital services from within Latvia will not be affected by the restrictions. For users abroad, they may remain in place until Monday, October 26, depending on the speed of update installations. At the same time, Cert.lv currently has no information that any information system in Latvia has been hacked using the discovered vulnerabilities. What is the threat As previously reported, two critical vulnerabilities have been found in PHP, designated CVE-2026-109618 and CVE-2026-109619. Both have been rated with a severity score of 9.2 out of 10 according to the CVSS v4.0 standard. According to available information, these vulnerabilities potentially allow attackers to execute arbitrary commands on the vulnerable system without prior authentication. The PHP security team has announced that patches will be released on Wednesday at 5:00 PM Latvian time. Developers have also published recommendations for mitigating risks for unsupported software versions. However, these measures only partially limit the potential for attacks and do not replace comprehensive security updates. If the system cannot be updated to a secure version of PHP, access to it from the internet should be restricted, and its public availability should be eliminated until the threats are addressed. Businesses are urged to urgently check their systems Cert.lv is also calling on private companies to immediately check their systems and install available security updates. Particular attention is recommended for publicly accessible websites, online stores, client portals, and other systems critical to business operations. Businesses are advised to contact their IT specialists or hosting providers to clarify the PHP versions in use and ensure that necessary updates are installed. Cert.lv emphasizes that timely and coordinated actions are especially important when critical vulnerabilities are discovered. Temporary access restrictions serve only as an additional layer of protection, while prompt installation of updates is essential for the security of both state and private information systems and the uninterrupted operation of digital services. PHP is widely used in website development, so the discovered vulnerabilities pose a potential threat to a large number of information systems. According to LETA, due to this threat, the operation of certain websites has been temporarily suspended in various countries around the world. In Latvia, the website and mobile application of Latvian Radio, as well as the public media portal Lsm.lv, have been temporarily taken offline.