Foto: BB.LV / Киберугроза PHP
In Latvia, attempts of cyberattacks have been recorded using discovered critical vulnerabilities in the PHP programming language; however, there are currently no reports that attackers have successfully breached any systems. This was reported on Thursday morning in the Latvian Television program "Morning Panorama" by Varis Teivans, the Deputy Head of the Cyber Incident Prevention Institution Cert.lv, as reported by LETA. According to him, attacks are likely to continue. At the same time, the specialist hopes that their consequences will be minor. However, Teivans acknowledged that among the internet resources whose owners pay insufficient attention to security, there are almost certainly those that may be affected. Currently, attempts to attack Latvian systems are mainly carried out by bots and small groups of attackers. According to the expert, these actions do not exhibit a high degree of preparation and targeting. ### Eight Important Internet Resources Remain Unavailable Teivans reminded that attempts at attacks were noticed as early as Wednesday, October 21. In this regard, a decision was made to temporarily restrict access to some Latvian internet websites. Most resources have already resumed operation; however, some remain unavailable. According to Cert.lv, eight high-priority digital resources are still not operational. In particular, on the morning of October 22, the official publication website Latvijas Vēstnesis remained inaccessible. Restrictions on access to Latvian internet resources from abroad are also still in place. It is expected that they will remain in effect at least until Monday, October 26. ### Thousands of Websites Are at Risk The reason for the emergency measures were two critical security vulnerabilities in PHP—a programming language widely used for creating and operating websites. The vulnerabilities are designated CVE-2026-109618 and CVE-2026-109619. Their severity is rated at 9.2 out of 10 according to the CVSS v4.0 standard. According to Cert.lv, they potentially allow attackers to execute arbitrary commands on the vulnerable system without prior authentication. In Latvia, about 6000 digital resources have been identified that could potentially be affected by these vulnerabilities. Only a few hundred of them belong to the public sector. It is important to note that this refers to potentially vulnerable resources, not confirmed cases of breaches. ### Why Government Websites Stopped Working On Wednesday evening, the State Chancellery announced a temporary suspension of access to the unified platform of government institution websites (TVP). This platform hosts 165 websites of state and municipal institutions. The decision was made as a preventive measure to protect against possible cyberattacks, as reported by [bb.lv](https://bb.lv/statja/tehno/2026/10/21/v-latvii-otkliuceny-portaly-pravitelstva-ministerstv-gosvedomstv-cto-slucilos). As a result, some websites became inaccessible not only from abroad but also for users within Latvia. Later, access to government internet resources began to be gradually restored. ### Cert.lv Urges Businesses to Urgently Update Systems Cert.lv emphasizes that the temporary restriction of access to websites is merely a protective measure and does not replace the elimination of vulnerabilities. PHP developers have published recommendations to reduce risks for systems using unsupported versions of the software. However, these measures do not provide full protection and do not replace security updates. If the system cannot be updated to a secure version of PHP, specialists recommend temporarily restricting its availability from the internet until the threat is eliminated. Private sector enterprises are also advised to promptly check their information systems and install necessary updates. Special attention should be paid to online stores, customer portals, public websites, and other digital services critical to business operations. For checking the PHP versions used and installing updates, companies are advised to contact their IT specialists or hosting providers. Cert.lv, together with responsible institutions, continues to monitor the situation and coordinate protective measures.
