Latvia Temporarily Restricts Foreign Access to Digital Resources Over PHP Vulnerabilities

Cert.lv, Latvia's cyber incident prevention institution, has temporarily limited access from abroad to several Latvian digital resources. The reason is a set of critical security vulnerabilities discovered globally in PHP, a programming language widely used to build websites and online systems.

According to Cert.lv, the access limits were introduced deliberately and with a clear purpose: to protect state information systems from possible cyberattacks. The preventive measures will be applied selectively to reduce the threat and to ensure that security updates are installed in time.

What it means for residents

People who use state digital services from within Latvia are not expected to be affected. For those located abroad, the restrictions could remain in force until Monday, 26 October, depending on how the rollout of security updates progresses.

Cert.lv currently has no information that any Latvian information system has been compromised through these vulnerabilities.

About the vulnerabilities

Two critical flaws have been found in PHP that could allow an attacker to execute commands on a system without prior authentication. They are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 in severity under the CVSS v4.0 standard.

Based on current information, exploiting them could let an unauthenticated attacker run any commands on an affected system. The PHP security team has announced that it will release security fixes on Wednesday at 17:00 Latvian time.