Latvia Introduces Preventive Measures in Response to Globally Disclosed PHP Vulnerabilities

To protect government information systems from potential cyberattacks, a decision has been made to temporarily restrict access from abroad to several government digital resources in response to two critical PHP software vulnerabilities. Latvia’s cyber incident response institution CERT.LV and the European Union’s cybersecurity service CERT-EU are warning about two critical PHP vulnerabilities that could threaten the security of websites and digital services. They affect PHP software versions starting with PHP 5 and could allow unauthenticated attackers to remotely execute malicious code on vulnerable servers, potentially compromising data security and service continuity. Emergency security updates were published in October, and system administrators are urged to update PHP software immediately to the fixed versions—8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP developers have also published recommendations for mitigating the impact of the vulnerabilities in unsupported software versions; however, these measures only partially limit potential attack methods and do not replace security updates. Preventive access restrictions are a temporary protective measure, while promptly installing security updates is essential for the security of information systems in both the public and private sectors and for the continuity of digital services.