PHP vulnerability exposes gaps in public information

Several Latvian government, municipal and private-sector websites were temporarily taken offline this week after a critical PHP software vulnerability was discovered worldwide, LSM reports. The incident highlighted the need to improve how residents are informed when websites and services become unavailable.

Gatis Ozols, state secretary at the Ministry of Smart Administration and Regional Development, told Latvian Radio that technology vulnerabilities cannot all be predicted, so organisations need to be ready to act immediately when they are found. While fixes could once take several days to implement, he said, that time may no longer be available: artificial intelligence tools can help prepare automated attacks that exploit newly discovered flaws.

In some cases, websites may therefore need to be taken offline at once. Organisations must also explain what is happening to people who rely on those sites for information or services, Ozols said. He added that the issue is not only technical: officials need to decide what to tell the public and which channels to use while a website is unavailable. He said the government would address the matter as it works to restore the affected sites.

The websites were taken offline as a security precaution, not because they had already been breached. Arvis Zīle, head of the Crisis Management Center, said he did not consider the incident a crisis. That affects how the public should be informed and whether a warning is needed, he said. Cell broadcast alerts should be reserved for more serious threats.

Media played an important role in informing the public during the incident, according to the report.