International cooperation is one of the pillars of CEA Digital Law. Through our network of partner institutions we connect initiatives, knowledge and academic and professional activity across Europe, Latin America and the Caribbean (LAC), with a significant presence in Africa. This space brings together a selection of news published by the institutions with which we have cooperation agreements, extending their reach and international profile.
CPIC urges immediate update of PHP systems over two critical vulnerabilities
22 October 2026 · Originally published by CPIC, Colegio de Profesionales en Informática y Computación ↗
Costa Rica's Colegio de Profesionales en Informática y Computación (CPIC) urged on 21 October 2026 that PHP patches be applied against two critical flaws. It warns that artificial intelligence speeds up both the discovery of flaws and their possible exploitation.
The Colegio de Profesionales en Informática y Computación (CPIC) of Costa Rica issued an urgent call from San José to public institutions, municipalities, companies, schools and IT professionals to review and update servers and web applications running on PHP. The notice follows the disclosure of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell", with a severity of 9.2 out of 10 on the CVSS v4 scale.
According to the technical information cited, the flaws lie in the memory management of the PHP core. They would allow an unauthenticated attacker to run code remotely on a non-updated server and access data held in memory, such as passwords, credentials, access keys and certificates. CPIC notes that PHP underpins content management systems such as WordPress, Drupal and Joomla. The flaws were found in August by the firm Calif, with support from an OpenAI artificial intelligence model, and independently by Wiz Research.
The Colegio recommends inventorying exposed systems, including unsupported versions, and applying the fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or those indicated by each vendor. Where an immediate update is not possible, it suggests enabling web application firewall protection rules or considering a temporary suspension of the exposed service. It also advises reviewing logs, rotating credentials and reporting incidents to the CSIRT-CR of the MICITT.
The Chair of the Board, Ing. Ricardo Romero López, stated that artificial intelligence is changing the rules of cybersecurity and that timely update management is a professional and institutional responsibility. Through its Comisión de Ciberseguridad, CPIC offered to provide technical expertise to the country's institutions.
News summary prepared by CEA Digital Law from a publication by CPIC, Colegio de Profesionales en Informática y Computación.
Read the full story on the original website ↗Their agreement with CEA Digital Law
Institutional cooperation
An international network open to new partnerships
CEA Digital Law fosters cooperation with universities, research centres, bar associations, scientific societies and international organisations committed to legal, technological and regulatory knowledge, through knowledge exchange, research and joint activities.
Explore institutional cooperation opportunitiesSee our agreements