Atualidade da nossa rede de cooperação institucional

CPIC urges immediate update of PHP systems over two critical vulnerabilities

22 outubro 2026 · Publicado originalmente por CPIC, Colegio de Profesionales en Informática y Computación ↗

Costa Rica's Colegio de Profesionales en Informática y Computación (CPIC) urged on 21 October 2026 that PHP patches be applied against two critical flaws. It warns that artificial intelligence speeds up both the discovery of flaws and their possible exploitation.

The Colegio de Profesionales en Informática y Computación (CPIC) of Costa Rica issued an urgent call from San José to public institutions, municipalities, companies, schools and IT professionals to review and update servers and web applications running on PHP. The notice follows the disclosure of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell", with a severity of 9.2 out of 10 on the CVSS v4 scale.

According to the technical information cited, the flaws lie in the memory management of the PHP core. They would allow an unauthenticated attacker to run code remotely on a non-updated server and access data held in memory, such as passwords, credentials, access keys and certificates. CPIC notes that PHP underpins content management systems such as WordPress, Drupal and Joomla. The flaws were found in August by the firm Calif, with support from an OpenAI artificial intelligence model, and independently by Wiz Research.

The Colegio recommends inventorying exposed systems, including unsupported versions, and applying the fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or those indicated by each vendor. Where an immediate update is not possible, it suggests enabling web application firewall protection rules or considering a temporary suspension of the exposed service. It also advises reviewing logs, rotating credentials and reporting incidents to the CSIRT-CR of the MICITT.

The Chair of the Board, Ing. Ricardo Romero López, stated that artificial intelligence is changing the rules of cybersecurity and that timely update management is a professional and institutional responsibility. Through its Comisión de Ciberseguridad, CPIC offered to provide technical expertise to the country's institutions.