Critical unauthenticated PHP flaws force Anatel and Brazilian federal courts to take SEI and other systems offline
Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed fe…