Critical unauthenticated PHP flaws force Anatel and Brazilian federal courts to take SEI and other systems offline
Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline. The flaws were found independently by Calif and OpenAI in August, and Wiz later found additional ways to exploit them using AI models. Wiz called them among the most serious PHP vulnerabilities ever found. The NSA recommended patching immediately or shutting down vulnerable systems, and French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency. The article does not give CVE identifiers, affected versions or evidence of in-the-wild exploitation.
Entenda a falha
A vulnerabilidade
Two critical vulnerabilities in PHP, with no CVE IDs given in the coverage, reportedly let an unauthenticated attacker run actions on a server and take it over, with no login or credentials. The articles do not name the component, the affected versions or the fixed version. They say only that a fixed PHP release exists and that the update is required. Because PHP runs an estimated 70% of websites and platforms such as WordPress, Moodle and Magento, exposure is broad. In Brazil, Anatel and the TRF1, TRF4 and TRF6 courts suspended external access to systems such as SEI. No in-the-wild exploitation is reported.
Como funciona
The articles do not describe how the vulnerable code path works. They say only that an attacker with no credentials can make a server running a vulnerable PHP version perform actions and end up controlling the machine that hosts the site. Which input reaches which PHP component, and at which step it fails, is not disclosed.
Por que é vulnerável
The articles do not state the root cause or what the fix changes. Wiz says the flaws stayed unaddressed for more than a decade because finding and exploiting them was extremely complex without AI tools.
Como foi descoberta
Calif and OpenAI found the flaws independently in August 2026, with AI assistance according to the reporting. Wiz later found additional ways to exploit them, using the Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI) models, and called them among the most serious PHP vulnerabilities ever found. Public disclosure came on 21 October through a Brazilian CISC alert, and GSI and MGI instructed federal teams to update or take PHP systems offline. The NSA advised patching immediately or shutting down vulnerable systems. In France, local government sites, including that of the Paris Police Prefecture, were made inaccessible at the national cybersecurity agency's request.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:19.
Detalhes técnicos
- Two vulnerabilities in PHP allow actions on servers without credentials, which can lead to full server takeover.
- Discovered independently by Calif and OpenAI in August 2026. Wiz later found further exploitation paths using the Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI) models.
- PHP is cited as used by roughly 70% of websites and underpins platforms such as WordPress, Moodle and Magento.
- Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. TSE was asked whether its systems are affected.
Remediação
- Update PHP to the fixed release, which is available.
- Where immediate patching is not possible, take vulnerable systems offline or suspend external access.
- Technically assess all services that use PHP.
Linha do tempo
-
Critical unauthenticated PHP flaws force Anatel and Brazilian federal courts to take SEI and other systems offline
ler a análise desta fonte ocultar
Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline. The flaws were found independently by Calif and OpenAI in August, and Wiz later found additional ways to exploit them using AI models. Wiz called them among the most serious PHP vulnerabilities ever found. The NSA recommended patching immediately or shutting down vulnerable systems, and French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency. The article does not give CVE identifiers, affected versions or evidence of in-the-wild exploitation.
Technical Details
- Two vulnerabilities in PHP allow actions on servers without credentials, which can lead to full server takeover.
- Discovered independently by Calif and OpenAI in August 2026. Wiz later found further exploitation paths using the Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI) models.
- PHP is cited as used by roughly 70% of websites and underpins platforms such as WordPress, Moodle and Magento.
- Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. TSE was asked whether its systems are affected.
Remediation
- Update PHP to the fixed release, which is available.
- Where immediate patching is not possible, take vulnerable systems offline or suspend external access.
- Technically assess all services that use PHP.