Paraguay Electoral Justice suspends sites over PHP CVEs

Paraguay’s Electoral Justice suspended its websites as a precaution after a CERT-PY alert tied to two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. At the same time, Paraguay’s incident response agency also warned about WhatsApp account theft through voicemail access used to capture verification codes, and recommended enabling two-step verification, changing the default voicemail password, or disabling that service.

What happened to the Electoral Justice sites?

The preventive shutdown followed the CERT-PY notice about two PHP flaws affecting exposed systems. The available reporting attributes the case to La Tribuna, which said the vulnerabilities were disclosed on October 20, 2026, and that the PHP team released emergency patches on October 21.

That coverage described them as remote code execution flaws, although it did not independently confirm active exploitation at the time. CISA later added both CVEs to its Known Exploited Vulnerabilities catalog, which does provide official confirmation that they were being actively exploited, though not that the exploitation was tied to Paraguayan systems.

What do the technical reports say about the flaws?

Unit 42 at Palo Alto Networks described CVE-2026-109618 and CVE-2026-109619 as critical unauthenticated remote code execution vulnerabilities with a CVSS score of 9.2. According to that analysis, CVE-2026-109618 is linked to uninitialized memory after out-of-memory errors, while CVE-2026-109619 involves global state references to freed memory.

AWS said a remote unauthenticated attacker could send crafted web requests to run arbitrary code, read data accessible to the process, or trigger a denial of service in affected PHP workers. Z-CERT, for its part, recommended urgently installing the PHP updates and, if that was not immediately possible, considering temporarily removing the affected systems from the internet.

What did CERT-PY recommend about WhatsApp account theft?

CERT-PY warned that WhatsApp accounts in Paraguay were being stolen by accessing voicemail to obtain the six-digit verification code. Its official recommendation was to enable two-step verification, change the default voicemail password, or disable voicemail.

The warning focused on that code-recovery mechanism, which can let a third party take over an account if they manage to hear or intercept the voicemail message. The alert was issued on October 27, 2026, at a point when separate warnings were already circulating about the PHP vulnerabilities and the operational pressure on exposed environments.