Public Sector & Government Agencies, October 2026

Monthly reference modules

These modules are populated automatically with verified dated facts within the period. Each one states its basis and counting criterion, so the figures reconcile across modules. They are the recurring month-by-month read, while the analysis that follows expands on the cases without repeating this summary.

Indicator window: 69 dated facts in October 2026 · 1 from prior months (comparative frame, not monthly volume) · 5 without confirmed date (excluded from the indicators). Facts from prior months are used only as a comparative frame in the analysis, never as volume for this period.

Executive summary

The reporting period was defined by a single regional pattern: critical PHP vulnerabilities, with potential or confirmed exploitation, prompted several public agencies and local administrations to take preventive steps, take portals offline, or speed up patching. The new factor was not only technical. The month also showed a convergence of long-standing service exposure, poor segmentation practices, and continued dependence on third-party platforms for essential administrative functions. Operationally, the message for public sector security teams was clear: when a flaw affects widely used, cross-cutting technology, the impact spreads quickly from servers to citizen services.

Two other stories stood out for different reasons but shared the same governance backdrop. In Bolivia, the Attorney General’s Office opened an investigation into the Roma system amid suspicions of leaked restricted information linked to Sebastián Marset, with public statements pointing both to possible external servers and to the need for a full audit of the ecosystem. In Brazil, the exposure of the Smart Sampa program triggered regulatory and administrative responses, including a formal request from the ANPD to the Prefeitura de São Paulo, while the city administration maintained that the case was not a conventional cyberattack but the disclosure of data by an authorized server. That difference in framing matters. In the public sector, the problem is not always an outside attacker. Sometimes it is privilege abuse, poor traceability, or the lack of fine-grained controls over legitimate access.

The third trend in the period was institutional response. Chile announced its first National Cybersecurity Exercise and reported 324 incidents with significant impact in the first half of 2026, adding context to a regulatory maturity that is beginning to incorporate simulation, interagency coordination, and notification. Peru, for its part, activated preventive measures in response to the two PHP vulnerabilities and expanded the alert to 1,510 public entities, showing a nationwide approach. Uruguay temporarily removed public agency portals while updates were being applied, in a defensive move that prioritized continuity and caution over immediate availability. Colombia, finally, issued an alert on the risk tied to PHP services exposed to the Internet and reinforced the debate over the mass exposure of infrastructure visible from the network.

The regional reading from these events is twofold. First, the public sector remains exposed because of common software, slow update cycles, and heterogeneous attack surfaces across ministries, municipalities, courts, citizen portals, and technology vendors. Second, risk management can no longer depend only on detecting a confirmed intrusion. Many of the month’s most effective responses were triggered before exploitation was confirmed, with containment measures, exposure reassessment, and public communication. For a government CISO, the lesson is clear: precise inventorying, faster patching, limiting external exposure, and reviewing internal user privileges are frontline controls, not secondary tasks.

Panorama

The month confirmed a trend that had already been emerging in earlier periods: a single software flaw can affect national governments, local administrations, and vendors that provide critical state services at the same time. The clearest technical case was PHP2Shell. Notices from official agencies and cybersecurity centers described two critical unauthenticated remote code execution vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, with fixed versions released on October 21. The available information points to a coordinated international response, but also an uneven one, with some institutions taking portals offline, others requesting urgent inventories, and others simply recommending updates.

Exposure was not limited to one type of organization. There were signs of impact on local government portals in several Argentine provinces, on Uruguayan public sites, on Peruvian state platforms and systems, and on Colombian government domains. In Brazil, the exposure of credentials from the Smart Sampa system triggered a regulatory, administrative, and media response cycle, although that case follows a different logic. It is not a global software vulnerability, but rather a matter of access management and sensitive information within an urban monitoring program. That distinction matters because it keeps incidents of different nature from being mixed together and allows defenses to be calibrated more precisely.

A second pattern also emerged, institutional transparency was partial and, in some cases, late. Public reporting on Smart Sampa moved between "invasion," "exposure," and "disclosure by an authorized user," which makes it necessary to separate confirmed facts from interpretation. In Bolivia, the investigation into Roma was marked by conflicting claims, audit requests, and possible changes in institutional identity. In Paraguay, the debate over the state digital system and allegations involving actors linked to China remained in the realm of attribution and geopolitics, where the public evidence is not enough to turn every claim into settled fact. The result is a landscape where public cybersecurity intersects with politics, regulation, the technology supply chain, and public perception.

From an operational standpoint, the month also reinforced a classic warning: Internet-facing portals remain the most likely entry point for service disruption, even when exploitation has not been confirmed. Alerts about PHP did not stop at theoretical risk, several technical reports indicated active exploitation, which is why public agencies should treat updates as urgent rather than routine maintenance. For state security and technology teams, the message is less dramatic than a sophisticated intrusion, but more useful, if a widely deployed component already has patches, the length of exposure is not an administrative detail, it is a direct risk factor.

Indicators

• Confirmed incidents with operational or regulatory impact during the period: 6
• Countries with relevant developments during the period: 7
• Critical PHP vulnerabilities mentioned during the period: 2
• Corrected versions released: 4
• Public entities directly alerted in Peru: 1,510
• Security and technology leaders alerted in Peru: approximately 2,400
• Incidents with significant impact recorded in Chile in the first half of 2026: 324

The figures above should be read with methodological caution. "Confirmed incidents with operational or regulatory impact" include service disruptions and the opening of investigations or regulatory demands, as long as the material allows a concrete fact to be verified and not just a suspicion. They should not be confused with internet telemetry or with press mentions of exposure that do not prove a successful intrusion. In particular, the country count reflects the presence of relevant events, not uniform intensity or severity.

Incidents

Argentina: local outages, urgent patches, and a municipal ecosystem tied to one vendor

Argentina’s case was among the most complex in the period because it combined two different layers: on one side, the wave of outages that hit municipalities in several provinces through Program Consultores S.A.’s PGM platform; on the other, the debate over how the state responded to the PHP2Shell vulnerability in its own systems. That overlap should not be read as a single incident. It is instead a reminder that public-sector environments depend on third parties and open-source software at the same time, which raises systemic risk.

According to coverage published on October 23, the outage tied to PGM reached systems used by local governments in Córdoba, Santa Fe, Santa Cruz, San Luis and Corrientes. Other reports described the event as a cyberattack that took down permit, tax collection and digital service portals used by municipalities across several Argentine provinces. The source does not confirm whether the impact came from encryption of assets, data exfiltration or only service unavailability, although some reports described it as ransomware. For a conservative reading, what can be verified is that municipal services were disrupted and that a vendor’s administrative and tax management platform sat at the center of the episode.

The operational takeaway matters. When a shared management platform concentrates permits, billing and digital services for many municipalities, any compromise or outage creates a cascade effect. Local governments usually have limited capacity to replace those tools quickly, so continuity depends on fallback plans that are rarely as mature as the core systems. In this kind of scenario, the critical question is not only whether there was an attack, but how long service counters can operate without the system, which processes remain manual and which data become inaccessible or exposed.

In the same country, a media analysis said state bodies, including Argentina.gob.ar and the Health and Economy ministries, applied measures recommended by Argentina’s CERT in response to PHP2Shell. That claim was attributed to Ariel Cessario, former coordinator of the national CERT, so it should be treated as indirect information. The technical basis is solid, though: CISA, the Canadian Centre for Cyber Security and several independent analyses described the flaws as unauthenticated remote code execution and recommended immediate patching. Corrected versions were also published. That means Argentina’s preventive response was consistent with the international technical consensus, even if the available material does not allow a precise measure of how many agencies followed the recommendation or how quickly.

For a public-sector CISO in Argentina, the lesson is twofold. First, municipal software vendors must be treated as part of the risk perimeter, not outside it. Second, responding to critical vulnerabilities in shared software requires version inventory, segmentation of exposed services, a contingency procedure and coordinated communication with local authorities. A portal taken offline can be less damaging than a compromised system, so when analytical capacity is weak, temporary containment may be the best decision. The month made one thing clear, availability without control is a false victory.

Bolivia: probe into Roma, debate over internal access and the need for a full audit

In Bolivia, the Attorney General’s Office opened an investigation into the Roma information system amid suspicion that confidential information linked to Sebastián Marset may have been leaked. Acting Attorney General José Armando Urioste announced a technical review of the digital ecosystem and mentioned the possibility that access to confidential information occurred through servers located outside the Attorney General’s premises. The way the case was communicated matters. Officials did not publicly state that an external intrusion had already been confirmed. Instead, they opened a technical line of inquiry and acknowledged the need to assess different vectors.

That caution does not reduce the seriousness of the episode. When an institutional platform concentrates sensitive data and doubts arise over how that information was accessed, the problem goes beyond a single technical failure. In this case, the published reports included versions that spoke of a possible leak, calls for a full audit and even references to institutional control of the system and its certification level. Attorney Luis Fernando Zegarra called for a full IT audit and argued that possible irregular access authorized from within should also be investigated, without ruling out or confirming an external intrusion. That point is key, because many high-impact public-sector incidents do not stem from a single cause. Sometimes they combine excessive privileges, weak separation of duties and poor traceability.

Red Uno also reported that the new administration was considering dropping the ROMA name from the institutional identity, while Vision360 said investigators were looking into claims about connections to external servers and that the system developer denied any penetration by organized crime. That range of accounts reflects a typical feature of sensitive state incidents: the reputational dimension can overtake the technical one. Changing a system’s name does not by itself solve exposure risks, but it can be part of an institutional repositioning strategy if it is paired with an audit, stronger controls and access cleanup.

The broader reading is that public cybersecurity in Bolivia cannot stop at perimeter checks. When the debate itself centers on external servers, internal access, certification and system governance, the correct response is a full life-cycle audit, who administers it, who can read it, who can export data, where logs are stored, what integrity controls exist and how each action is audited. For a government CISO, the incident is a reminder that confidential data are not protected by infrastructure alone. They are protected by processes and by oversight of privileged users.

Brazil: Smart Sampa, credential exposure and regulatory response

The Smart Sampa case was Brazil’s most visible during the period, not so much because of a traditional attack, but because of the mix of credential exposure, regulatory questions and disputes over the source of access. ANPD asked the Prefeitura de São Paulo for information about the exposure linked to the program and gave it five business days to respond. That regulator intervention marks an important threshold. The case was no longer just an administrative or media controversy. It had entered a formal review phase over information handling and responsibilities.

The sources reviewed describe several elements. First, the Prefeitura de São Paulo removed a public servant whom the municipal administration itself accused of leaking Smart Sampa monitoring data. Second, the administration said the case did not stem from a conventional cyberattack, but from the disclosure of information by an authorized employee. Third, UOL reported that ANPD received a request to investigate the exposure of system information in a public internet repository. Fourth, CNN Brasil reported an exposure lasting about 11 months that allegedly included credentials, data from more than 58,000 cameras, information from more than 6,000 agents and instructions for reproducing access to the system, although that coverage itself used the term "invasion," so that characterization should be read cautiously against the municipal version. Later, Estadão said, citing a digital security specialist, that credentials may have been available since 2024, although that claim depends on the authenticity and date of the credentials analyzed.

It was also reported that the Prefeitura would implement facial recognition and two-factor authentication for authorized Smart Sampa users after the credential exposure. In addition, the Public Prosecutor’s Office filed a noticia de fato to assess the case. That points to a multilayered response, technical correction, stronger authentication and institutional review. Technically, the case shows a recurring risk in urban security systems: access controls must be designed not only to stop external intrusions, but also to limit the damage a leaked, reused or improperly shared credential can cause.

The lesson for CISOs and data protection leads is clear. When a system concentrates operational information about cameras, agents or urban monitoring, access must be governed by least privilege, strong authentication, anomaly monitoring and export auditing. The mere existence of a public repository of credentials, even without proof of mass exploitation, is already a serious information governance problem. The divergence between "exposure," "leak" and "invasion" also shows that public organizations need precise messaging so they do not undermine trust or deepen confusion.

Chile: institutional response, national exercise and prolonged shutdown of a solar plant

Chile offered two complementary stories, one about institutional preparedness and another about operational impact on energy infrastructure. On one side, the National Cybersecurity Agency said 324 significant-impact incidents were recorded during the first half of 2026 and announced the first National Cybersecurity Exercise for October 29. Provectis and UCISO said the exercise would use a Capture The Flag format, be online and include technical challenges across different categories, with individual or team participation. Defensa.com placed the initiative in the context of notification obligations that apply to essential service providers and Critical Infrastructure Operators. Together, those sources show a country institutionalizing preparedness and capability testing.

On the other side, the National Electric Coordinator reported that the Huatacondo solar farm and its BESS storage system were still disconnected from the National Electric System, with 0% availability, after an incident the agency identified as a cyberattack on August 27, 2026. Diario Financiero also said the Coordinator’s record showed the disconnection of transformer TR1 220/23 kV at the Santa Rita substation, Huatacondo’s interconnection infrastructure, under a separate forced-disconnection request. SolarQuarter added that the attackers’ identity, access methods and any ransom demands had not been disclosed, and that the Santa Rita transformer may have been affected.

Analytically, the case is useful because it combines energy, operational continuity and cybersecurity without oversimplifying. The prolonged unavailability of a photovoltaic plant and its BESS does not automatically mean a confirmed ransomware scenario. What it does show is that the effects of a cyberattack on critical infrastructure can last for months and affect related components, not only the main asset. For public-sector teams and regulators, the message is that critical infrastructure security is not solved by software alerts alone. It also requires recovery plans, control-system segmentation and coordination among operators, regulators and response agencies.

Regionally, Chile stands out as one of the countries that best aligns preventive response with exercise planning, but the Huatacondo case shows that preparation does not eliminate the possibility of lasting damage. The value of the national exercise will be limited if it does not lead to concrete improvements in inventory, restoration and coordination between the IT and OT worlds. For a public-sector CISO, the recommendation is to treat continuity as a demonstrable capability. It is not enough to say it exists, it has to be proven.

Colombia: PHP service exposure, ColCERT alert and a cautious view of risk

Colombia did not record a confirmed intrusion against a public entity in the material analyzed, but it did face broad exposure of PHP services and an official warning about the associated risk. ColCERT published alert AL-20261021-123 and rated as high the risk tied to two critical remote code execution vulnerabilities in PHP services exposed to the Internet. It also counted 8,699 PHP services exposed to the Internet in the country. A later technical report said roughly 88% were on operator networks. That figure measures exposure, not compromise, and should not be read as a count of victims or breached systems.

The public discussion intensified when an investigation cited by Colombia One identified about 170 server records associated with Colombian government domains that advertised PHP, though without confirming a successful attack against any government institution. Impacto TIC, for its part, attributed to an analysis by Hyperconectado the identification of .gov.co servers linked to hospitals, ministries and mayors’ offices running PHP versions more than 15 years old. That still does not confirm intrusion, but it does point to significant technological obsolescence in public environments.

The nature of the case calls for disciplined reading. A large exposure surface does not mean all of it is compromised, but it does define a priority universe for review. In Colombia’s public sector, the combination of exposed portals, old versions and hybrid ecosystems involving telecom operators and hosting providers requires separating risk management from media perception. The technical authority has already done its part by issuing the alert. Now the entities need to map versions, identify critical services and apply patches or external-access restrictions when immediate updates are not possible.

For CISOs, the concrete recommendation is a three-part minimum, server inventory, version verification and segmentation of exposed services. In the short term, if updates are not possible, reducing the external attack surface should be the priority. In the medium term, Colombia’s problem is not only PHP, but persistent obsolescence in institutional domains and reliance on infrastructure that is not always under the direct control of the service-owning agency.

Paraguay: Chinese sanctions, attribution debate and cybersecurity as a geopolitical dispute

Paraguay’s case was shaped as much by international politics as by cybersecurity. China announced countermeasures against Paraguayan Minister of Information and Communication Technologies Gustavo Villate, accusing him of spreading disinformation about alleged Chinese cyberattacks. Beijing framed the move as a response tied to its relations with Taiwan. Associated Press reported that the sanctions came after Paraguay and the U.S. embassy said in July that attacks linked to the Chinese government had compromised Paraguayan state systems. China rejected the accusation.

Villate responded that Paraguay sovereignly decides the technical and national security criteria for its digital infrastructure, and that no external sanctions will shape those decisions. LatinAmerican Post said 2024 and July 2026 reports describe separate findings involving China-linked actors, but do not prove an uninterrupted intrusion. It also warned that technical attribution does not by itself show who ordered an operation. That distinction matters because it keeps attribution hypotheses from turning into political certainties.

At the same time, MITIC and the U.S. government issued a joint statement on malicious cyber operations linked to China and aimed at Paraguayan state institutions. TEDIC, meanwhile, said there was no public evidence that certain vulnerabilities identified in components of Paraguay’s electoral technology system had been fixed before October 4, 2026. That observation does not confirm a new incident during the period, but it does show that part of Paraguay’s state-security debate remains open and that vulnerability remediation is not always transparent or publicly verifiable.

The implication for the public sector is twofold. First, cybersecurity can be used as a tool in diplomatic disputes, which demands technical precision and narrative caution. Second, even when attribution is disputed, digital infrastructure modernization cannot wait for geopolitical consensus. For security leaders, defending the system must continue regardless of the external dispute, segmentation, access review, auditing and coordination with trusted partners are useful in any scenario.

Peru: national alert on PHP and coordinated public-sector response

Peru mounted a broad institutional response to the two critical PHP vulnerabilities. CNSD said it was assessing state digital services to identify exposed systems and provide technical assistance to entities at all three levels of government. At the same time, the Digital Security Center of the Presidency of the Council of Ministers alerted about 2,400 security and technology leads across 1,510 public entities and recommended applying the available patches. That notification scale shows a substantial national effort with an explicit focus on operational continuity.

Technical and press coverage also said the Peruvian government activated preventive measures, recommending that PHP versions be checked, the corresponding updates be installed and vigilance be reinforced for Internet-connected systems. La República reported that CNSD had warned about exploitation attempts against the PHP2Shell vulnerabilities, but the coverage did not identify compromised Peruvian public entities or confirm successful access. That distinction is central. The country acted against exploitation risk, not against a confirmed breach of the state.

From an operational standpoint, Peru’s response is probably one of the clearest in the period. It did not just issue an alert, it paired it with a specific universe of responsible people and entities. That matters because generic alerts often get lost in the bureaucratic chain in the public sector. When the technical message reaches thousands of responsible staff and is turned into concrete recommendations, the likelihood of action rises. Even so, the real challenge is not sending the notice, but verifying compliance, recording exceptions and prioritizing the most exposed systems.

The lesson for CISOs is that patch governance must be measurable. It is not enough to recommend an update. Teams need to know who received the notice, who executed it, how quickly and with what impact on citizen services. Peru showed a valuable coordination structure. The next step is to turn that into operational traceability and remediation metrics.

Uruguay: portals taken offline as a preventive measure

Uruguay appears in the material as a case of preventive containment. The temporary shutdown of public-sector websites responded to an international alert over two critical PHP vulnerabilities and to CERTuy’s decision to take service portals offline while updates were applied. El Observador said ministry portals and other state digital services were temporarily taken offline as a preventive measure, with no public confirmation of successful exploitation of the vulnerability in Uruguay.

The decision may seem drastic, but in context it is reasonable. When a public service depends on Internet-facing software and there is a risk of unauthenticated remote code execution, temporarily disconnecting it can be preferable to leaving a potentially vulnerable system online. The political cost of a controlled outage may be lower than the cost of an intrusion affecting data or service integrity. The coverage reviewed does not report data theft, encryption or exfiltration, so the relevant fact is preventive unavailability, not confirmed exploitation.

This case offers a useful signal for the region. CERTs and CSIRTs can gain legitimacy when they prioritize preventive action and clearly explain why it is being taken. Transparency about the reason for taking a service offline helps avoid speculation and sustain public trust. For a CISO, the Uruguayan example is a reminder that continuity does not always mean keeping everything online. Sometimes it means shutting down in time to preserve service in the medium term.