Alerts

Client alerts.

Short notices on legal, regulatory and technical changes that call for a decision. Newest first.

Cybersecurity & data protection

Critical PHP flaws: every day without patching weakens your legal defense.

PHP runs nearly 7 in 10 websites, including every WordPress site. Two critical flaws are already being exploited.

  1. A L E R T · 0 1 / 0 7 A L E R T C Y B E R S E C U R I T Y & D A T A P R O T E C T I O N CriticalPHPflaws: everydaywithout patchingweakensyour legaldefense. PHP runs nearly 7 in 10 websites, including every WordPress site. Two critical flaws are already being exploited. O C T O B E R 2 4 , 2 0 2 6 S W I P E →
  2. A L E R T · 0 2 / 0 7 0 1 · W H A T H A P P E N E D Threeflawsinfourdays. C R I T I C A L · C V S S 9 . 2 E X P L O I T E D PHP2Shell CVE-2026-109618 · CVE-2026-109619 Fixed on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier will not be patched: you must upgrade. N A R R O W · O C T O B E R 2 3 N O P A T C H Y E T CVE-2026-115560 No fix until the next regular release. Block it at the server level with session.upload_progress.enabled=0
  3. A L E R T · 0 3 / 0 7 0 2 · T H E R I S K Onanunpatchedserver,an attackercan: 0 1 Getinwithoutapassword Run their own code on your server. 0 2 Readyourdatabases Client files, employee data and stored passwords. 0 3 Stayinside Leave hidden backdoors that stay active after you patch. 0 4 Turnyoursiteagainstothers Infect your visitors, take your site down or attack third parties from your server.
  4. A L E R T · 0 4 / 0 7 0 3 · Y O U R L E G A L E X P O S U R E · M E X I C O ’ S L F P D P P P Whenthefixisfreeandavailable,not applyingitishardtojustify. Duty of security (art. 18): safeguards must reflect the risk and the state of technology. F I N E S O F U P T O $37.5 millionMexicanpesos 320,000 UMA (Mexico’s fine unit) for a database security breach attributable to you (arts. 58-XI and 59). ×2 with sensitive data + additional fine if the violation persists
  5. A L E R T · 0 5 / 0 7 0 4 · O T H E R C O N S E Q U E N C E S Beyondthefine: Exofficioinspection Mexico’s Anti-Corruption and Good Governance Ministry may open one on well-founded grounds to presume a violation. ART. 54 Immediatenoticetodatasubjects If the breach significantly affects their property or moral rights. ART. 19 Compensation Affected individuals may claim damages. ART. 53 Civilorcriminalliability Administrative penalties do not preclude it. ART. 61
  6. A L E R T · 0 6 / 0 7 0 5 · A C T I O N P L A N Whattodothisweek 1 Getitinwriting Ask whoever runs your servers to confirm they updated PHP (or upgraded to 8.2 or later) and applied the configuration change. 2 Preservethelogs Have them reviewed and preserved from October 17, the date of the first detected exploitation attempt. 3 Assessnoticetodatasubjects If there are signs of unauthorized access, decide right away whether you must notify them. 4 Documenteverystep That record is your evidence of due diligence.
  7. A L E R T · 0 7 / 0 7 Needtoassessyourexposureor reviewyourvendorcontracts? cyber@lipp.legal → L A W · I N N O V A T I O N · P U B L I C P O L I C Y Information as of October 24, 2026. For informational purposes only; not legal advice.

Download the PDFQuestions about your case? cyber@lipp.legal

For informational purposes only; not legal advice.

BACK TO HOME