Regional Pulse · Forty-five minutes

PHP2ShellThe clock runs in minutes

On Wednesday, October 21, PHP shipped patches for two flaws rated 9.2 out of 10 that let an attacker run code on the server with no username or password. Cloudflare CEO Matthew Prince counted tens of thousands of attack attempts in the 45 minutes after the announcement and millions that night. The Netherlands and Finland took public sites offline; in Costa Rica, Micitt alerted every state institution.

Calif and Wiz found the flaws using AI models, as Fortune reported. If finding a flaw takes weeks and exploiting it takes minutes, the only thing an institution controls is how long it takes to decide. That calls for an inventory of which sites run PHP, a CSIRT with a mandate to raise the alarm, and someone with written authority to pull a site offline without waiting for a meeting.

The figure comes from the World Economic Forum's regional analysis of the Global Cybersecurity Outlook 2026.

Strategies without budgets, regulators with wider reach

ILIA 2026, from ECLAC and CENIA, finds that about 85% of the countries assessed have a national AI strategy, but only Brazil and Colombia fund it. In Central America, governance scores range from 80.5 in Costa Rica to 19.3 at the other end of the isthmus. That gap is about execution more than technology: announcing costs little, executing takes a budget, a named owner and measurable goals.

In Montevideo, REGULATEL Week opened its first panel on whether telecom regulators should also become digital regulators. That mandate is set by law, and if every country does it its own way, anyone operating across borders faces different rules for the same service. Technology neutrality and international standards are the way out.

You fall to what you prepared

Chris Voss negotiated hostage releases for the FBI. In Never Split the Difference he argues that negotiation is an emotional game before it is a rational one.

Chapter 9 has the line that best explains Wednesday night: under pressure, each of us falls to the level we prepared. Voss walks in with his goal, his limits and even the worst accusations he might face already written down. On Wednesday night, the ones who responded well had an inventory, a mandate and someone with authority. With a regulator or a client, it works the same way.

For a slower read

On Corplife360, the four cultural barriers that hold regional teams back and four ways to intervene, drawing on Brett, Behfar and Kern in Harvard Business Review.

And on my site, the full picture of PHP2Shell: who decides and what changes for the region.

Panama opens the calendar

From Wednesday, October 28 to Friday, October 30, Panama hosts the first OAS Cyber Americas Forum alongside CIBERCOM 2026. On Friday, October 30, ISACA Full Day in Santo Domingo. From Wednesday, November 4 to Friday, November 6, the 19th LACIGF in Fortaleza, Brazil. In mid-November, the month Mexico gave platforms to protect minors runs out. From Tuesday, November 17 to Friday, November 20, CyberWeek@LAC4 in Santo Domingo.

Your turn

If your institution already has someone with written authority to take a site offline, tell me how you got there. And if this is useful to a colleague, forward it along.