Cybersecurity in Chile: PHP2Shell, ransomware and the laws ahead

The second installment in our series on server security in the AI era. In part 1 we covered what changed and how we responded to PHP2Shell; here we bring that international news down to Chile's reality.

PHP2Shell in Chile

PHP2Shell reached Chile too. The National CSIRT, part of Chile's National Cybersecurity Agency (ANCI), issued an alert (in Spanish) on October 21 itself, updated on the 23rd, warning that it could affect essential service providers and operators of vital importance. It called for installing the fixed versions immediately, warned that temporary mitigations "don't guarantee complete protection" and that a web application firewall doesn't replace updates, and recommended reviewing logs back to October 17 for signs of exploitation. As academic Marco Aravena told the University of Valparaíso (in Spanish): "An official alert doesn't mean Chilean sites have been compromised." But the question, he added, is how much it affects us.

The local context shows why it matters:

• More incidents. According to ANCI, cited by Mundo en Línea and other outlets (in Spanish), Chile had 324 significant-impact incidents in the first half of 2026, close to the more than 400 reports for all of 2025. According to Las2orillas (in Spanish), almost half of the incidents started with a compromised account, and 41% of 2025 cases could have been avoided with simple measures; ANCI promotes nine basic measures that, according to the agency, would prevent up to 90% of reported incidents.
• Rising ransomware. Between January and August 2026, 33 Chilean organizations were hit by ransomware, fourth in Latin America, according to the Gtd report prepared by Secure Soft with CronUp records, cited by DeboSaber and other outlets (all based on that same report). According to CronUp (in Spanish), August was the worst month on record in the country, with at least ten organizations hit, including the University of Chile Clinical Hospital, and the 2026 average is four times that of 2023.
• Framework Cybersecurity Law (Law 21.663). It created ANCI and requires essential services and operators of vital importance (1,154 designated, according to the agency) to manage vulnerabilities, have continuity plans and report significant incidents: an early warning within 3 hours, a second report within 72 hours (24 for vital operators whose service is affected) and a final report within 15 days, according to Asentic and Las2orillas (in Spanish). Fines reach 40,000 UTM (a Chilean inflation-indexed unit).
• Personal Data Protection Law (Law 21.719). Under the law as it stands, it takes effect on December 1, 2026. On October 28, 2026, the Senate approved delaying it to October 15, 2027; the bill has moved to the Chamber of Deputies, and until it's approved and published the legal date remains December 1, 2026 (details in our note on the delay). It sets fines of up to 20,000 UTM and, for repeat offenses, up to 2% or 4% of annual revenue, according to guides such as Prey's (in Spanish). A breach exposing personal data will have to be reported to the new Data Protection Agency.

For a Chilean company, the message is concrete: even if it isn't bound by Law 21.663, its customers or suppliers may be, and Law 21.719 applies to anyone who handles personal data.

What to ask your IT provider

• If we have an incident, who reports it and within what deadlines, considering Laws 21.663 and 21.719?
• Have you reviewed logs back to October 17, as the National CSIRT recommended, on systems running PHP?
• Do admin accounts use two-factor authentication? According to ANCI, almost half of incidents start with a compromised account.

Frequently asked questions

Were Chilean sites compromised by PHP2Shell? The sources we reviewed don't report confirmed successful attacks in Chile. The National CSIRT issued an alert and called for immediate updates.

What does Chilean law require? Law 21.663 requires essential services and operators of vital importance to manage their security and report significant incidents within 3 hours, 72 hours and 15 days. Law 21.719, on personal data, applies to any organization that handles people's data.

Has Law 21.719 been delayed? The Senate approved delaying it to October 15, 2027, but the Chamber of Deputies still has to vote. Until the delay is published, the legal date remains December 1, 2026.

Sources

• Chile's National CSIRT (ANCI), alert AVC26-00740 on PHP (in Spanish) (October 2026).
• University of Valparaíso, interview with Marco Aravena (in Spanish) (October 2026).
• Mundo en Línea, on ANCI figures (in Spanish) (October 2026).
• Las2orillas, on Chile's cybersecurity law (in Spanish) (October 2026).
• DeboSaber, on Gtd's ransomware report (in Spanish).
• CronUp, on August 2026's ransomware record in Chile (in Spanish) (September 2026).
• Asentic, guide to Law 21.663 (in Spanish) (May 2026).
• Prey, guide to Law 21.719 (in Spanish) (2026).

More in this series

• Part 1: Server security in the AI era
• What a patch can't fix: hardware vulnerabilities

Contact

If your organization wants to review its security or its obligations under Laws 21.663 and 21.719, ITLab can help. Contact us.