Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
CZ’s post shows how fast a zero-day leak turns into an emergency, but it also highlights a bigger (quieter) problem in Latin America: our state institutions and local systems simply aren't built to react this fast. While global tech companies can deploy WAF (Web Application Firewall) rules or push emergency patches in hours, public institutions across LATAM are stuck in a structural talent trap.
Rigid salary caps and slow state procurement mean the region’s best reverse engineers and security researchers end up working for global remote firms instead of securing our own public infrastructure.
This leaves the region reacting to threats rather than managing them.
For LATAM, it is critical to reassess how the state hires technical talent, trains local researchers, and build real operational capacity.
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early.
Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.
Stay SAFU!
There is the impression today that all organizations and corporations must rely on both frontier models and distributed technological stacks for agentic AI.
The reality is different. Artificial intelligence is becoming increasingly accessible, and there is no exclusive need for agentic models to be confined to the sphere of frontier models.
This discussion also touches on topics that rarely make it into the public debate:
• Security: many organizations prefer to keep their information isolated from major providers for intellectual property and exclusivity reasons.
• Training & sovereignty: a model trained inside a specific ecosystem ends up understanding that ecosystem far better than a generic one.
Many of the activities an agentic model performs don’t have to depend on external commercial platforms. Functions that are currently split between frontier models and other tech services could be handled inside the organization itself, with a native AI model and execution mechanisms that stay within the company.
That’s why we created Poliversia: not just another tool, but a space for organizations to explore what agentic AI can look like when it is built and governed from within.
If this resonates, here’s a short 2-minute tour of Poliversia:
https://t.co/0VQajEXM4b
Happy to continue the conversation or walk you through it in more detail.
An invitation to those who read me:
For some time now, AI models and agents have integrated with everything, but almost always through external APIs and intermediary platforms to connect them. It's a perfectly valid approach, but it has deeper limitations, from costs to organizational security.
That's why we built Poliversia: one space where work is executed, from internal and external communication to tasks, team progress, video calls, and webinars on your own domain, not outside it.
If you lead a team and feel the work getting lost between apps, I'd like to invite you to try Poliversia with your team. You get 50% off your first 3 months, so you can evaluate it calmly, with your real work.
→ Starter, for teams of up to 6: https://t.co/TUrHvEqwXg
→ Pro, for teams of up to 20: https://t.co/S6B4LWkp0K
I read every message. If you have questions, write to me directly, or let's set up a meeting to learn more about your organization and see how we can help.
Una invitación a quienes me leen:
Desde hace algún tiempo, los modelos de inteligencia artificial y los agentes se integran con todo, pero casi siempre por APIs externas y con plataformas intermedias para conectarlos. Es un enfoque perfectamente válido, pero tiene limitaciones de fondo, desde sus costos hasta la seguridad de la organización.
Por eso construimos Poliversia: un solo espacio donde se ejecuta el trabajo, desde la comunicación interna y externa hasta las tareas, el progreso del equipo, las videollamadas y los webinars en tu propio dominio.
El objetivo: que todo funcione en sinergia y que, con el tiempo, la IA propia de Poliversia actúe desde adentro, no por fuera.
Si diriges un equipo y sientes que el trabajo se pierde entre aplicaciones, te invito a probar Poliversia con tu equipo. Durante los primeros 3 meses tienes un 50% de descuento, para que lo evalúes con calma, con tu trabajo real.
→ Starter, para equipos de hasta 6 personas: https://t.co/TUrHvEqwXg
→ Pro, para equipos de hasta 20 personas: https://t.co/S6B4LWkp0K
Leo cada mensaje: si tienes preguntas, escríbeme directamente, o hagamos una reunión para conocer más de tu organización y ver cómo podemos ayudarles.
Great news. An electric car is already halfway to being a lunar rover: no combustion, no need for oxygen, and fully software-driven control. The most recent launch of the new Tesla Roadster, with its SpaceX cold-gas thrusters, shows how close cars and spacecraft are getting. Here are three things it unlocks, and three challenges still ahead. @elonmusk
What the new Roadster unlocks:
Thrusters that work in a vacuum. The Roadster’s cold-gas thrusters carry their own pressurized gas, so unlike fans or wings, they don’t need air to work. That’s why SpaceX uses the same principle to steer rockets in space. For the first time, a car carries a propulsion system that would behave the same way on the Moon as on Earth, ready to stabilize the vehicle and help it hop over craters and rocks.
A powertrain that doesn’t need to breathe. A gasoline engine needs oxygen from the air to burn fuel, which makes it useless on the Moon. An electric motor only needs electricity. The Roadster’s battery-powered drivetrain could, in principle, run on lunar sunlight captured by solar panels, with no fuel shipments from Earth.
Autonomy as a starting point. A radio signal takes about 1.3 seconds to travel each way between Earth and the Moon, so driving a lunar vehicle remotely in real time is dangerous. The vehicle has to see, decide, and react on its own. Tesla has spent years training cars to do exactly that, and that software could become the brain of a future lunar rover.
The challenges ahead:
Thermal control. Surface temperatures swing from about +120°C in sunlight to below −170°C in darkness, and lunar night lasts about 14 Earth days. With no air to carry heat away or bring it back, the car would need radiators, insulation, and heaters to keep its battery alive through two weeks of deep cold.
Regolith. Lunar dust has never been smoothed by wind or water, so each grain is sharp, like crushed glass, and electrically charged, so it sticks to everything. Apollo astronauts saw it wear through suit layers and jam equipment within days. Every joint, motor, and seal would need special protection.
Radiation. Without an atmosphere or magnetic field, the Moon receives cosmic radiation directly. High-energy particles can corrupt memory or permanently damage circuits, so normal car chips could fail.
The first half of a lunar rover already rolls off Tesla’s production lines every day. The second half is engineering for an environment that is constantly trying to destroy it, and that’s where @Tesla and @SpaceX working together have a real advantage.
¿Checkpoint? ¿Has escuchado hablar de ella?
Es una empresa israelí líder mundial en ciberseguridad, con una presencia significativa en Colombia.
Junto al Canciller @omarbula nos reunimos con su equipo para evaluar cómo Colombia puede seguir aprovechando las soluciones tecnológicas de vanguardia que ofrecen.
La innovación israelí al servicio de la seguridad digital de Colombia.
¡Israel y Colombia, siempre unidos! 🇮🇱 🇨🇴
11/ El reporte completo, con 31 páginas, fuentes y límites, está aquí:
https://t.co/u7ZD3kYnUe
Es un análisis independiente abierto a una conversación. ¿Qué cadena de trámites les parece más urgente? ¿Qué necesita complementarse al diagnóstico?
Leeremos sus comentarios.
1/Un breve aporte independiente a la agenda de modernización del Estado y de IA que coordina el vicepresidente @jrestrp , con la asesoría de @velez_david . Dónde se pierde el tiempo en los trámites, qué hacen 12 países punteros y 10 pilotos para empezar. Hilo 🧵
10/ Sobre la IA: para que Colombia sea un país nativo en IA, el Estado necesita primero datos conectados. La IA verifica, clasifica y orienta, pero no reemplaza una regla bien diseñada ni el intercambio de datos entre entidades.
¿Por dónde empezar a simplificar el Estado en Colombia?
Segunda parte de nuestras observaciones sobre la digitalización del Estado. La primera mostró el punto de partida; esta sugiere por dónde empezar.
En Poliversia seguimos tres cadenas de trámites de principio a fin: importar un producto regulado, registrar un medicamento y crear una empresa. El cuello de botella no suele estar en un trámite aislado, sino en los pasos entre entidades.
Algunos datos:
- Registro de medicamentos: el tope legal es de 180 días; los gremios reportan 29 meses en promedio en 2025.
- Licencia de construcción: plazo legal de 45 días hábiles; el Banco Mundial mide 90 días en promedio.
- Solo cerca del 41% del territorio tiene catastro actualizado.
- El registro de importación pasó de 1 día a 3 minutos. Cuando los datos se conectan, los tiempos caen.
Diez trámites piloto, en tres niveles:
- Inmediatos: importación de productos regulados, registro de medicamentos, registro empresarial, licencia ambiental y consulta previa, y compraventa de inmuebles.
- Para grupos amplios: licencia de construcción, devolución de saldos a favor en la DIAN y convalidación de títulos.
- De alto volumen: trámites de tránsito, y certificados y antecedentes.
Cinco pasos posibles, en orden:
1. Una identidad digital común.
2. La regla de una sola vez: ninguna entidad pide un documento que otra ya expidió.
3. Las diez cadenas piloto, empezando por las cinco críticas.
4. Un plazo para que las entidades se conecten a la capa común de intercambio de datos.
5. Respaldo y pruebas de continuidad antes de conectar cada sistema.
La inteligencia artificial rinde más cuando los datos ya están conectados.
Varias de estas cadenas coinciden con las que ha señalado el vicepresidente @jrestrp. Las dejamos como aporte a esa agenda y al trabajo de @velez_david en transformación digital.
¿Cuál de estos diez trámites pondría usted de primero?