Telecoms and ISPs, October 2026

Monthly reference modules

These modules are completed automatically with the verified dated facts within the period. Each one states its source basis and counting criterion, so the figures reconcile across modules. They are the recurring month-to-month readout; the later analysis develops the cases without repeating this summary.

Indicator window: 49 dated facts in October 2026. Facts from prior months are used only as comparative context in the analysis, never as volume for this period.

Executive Summary for the Month

October 2026 pointed more to operational stress than technical novelty for telecoms and ISPs in Latin America: 49 verified incidents, 17 unclassified incidents, one ransomware or extortion case as the main thread, and 3 critical CVEs mentioned. The month was defined by outages, service degradation, and regulatory responses, with a medium risk reading driven by volume, geographic spread, and a mix of connectivity failures, exposed services, and pressure on public and private infrastructure.

Most of the events did not confirm a cybersecurity cause. That point matters. There were cuts and degradations in Argentina, Bolivia, Colombia, and Uruguay that remained in the realm of technical observation or user reporting, with no firm attribution to attacks. There was also a single ransomware reference with unverified impact at MCM Telecom and an additional mention of a possible compromise of VTR, both without enough public evidence to elevate them to confirmed incidents. At the same time, the region saw clearer regulatory and mitigation activity than in previous months.

The most consistent defensive episode was the PHP family, with two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which triggered alerts from CISA, CERT-EU, national CSIRTs, and security vendors. For the telecom vertical, the issue is not only the software itself, but the number of internet-facing services that depend on web stacks and administrative portals that often sit alongside network operations, customer support, and infrastructure management.

Chile accounted for another important block, this time around compliance and control of the access ecosystem. Subtel ordered the blocking of nearly 2,000 sites linked to pirate TV and instructed several ISPs to carry out the restrictions. This was not a cyberattack, but it was a technical governance action with direct impact on connectivity networks, DNS, filtering, and coordination with providers. In the same country, there was also a report of a ransomware attack that affected IaaS platforms at the Ministry of the Interior and Public Security, expanding the risk perimeter beyond pure connectivity.

Brazil ended the month with two different signals. On one side, NETSCOUT telemetry and reports from specialized media confirmed that wireless telecommunications remain among the most heavily targeted by DDoS. On the other, CTIR Gov's advisory on the critical vulnerability in Cisco Catalyst SD-WAN Manager reinforced the problem of exposed network equipment. The month did not show a documented phishing or fraud pattern in this area, but it did show continued pressure on infrastructure, service management, and exposed public applications.

Regional snapshot for the month

October’s regional signal was medium risk, shaped more by verified outages and degradations than by confirmed intrusions. The volume was high for a single month in this vertical, and the geographic spread, which reaches at least six documented countries or subsegments, calls for reading the period as a mix of operational failures, technical exposure, and regulatory measures. There was no clear wave of fraud or phishing documented in the material, but there was a persistent base of critical vulnerabilities and unstable availability.

The risk reading does not rise to high because many of the events lack direct attribution to a cyberattack. However, the absence of confirmation does not mean there was no threat. In telecommunications, cuts, degradations, and BGP visibility issues can be signs of technical incidents, operational errors, or malicious activity, and October’s material leaves several cases in that ambiguous zone. That ambiguity, in itself, is a signal for network teams, CSIRTs, and regulators.

The geographic pattern was uneven. Chile contributed a regulatory block and a ransomware case tied to the public sector. Bolivia showed a mix of BGP degradation and a nationwide mobile service outage at ENTEL. Argentina added two connectivity outages reported by Voidly and an availability incident around EdgeUno. Colombia recorded a significant connectivity drop. Uruguay appeared in the mass PHP exposure and in a preventive response episode. Brazil concentrated DDoS pressure and the network software alert. Mexico, although not included through pure connectivity in all the events, also added signals involving MCM Telecom, Telmex, and service failures at Telcel and other networks.

The combination of unclassified incidents and critical CVEs points to a mixed attack surface, where service continuity depends as much on backbone and interconnection status as on patching exposed software and disciplined incident response. The month also showed greater involvement by authorities, whether to inspect, order blocks, or require mitigations. That leaves a clear operational takeaway: ISPs and telecom operators are dealing not only with availability, but also with compliance, reputation, and third-party dependence.

Period indicators

The table above reproduces the indicators provided and their exact basis. There is no aggregated telemetry in this count, and the unclassified incidents include both outages and breaches whose origin was not proven in the material reviewed. The comparison with September suggests that October was more intense in availability and less intense in confirmed ransomware.

Relevant incidents

ENTEL Bolivia and the nationwide outage on October 21

ENTEL was at the center of Bolivia’s clearest operational event of the month. The ATT said it detected a service interruption or degradation on October 21 and opened an inspection to verify the cause and continuity. The company itself described a temporary degradation in mobile voice and mobile internet, followed by restoration, but did not attribute the origin of the event.

The significance of the case lies not only in its scope, but in the institutional sequence. When an operator reports a temporary failure and the regulator launches an inspection the same day, the incident stops being a simple technical anomaly and becomes a public service oversight issue. That puts pressure on continuity, transparency, and proof of cause. It also requires separating a temporary degradation from a total outage, because the available evidence describes degradation and restoration, not a confirmed prolonged collapse.

In the same country, another record dated a BGP visibility degradation on October 16. Telecom Observer reported about 35 minutes of impact, with the clarification that there were no signs of a widespread data-plane outage. That distinction matters. In connectivity networks, impaired BGP visibility does not automatically mean service failure, but it can point to routing, convergence, or announcement-segmentation problems. The coexistence of both events in the same month suggests a delicate operational stability surface.

Chile: mass pirate TV blocking and ransomware on state IaaS

Chile presented two different signals. The first was regulatory. Subtel ordered GTD, DirecTV, Entel, WOM, Mundo, ClaroVTR, Netline and Movistar to block URLs associated with illegal IPTV and streaming services, with a five-day deadline. The authority tied the measure to digital security and data protection, and later coverage said 1,954 URL had been blocked by October, 765 of them in October.

That case does not describe a classic cybersecurity incident, but it does represent a significant technical intervention for ISPs and telcos. Blocking domains, IPs, and URLs requires operational coordination between the regulator and providers, along with traceability over what is restricted and how it is enforced. In network management terms, the episode shows that ISPs are compliance actors, not just transport providers.

The second Chilean signal touches the security perimeter more directly. CSIRT Telconet reported that the Ministry of the Interior and Public Security was alerted by GTD about a ransomware attack that affected its IaaS platforms. The source does not describe the scope of encryption, whether exfiltration occurred, or which systems were affected. For that reason, the event remains categorized primarily as ransomware, but the impact assessment is still incomplete.

The coexistence of both events in Chile is useful for reading the month: on one hand, the country is pushing controls on illegal traffic and content; on the other, it is exposing state infrastructure hosted on services that depend on connectivity or cloud providers. That places ISPs and infrastructure operators in a critical intermediary role, where compliance, hosting, and security can no longer be treated separately.

Argentina: connectivity outages and questions around EdgeUno

Argentina contributed three pieces that together describe an unstable month, though not one that is conclusive from a forensic standpoint. Voidly recorded two connectivity outages, one on October 21 with a critical alert for Santa Cruz and another on October 25 with an observed window between 11:05 and 16:20 UTC, with a related critical alert for Río Negro. In both cases, the source did not confirm a cause or the provider affected.

Added to that was a NextDNS Community report about an EdgeUno point of presence in Buenos Aires that reportedly became unreachable for about 33 seconds every 15 minutes from several Argentine networks. The post suggested a possible periodic cause, but it did not confirm an attack or an ISP failure. This type of observation is useful for early detection, but it is not enough to classify a cybersecurity incident. The material points to degraded accessibility, not a proven intrusion.

The data on Personal, the mobile brand of Telecom Argentina, adds noise but no certainty. A clandestine forum actor said they had published about 129,000 records attributed to customers, with personal and technical data, although the post made clear that the claim had not been independently verified and did not confirm a breach. Editorially, this is not treated as a confirmed leak. It does serve as an intelligence signal that, if verified, could change the reading of the month for the operator.

Colombia and PHP exposure

Colombia appears in October through a technical alert, not a confirmed operator outage. IODA recorded a significant connectivity drop between 00:30 and 01:10 UTC on October 22, with a critical alert for Casanare, but without attribution to a cyberattack or identification of the responsible ISP. The event remains an unclassified connectivity incident.

The other signal is the most relevant one for the region’s ISP and telecom ecosystem. ColCERT issued alert AL-20261021-123 on two critical PHP vulnerabilities that allowed unauthenticated remote code execution. Coverage explained that 8,699 PHP services were exposed to the internet in Colombia, 7,659 of them on internet and telecom provider networks, though no operational ownership or observed compromises were confirmed. The figure does not prove intrusion, but it does show a major exposed attack surface within the vertical.

The implication for ISPs and telcos is clear: PHP exposure does not usually stay within development teams. It can reach customer portals, administrative panels, self-service systems, landing pages, and internal tools used by providers or integrators. When a CSIRT issues the alert and the inventory shows thousands of exposed services, the problem stops being a single patch and becomes a matter of critical asset prioritization.

Uruguay: preventive response to PHP

Uruguay spent the month in a preventive posture. CERTuy published an alert on CVE-2026-109618 and CVE-2026-109619, which led to preventive measures including the temporary disconnection of government portals. The source says exploitation in Uruguay was not confirmed. The event is not a breach, but it is a concrete operational response to potential risk.

The value of this case lies in the response. Rather than waiting for proof of exploitation, the country took containment measures on public services. At the same time, a survey cited by El Observador said around 1,500 servers were still vulnerable in Uruguay, although with no confirmed attacks. That mix of alert, temporary disconnection, and remaining exposure sends an uncomfortable message for any vertical with extensive web infrastructure: the issue is not only patching, but knowing what is exposed and how critical it is.

IPinfo added another signal that should not be confused with a cybersecurity incident, but does point to unusual network behavior. It observed that almost all ANTEL addresses in the south and east stopped responding to its checks for about two and a half hours, even though the network continued advertising routes to the rest of the internet. It also recorded a brief interruption of a regional ISP in Brazil. Again, the material does not allow a cause to be assigned, but it does confirm observable instability.

Brazil: DDoS, SD-WAN, and degraded SMS

Brazil combined volume, exposure, and pressure on messaging services. TELETIME and TI INSIDE, using NETSCOUT data, reported that wireless telecommunications concentrated 141,400 DDoS attacks in the first half of 2026, while wireline operators recorded 27,967. Although those figures belong to the half-year rather than to the month itself, October’s material uses them as a trend signal for Brazil’s telecom sector.

The editorial relevance of the data lies in the target type. Wireless networks appear as the segment with the highest DDoS volume, reinforcing a familiar hypothesis, now backed by period material: the mobile connectivity layer and its associated services remain an attractive target for saturation and disruption. This is not evidence of a specific October attack, but operational context that helps interpret other events in the month.

In parallel, CTIR Gov published an alert on a critical vulnerability in Cisco Catalyst SD-WAN Manager, identified as CVE-2026-76504. The flaw allows an unauthenticated remote attacker to bypass API authentication and gain administrative access. For operators and providers with SD-WAN deployed, the issue is not theoretical, it involves a network management component that may be exposed or integrated into customer critical infrastructure.

The country also saw degraded Twilio SMS delivery to Surf Telecom and another degradation affecting a subset of numbers across multiple Brazilian networks. In both cases the cause was not publicly disclosed. This is not a traditional telecom breach, but it is a clear example of dependence on third-party messaging services for the end-user experience. When a CPaaS or messaging provider slows down, the impact is felt by operators even if the source is not in their network.

Mexico: physical infrastructure, compromise rumors, and service failures

Mexico left a mixed picture. On one side, there was a report of the theft of 1,000 meters of copper and fiber-optic cable, plus electronic cards, from a Telmex telephone exchange in Nopalucan, Tlaxcala. The source describes it as infrastructure theft, not a cyberattack. Even so, for an ISP or telco the potential effect on continuity, maintenance, and replacement is real. The line between physical security and technical availability was clearly exposed.

At the same time, El Fondo reported browsing and call failures on Telcel, as well as problems on AT&T and Unefon networks during the same day. The companies had not issued an official statement at the time of publication, and no cybersecurity cause was confirmed. The incident remains in the gray area between operational disruption and user complaint. For the month’s reading, that is exactly why it matters: it shows how quickly a service degradation can turn into reputational noise before any public diagnosis exists.

Mexico’s ransomware dimension also remained uncertain. Imagen Radio said Qilin had exposed MCM Telecom on its leak site after the negotiation deadline expired, but it provided no company confirmation or independent forensic evidence. Added to that are the records from ransomware.mx and NinjaLabz, which also include MCM Telecom as a Qilin claim without describing the incident or validating the material. In this report body, that is treated as a leak-site mention without verified impact, not as confirmed encryption.

PHP vulnerabilities and operational reach

The PHP alerts cut across several jurisdictions and several operator types. Cisco, CISA, CERT-EU, ENISA, Akamai, AWS, Censys, Bitdefender, the Canadian Centre for Cyber Security, and New Zealand’s NCSC all agreed on the severity of CVE-2026-109618 and CVE-2026-109619. Active exploitation was mentioned by some sources, while others focused on remediation, scope, and affected versions. What matters for telecom is not only the technical detail, but the ecosystem of exposed applications built on PHP.

The combination of exposed inventories in Colombia and preventive measures in Uruguay shows that the threat was not confined to a single country. In ISP and telco environments, PHP often supports customer portals, back-office tools, billing integrations, provisioning automation, and support sites. An unauthenticated RCE at that layer can quickly become a lateral entry point. That is why October’s signal is not an abstract threat, but a cross-cutting exposure that operators should read alongside their web service map.