Philippines National CERT

03/11/2026

𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗛𝗶𝘁𝗮𝗰𝗵𝗶 𝗘𝗻𝗲𝗿𝗴𝘆 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 𝗦𝘆𝘀𝘁𝗲𝗺𝘀

The National Computer Emergency Response Team of the Philippines (CERT-PH) has issued a security advisory regarding vulnerabilities in Hitachi Energy TRO600 and CoreTec industrial control and communications systems.

These systems are critical to substation communications, industrial networking, and energy infrastructure. The identified flaws allow unauthenticated access to sensitive configuration credentials (CVE-2026-106087, CVSS 8.7), bypass of network access restrictions (CVE-2026-10756, CVSS 7.7), and OS command injection leading to unauthorized device control (CVE-2026-13162, CVSS 7.7).

All Critical Information Infrastructure (CII) operators, utility engineers, and OT system administrators are strongly advised to inventory affected assets, consult Hitachi Energy advisories, rotate exposed credentials, and apply recommended security updates.

Proactive vulnerability management, network isolation, and continuous operational surveillance remain vital to defending critical infrastructure against emerging cyber threats.

𝗥𝗲𝗮𝗱 𝗺𝗼𝗿𝗲 𝗵𝗲𝗿𝗲:
https://ncert.gov.ph/vulnerabilities-in-hitachi-energy-industrial-control-and-communications-systems-cve-2026-106087-cve-2026-10756-cve-2026-13162/

You can report cybersecurity incidents to CERT-PH via:
📧 [email protected]
☎️ 8920-0101 loc. 1708 or 2378

03/11/2026

𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗟𝗶𝗻𝘂𝘅 𝗞𝗲𝗿𝗻𝗲𝗹 𝗧𝗖𝗣 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 (𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟵𝟴𝟰𝟯𝟮)

CERT-PH has issued a security advisory regarding a critical CVSS 9.8 vulnerability in the Linux kernel’s IPv4 TCP connection-handling implementation.

A race condition causing a use-after-free memory flaw could allow unauthenticated remote attackers to trigger memory corruption or execute arbitrary code with root privileges on affected Linux environments. Recent security research demonstrated AI-developed exploits targeting Multipath TCP (MPTCP) listeners, increasing the urgency of remediation.

The vulnerability affects major Linux distributions including Ubuntu, Red Hat Enterprise Linux (RHEL), Debian, SUSE, Amazon Linux, and Oracle Linux. Patches are already available for select distributions, while fixes for others remain in progress.

All system administrators, cloud engineers, and IT leads are urged to inspect their Linux deployments and apply vendor kernel patches immediately.

Proactive patching, continuous surveillance, and strong response protocols are vital to securing our systems and reinforcing digital defenses.

𝗥𝗲𝗮𝗱 𝗺𝗼𝗿𝗲 𝗵𝗲𝗿𝗲:
https://ncert.gov.ph/critical-linux-kernel-tcp-vulnerability-cve-2026-98432-potential-remote-code-ex*****on-and-privilege-escalation/

You can report cybersecurity incidents to CERT-PH via:
📧 [email protected]
☎️ 8920-0101 loc. 1708 or 2378

29/10/2026

𝗙𝗢𝗨𝗥-𝗣𝗘𝗔𝗧 𝗖𝗛𝗔𝗠𝗣𝗜𝗢𝗡𝗦! 𝗜𝗟𝗢𝗜𝗟𝗢 𝗦𝗖𝗜𝗘𝗡𝗖𝗘 𝗔𝗡𝗗 𝗧𝗘𝗖𝗛𝗡𝗢𝗟𝗢𝗚𝗬 𝗨𝗡𝗜𝗩𝗘𝗥𝗦𝗜𝗧𝗬 𝗘𝗫𝗧𝗘𝗡𝗗𝗦 𝗜𝗧𝗦 𝗪𝗜𝗡𝗡𝗜𝗡𝗚 𝗦𝗧𝗥𝗘𝗔𝗞!

Four consecutive years. Four regional titles. One remarkable legacy.

Iloilo Science and Technology University (ISAT-U) once again claimed the championship at HackForGov 2026 – Western Visayas Region (Region VI), held on 23 October 2026 at Sam's 21 Hotel, Iloilo City. With this victory, ISAT-U secures its fourth consecutive championship, showcasing the team's cybersecurity skills, teamwork, and determination.

REGIONAL WINNERS

CHAMPION: Iloilo Science and Technology University (ISAT-U)
Team: 1$4tU-1sS3TZz-CC1
Bobby Jr L. Balicbalic
Shasli B. Bansi
James Anthony S. Arcenas
Loel Joseph Z. Hofileña

1ST RUNNER-UP: University of the Philippines Visayas
Team: Popcorn Prophets
Andrian Lloyd M. Maagma
Dejel Cyrus D. De Asis
John Romyr B. Lopez
Ezra I. Magbanua

2ND RUNNER-UP: Western Institute of Technology
Team: WIT For Me
Kevin Russel S. Coquilla
Patrick Andrew E. Cortez
Carl Fritz B. Sudilla
Ace Lorenz P. Gallo

TOP INDIVIDUAL PERFORMERS
Bobby Jr L. Balicbalic – ISAT-U
James Anthony S. Arcenas – ISAT-U
Dejel Cyrus D. De Asis – UP Visayas
Carl Fritz B. Sudilla – Western Institute of Technology (Wildcard Qualifier)

The regional champion and wildcard qualifier will advance to the HackForGov 2026 National Finals, where they will take on the country's top collegiate cybersecurity talents.

Congratulations to all participating teams for demonstrating the skills and determination of the next generation of Filipino cyber defenders!

28/10/2026

The Philippines 🇵🇭 Crowned Champion at Cyber SEA Game 2026!

The Philippine Team emerged as Champion at the Cyber SEA Game 2026, held on 26–27 October 2026 in Bangkok, Thailand, competing against nine ASEAN national teams in a challenging Capture the Flag (CTF) competition.

The Team Philippines delegation was nominated through the initiative of the 𝐃𝐞𝐩𝐚𝐫𝐭𝐦𝐞𝐧𝐭 𝐨𝐟 𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐂𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐓𝐞𝐜𝐡𝐧𝐨𝐥𝐨𝐠𝐲 – 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐁𝐮𝐫𝐞𝐚𝐮 – 𝐍𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐂𝐨𝐦𝐩𝐮𝐭𝐞𝐫 𝐄𝐦𝐞𝐫𝐠𝐞𝐧𝐜𝐲 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞 𝐓𝐞𝐚𝐦 (𝐃𝐈𝐂𝐓-𝐂𝐄𝐑𝐓-𝐏𝐇) 𝐇𝐚𝐜𝐤𝐟𝐨𝐫𝐆𝐨𝐯 𝐂𝐨𝐦𝐩𝐞𝐭𝐢𝐭𝐢𝐨𝐧 a capture the flag competition for the students where their cybersecurity skills will put into test, This highlights the DICT’s commitment to developing Filipino cybersecurity talent and strengthening the country’s representation in regional cybersecurity competitions.

Congratulations to our champions for bringing pride to the Philippines and contributing to a safer digital future for ASEAN! 🇵🇭🥇

27/10/2026

𝐔𝐘 𝐏𝐈𝐋𝐈𝐏𝐈𝐍𝐒!

🏆🇵🇭 𝗖𝗢𝗡𝗚𝗥𝗔𝗧𝗨𝗟𝗔𝗧𝗜𝗢𝗡𝗦, 𝗧𝗘𝗔𝗠 𝗣𝗛𝗜𝗟𝗜𝗣𝗣𝗜𝗡𝗘𝗦! 🇵🇭🏆

A well-deserved victory for our very own 𝗔𝗦𝗘𝗔𝗡-𝗝𝗮𝗽𝗮𝗻 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗮𝗽𝗮𝗰𝗶𝘁𝘆 𝗕𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗖𝗲𝗻𝘁𝗿𝗲 𝗖𝘆𝗯𝗲𝗿 𝗦𝗲𝗮 𝗚𝗮𝗺𝗲𝘀 𝗖𝗵𝗮𝗺𝗽𝗶𝗼𝗻-𝗧𝗲𝗮𝗺 𝗣𝗵𝗶𝗹𝗶𝗽𝗽𝗶𝗻𝗲𝘀! 🎉

Justin Clark Ong- HackforGov 2025 National Champion and Top Performing Individual

Jiandale Ambal- Mindanao State University- Iligan Institute of Technology | Region 10 HackforGov 2026 Regional Champions

Audre Montero- University of Cordilleras | CAR HackforGov 2026 Regional Top Performing Individual

Glenn Gabriel Castillejo- University of Perpetual Help System Cauayan Campus | Region 2 HackforGov 2026 Regional Champions

From 𝐇𝐚𝐜𝐤𝐟𝐨𝐫𝐠𝐨𝐯 to the international stage!

These outstanding students are among the promising Filipino cybersecurity talents developed and showcased through the 𝐃𝐞𝐩𝐚𝐫𝐭𝐦𝐞𝐧𝐭 𝐨𝐟 𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐂𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐓𝐞𝐜𝐡𝐧𝐨𝐥𝐨𝐠𝐲 (𝐃𝐈𝐂𝐓), 𝐏𝐡𝐢𝐥𝐢𝐩𝐩𝐢𝐧𝐞 𝐍𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐂𝐨𝐦𝐩𝐮𝐭𝐞𝐫 𝐄𝐦𝐞𝐫𝐠𝐞𝐧𝐜𝐲 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞 𝐓𝐞𝐚𝐦 (𝐂𝐄𝐑𝐓-𝐏𝐇) 𝐇𝐚𝐜𝐤𝐟𝐨𝐫𝐠𝐨𝐯 initiative. Their journey reflects the importance of nurturing young cyber defenders, strengthening cybersecurity skills, and providing Filipino talents with opportunities to excel in national and international competitions. 🇵🇭🔐

Your hard work, dedication, teamwork, and determination have brought pride and honor to our country. You have proven that with unity, passion, and perseverance, greatness can be achieved. 💪🔥

You fought with heart, represented the Philippines with pride, and showed everyone the true spirit of a champion! 🇵🇭❤️

This victory is more than just a win—it’s a testament to your commitment, resilience, and Filipino pride.

Mabuhay, Team Philippines!🥇👏

27/10/2026

𝗙𝗟𝗔𝗚𝗦 𝗖𝗔𝗣𝗧𝗨𝗥𝗘𝗗, 𝗖𝗛𝗔𝗟𝗟𝗘𝗡𝗚𝗘𝗦 𝗖𝗢𝗡𝗤𝗨𝗘𝗥𝗘𝗗 — 𝗧𝗛𝗔𝗧’𝗦 𝗔 𝗪𝗥𝗔𝗣, 𝗖𝗘𝗡𝗧𝗥𝗔𝗟 𝗟𝗨𝗭𝗢𝗡

15 TEAMS. 10 SCHOOLS. ONE MISSION: DEFEND THE DIGITAL NATION.

The HackForGov 2026 Capture-the-Flag (CTF) Competition – Region III Qualifying Round has officially wrapped up, and Central Luzon showed up ready to compete, collaborate, and conquer!

Anchored on the theme:

“Decoding Youth Innovation, Anchoring One Nation’s Digital Defense.”

Our young cyber warriors put their skills to the test in an intense cybersecurity showdown, solving challenges, hunting vulnerabilities, and showcasing their critical thinking, creativity, strategy, and teamwork.

Every challenge solved and every flag captured proved one thing: the next generation of cyber warriors is ready to rise!

MEET THE CYBER WARRIORS WHO CONQUERED REGION III

🥇 CHAMPION: VERITAS — Nueva Ecija University of Science and Technology

🥈 1ST RUNNER-UP: CYBERFOXES ENIGMA — Holy Angel University

🥉 2ND RUNNER-UP: CYVERDARIAN REBIRTHS — La Verdad Christian College

🌟 TOP SCORERS:
Samuel D. L. Binos - CYVERDARIAN REBIRTHS | ZAMUWELLE
Renz Andrew Zuniga - VERITAS | TENDOUKEI
Francisco V. Olpindo, IV. - CYBERFOXES ENIGMA | SSECCATOOR (Wildcard)

Congratulations to all our winners and participating teams! You brought your A-game, embraced the challenges, and showed us what young Filipino cyber talent can do.

THE ROAD TO THE NATIONAL FINALS STARTS HERE!

Team VERITAS will proudly represent Region III at the HackForGov 2026 National Finals!

And there’s more! Wild Card qualifier Francisco V. Olpindo, IV. will join three other wildcard representatives from across the regions to form another team advancing to the National Finals.

But HackForGov is more than just a competition. It’s an opportunity for young talents to sharpen their skills, discover their potential, and take their first steps toward becoming the cyber defenders of tomorrow.

To all the participants, coaches, schools, organizers, volunteers, and partners THANK YOU for making this qualifying round a success and celebrating the power of youth, innovation, and cybersecurity!

Central Luzon, you’ve answered the call. The challenges have been conquered, the champions have emerged, and the journey continues!

📍NEXT STOP: WESTERN VISAYAS — REGION VI!

The cyber battle continues. The competition gets tougher. And the road to the National Finals is heating up!

SEE YOU AT THE NEXT ROUND ! THE NATIONAL FINALS ARE CALLING!

27/10/2026

𝗣𝗨𝗕𝗟𝗜𝗖 𝗔𝗗𝗩𝗜𝗦𝗢𝗥𝗬: 𝗖𝗬𝗕𝗘𝗥𝗦𝗘𝗖𝗨𝗥𝗜𝗧𝗬 𝗣𝗥𝗘𝗣𝗔𝗥𝗘𝗗𝗡𝗘𝗦𝗦 𝗔𝗡𝗗 𝗛𝗘𝗜𝗚𝗛𝗧𝗘𝗡𝗘𝗗 𝗠𝗢𝗡𝗜𝗧𝗢𝗥𝗜𝗡𝗚

The Department of Information and Communications Technology (DICT), through the Cybersecurity Bureau – National Computer Emergency Response Team (NCERT), advises all government agencies and Critical Information Infrastructure (CII) operators to strengthen cybersecurity preparedness and maintain heightened monitoring in anticipation of potential cyber threat activity surrounding November 5, 2026.

Previous monitoring recorded 38 security incidents on November 5, 2025, with Denial-of-Service (DoS/DDoS) attacks and system compromises accounting for a significant portion of observed activity. Recent threat intelligence has also highlighted critical PHP vulnerabilities, including PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which have reportedly been exploited globally.

All concerned entities are urged to review internet-facing systems, apply relevant security patches, strengthen DDoS defenses, monitor suspicious network and system activity, verify incident response readiness, and ensure the integrity of critical backups. Organizations should also assess their PHP-based applications for exposure and promptly report suspected cybersecurity incidents to DICT-NCERT.

This advisory does not confirm an imminent cyberattack against specific Philippine infrastructure. All covered entities are encouraged to remain vigilant and take proactive measures to protect essential services.

𝗥𝗲𝗮𝗱 𝗺𝗼𝗿𝗲 𝗵𝗲𝗿𝗲:
https://ncert.gov.ph/public-advisory-cybersecurity-preparedness-and-heightened-monitoring/

You can report cybersecurity incidents to CERT-PH via:
📧 [email protected]
☎️ 8920-0101 loc. 1708 or 2378

27/10/2026

𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗛𝗣𝗘 𝗔𝗿𝘂𝗯𝗮 𝗡𝗲𝘁𝘄𝗼𝗿𝗸𝗶𝗻𝗴 𝗔𝗢𝗦-𝟴 𝗮𝗻𝗱 𝗔𝗢𝗦-𝟭𝟬

On October 22, 2026, Hewlett Packard Enterprise (HPE) released a security bulletin addressing 72 vulnerabilities affecting Aruba Networking AOS-8 and AOS-10 wireless operating systems. These include critical flaws involving authentication bypass, command injection, SQL injection, and remote code ex*****on (RCE), with several vulnerabilities receiving the maximum severity score of CVSS 10.0. One notable vulnerability, CVE-2026-79855, could allow a remote, unauthenticated attacker to bypass SSH authentication and obtain administrative privileges on affected AOS-8 systems.

Government agencies, Critical Information Infrastructure (CII) operators, and organizations using affected Aruba networking devices are strongly advised to upgrade to the appropriate fixed software versions, restrict management interfaces to authorized networks, and review system logs for suspicious activity. Although no confirmed exploitation in the wild was reported in the vendor’s advisory, prompt remediation is recommended.

𝗥𝗲𝗮𝗱 𝗺𝗼𝗿𝗲 𝗵𝗲𝗿𝗲:
https://ncert.gov.ph/critical-vulnerabilities-in-hpe-aruba-networking-aos-8-and-aos-10/

For additional information, you may refer to the following references:
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
https://gbhackers.com/critical-hpe-aruba-aos-8-flaw/
https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
https://app.opencve.io/cve/CVE-2026-79846

You can report cybersecurity incidents to CERT-PH via:
📧 [email protected]
☎️ 8920-0101 loc. 1708 or 2378

27/10/2026

23/10/2026

𝗛𝗲𝗶𝗴𝗵𝘁𝗲𝗻𝗲𝗱 𝗖𝘆𝗯𝗲𝗿 𝗧𝗵𝗿𝗲𝗮𝘁𝘀 𝗧𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗣𝗵𝗶𝗹𝗶𝗽𝗽𝗶𝗻𝗲 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲, 𝗙𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗦𝘆𝘀𝘁𝗲𝗺𝘀, 𝗮𝗻𝗱 𝗠𝗼𝗯𝗶𝗹𝗲 𝗨𝘀𝗲𝗿𝘀

The September 2026 APAC & ANZ Threat Intelligence Report identified multiple cyber threats affecting or posing elevated risks to the Philippines. These include ransomware attacks targeting Philippine critical infrastructure and healthcare organizations, 28,917 compromised Philippine bank cards, and the confirmed expansion of the Vwork/Gigabud Android banking trojan to the country. The report also highlighted a 645% regional increase in compromised bank cards, a 452% surge in exposed credentials, and phishing kits capable of bypassing conventional multi-factor authentication (MFA).

CERT-PH advises organizations to strengthen ransomware preparedness, adopt phishing-resistant authentication methods such as passkeys and FIDO2 security keys, monitor compromised credentials, and enhance mobile device security. Users are also urged to avoid suspicious links and unofficial application downloads, particularly those received through SMS or messaging platforms.

𝗥𝗲𝗮𝗱 𝗺𝗼𝗿𝗲 𝗵𝗲𝗿𝗲:
https://ncert.gov.ph/heightened-cyber-threats-targeting-philippine-critical-infrastructure-financial-systems-and-mobile-users/

For additional information, you may refer to the following references:
APAC & ANZ Threat Intelligence Report, September 2026 — Primary CTI source for this advisory.
MITRE ATT&CK Framework — Enterprise and Mobile Matrices: T1486 (Data Encrypted for Impact), T1557 (Adversary-in-the-Middle), T1411 (Input Prompt), T1407 (Download New Code at Runtime), T1574 (Hijack Ex*****on Flow — DLL Side-Loading). Available at: https://attack.mitre.org/
CISA Known Exploited Vulnerabilities (KEV) Catalog — Referenced for patch prioritization guidance. Available at: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
The Central Bank of the Philippines — Circular No. 1140 and related cybersecurity guidelines for financial institutions. Available at: https://www.bsp.gov.ph
Republic Act No. 10173 (Data Privacy Act of 2012) — Notification and breach reporting obligations. Available at: https://www.privacy.gov.ph
Republic Act No. 10175 (Cybercrime Prevention Act of 2012) — Legal framework for cybercrime reporting and prosecution. Available at: https://www.officialgazette.gov.ph
NCERT/CERT-PH Incident Reporting Portal: https://ncert.dict.gov.ph

You can report cybersecurity incidents to CERT-PH via:
📧 [email protected]
☎️ 8920-0101 loc. 1708 or 2378