MCT CASE TRACKERTracking Sara Duterte’s impeachmentHearings, documents and disputed issues.Follow the trial → MCT CASE TRACKERTracking Rodrigo Duterte’s ICC caseCourt records, hearing dates and sourced notes.Follow the case →

LATEST COMMENTARY

View all commentary →

FIVE THINGS TO KNOW

Afternoon6-minute read

ABOUT THE OVP’S 2027 BUDGET AFTER A 16-MINUTE SENATE HEARING

The Office of the Vice President’s proposed budget moved through a Senate panel today in 16 minutes. Vice President Sara Duterte was absent; her chief of staff answered for the office. Yesterday’s MCT explainer looked at parliamentary courtesy. Today’s question is what that short hearing actually did to the spending plan, and what it left for the Senate to examine.

Read the explainer →
Afternoon6-minute read

ABOUT THE EDSA BUSWAY’S 2027 BUDGET GAP

The Department of Transportation is again asking Congress to fund the EDSA Busway. Its original ₱1.756 billion request received zero in the administration’s proposed 2027 National Expenditure Program. A House budget panel later inserted ₱75 million. Those two statements describe different stages of the same budget process. Neither tells us yet what Congress will finally approve.

Read the explainer →
Afternoon7-minute read

ABOUT DECLARING AN AMBASSADOR PERSONA NON GRATA

Several lawmakers want Chinese Ambassador Jing Quan sent home. The Chinese Embassy has challenged them to follow through. That exchange leaves an ordinary reader with a reasonable question: if our own officials say an ambassador should leave, why is he still here?

Read the explainer →
7:23 AM5-minute read

ABOUT LINO CAYETANO AND THE CHANGE AT THE PCO

President Ferdinand Marcos Jr. announced on October 11 that Lino Cayetano would replace Dave Gomez at the Presidential Communications Office. He said Gomez had been bypassed by the Commission on Appointments and that the change would be formalized when they returned from Singapore.

Read the explainer →
6:10 PM4-minute read

ABOUT THE DISPUTE OVER CHANGING THE ORDER OF IMPEACHMENT WITNESSES

The argument at Thursday’s impeachment hearing was about which witness the prosecution could present next. It began with an absent lawyer and became a dispute over preparation and notice. Understanding the exchange helps explain why a courtroom can pause even when the parties, documents and another potential witness are already in the building.

Read the explainer →
3:01 PM3-minute read

ABOUT MARK VILLAR’S MOVE TO THE SENATE MAJORITY

Senator Mark Villar has formally left the Senate minority and joined the majority. The October 8 move strengthens the bloc supporting the chamber’s leadership and gives Villar two significant positions. Its implications for Sara Duterte’s impeachment trial, however, require more than counting political allies.

Read the explainer →
9:56 AM4-minute read

ABOUT THE MANAGER’S CHECKS AND THE QUESTIONS OVER SARA DUTERTE’S SALN

A bank balance can fall even when the value represented by the money has not disappeared. That distinction sits behind the prosecution’s questions about manager’s checks in Sara Duterte’s impeachment trial. To understand the October 7 testimony, we need to follow the instrument, the person entitled to its value and the declaration of assets for the relevant year.

Read the explainer →
9:08 PM3-minute read

ABOUT WHAT COA’S REJECTION OF THE OVP APPEAL MEANS

COA has rejected the request to reconsider the ₱73.287-million disallowance involving the Office of the Vice President’s December 2022 confidential expenses. The October 5 resolution became public on October 7. Its significance is easier to understand when the amount, the audit finding and the available legal remedies are kept separate.

Read the explainer →
7:47 AM3-minute read

ABOUT WHAT BANK SECRECY PROTECTS IN AN IMPEACHMENT TRIAL

The arguments over bank records in Sara Duterte’s impeachment trial involve several protections. The privacy of a peso deposit, the protection of a foreign-currency deposit, and the confidentiality of a report sent to the AMLC come from different rules. Understanding those differences helps explain what the court has allowed and what remains in dispute.

Read the explainer →
8:43 AM8-minute read

ABOUT THE AMLC RECORDS IN SARA DUTERTE’S IMPEACHMENT TRIAL

₱4.4 billion is a figure that can dominate a conversation before anyone asks what it counts. AMLC Executive Director Ronel Buenaventura presented that approximate total in the Senate impeachment court on October 5, covering reported transactions involving Vice President Sara Duterte and her husband, Manases Carpio. He also explained that a bank correction had reduced the earlier figure of ₱6.7 billion.

Read the explainer →
6:44 PM5-minute read

ABOUT THE COINS.PH CASH-IN RESTRICTION AND WHAT USERS SHOULD CHECK

If you use Coins.ph to receive money or pay bills, a failed cash-in can disrupt plans for the day. Coins.ph has announced that some incoming peso services are temporarily unavailable following a BSP directive to improve its internal controls. Its advisory also identifies services that existing customers can still use.

Read the explainer →
12:00 PM5-minute read

ABOUT THE PROPOSED RULES ON SECONDHAND PHONES

A secondhand phone can put a useful device within reach of someone who cannot afford a new one. The problem comes when the buyer has no clear information about where it came from, what condition it is in, or who will fix it if it fails.

Read the explainer →
8:35 PM6-minute read

ABOUT THE SUPREME COURT’S DECISION ON THE IMPEACHMENT VOTE THRESHOLD

The Supreme Court dismissed three petitions on September 30 challenging how the Senate impeachment court would count the votes needed to convict Vice President Sara Duterte. The dismissal leaves the Senate’s September 23 ruling in place, but it needs to be read carefully. A case can be dismissed because it does not meet the requirements for the Court to hear it, without settling whether the challenged action is constitutional.

Read the explainer →
6:12 AM6-minute read

ABOUT WHAT BASTE DUTERTE SHOULD HAVE CHECKED AS MAYOR

Davao City Mayor Sebastian “Baste” Duterte told the Senate impeachment court on September 29 that he had been unfamiliar with GenCorp Industries Inc. before it came up in the proceedings. He also said he did not know about Vice President Sara Duterte’s declared business interest in the company.

Read the explainer →
10:45 PM7-minute read

ABOUT THE OCTOBER WATER-RATE INCREASES

Metro Manila households served by Maynilad and Manila Water will see slightly higher water charges beginning October 1. The announced increases are small for many residential customers, but the figures vary by concessionaire and consumption level. That makes it easy to misunderstand a notice expressed only in centavos per cubic meter.

Read the explainer →
7:21 AM6-minute read

ABOUT THE NOTE HANDED TO GIBO TEODORO IN SEOUL

Defense Secretary Gilberto “Gibo” Teodoro Jr. was answering questions at the Seoul Defense Dialogue on September 8 when a man handed him a note. He read it aloud, challenged its rejection of the 2016 South China Sea ruling and objected to being interrupted that way.

Read the explainer →
9:55 AM8-minute read

ABOUT EL NIÑO AND PREPARING FOR LESS RAIN

It can be raining outside while PAGASA warns about El Niño. That can sound confusing when the immediate problem is a wet road or a flooded field. The two warnings describe different periods: the weather happening now and the rainfall conditions that may develop over the coming months.

Read the explainer →
5:30 AM8-minute read

ABOUT THE NEW ARREST WARRANTS AGAINST ZALDY CO, MARTIN ROMUALDEZ AND TWO OTHERS

The Sandiganbayan has ordered the arrest of Zaldy Co, Martin Romualdez and two other accused in the plunder case filed on September 7. By Monday evening, authorities had served Romualdez's warrant and carried out booking procedures at Cardinal Santos Medical Center in San Juan. His arrest is a confirmed development; it does not establish that his three co-accused are also in custody.

Read the explainer →
3:15 PM8-minute read

ABOUT THE PLUNDER CASE AGAINST MARTIN ROMUALDEZ

The Office of the Ombudsman filed a plunder case against former House Speaker Martin Romualdez at the Sandiganbayan on September 7 over his alleged involvement in flood-control kickbacks. The accusations have now reached the court that will handle the criminal case. Romualdez denies wrongdoing and remains presumed innocent.

Read the explainer →
1:18 PM7-minute read

ABOUT THE NEW SWS POVERTY NUMBERS

Self-rated poverty and food poverty declined in June, but the figures also show how many Filipino families remain under pressure and why lower household budgets do not necessarily mean life became cheaper.

Read the explainer →
2:02 PM11-minute read

ABOUT THE CHILDREN'S SOCIAL MEDIA SAFETY ACT

House Bill No. 9965 would bar children below 13 from having social media accounts, require parental consent for users aged 13 to 17, regulate platform algorithms, and impose fines reaching P50 million. It is still being deliberated in the House.

Read the explainer →
12:02 PM7-minute read

ABOUT THE SEALED BIR BOX

Marcos authorized the BIR to comply with the Senate subpoena. That did not open the records to the public or prove the unexplained-wealth allegation.

Read the explainer →

MCT READER PULSE · MCT-PULSE-2026-015

MCT READER SURVEY

Dapat bang ideklara ng pamahalaan ng Pilipinas na persona non grata si Chinese Ambassador Jing Quan at hilingin sa China na pauwiin siya?

Answer the survey →

This is an informal survey of people who choose to participate. It is not a scientific or nationally representative sample.

View previous survey results →
October 23, 20265-minute read

ABOUT PHP2SHELL AND THE RISK TO PHILIPPINE GOVERNMENT WEBSITES

When a government website asks for a copy of your ID, your address or your medical information, you have little choice about trusting the agency with it. You may need those records to claim a benefit or complete an application.

MCT Five Things cover about PHP2Shell risks, using a 2011 server-rack file photograph from NERSC in the United States.
Server-rack file photograph at NERSC, United States, by Chiara Coetzee, October 14, 2011 / Wikimedia Commons. This does not show a Philippine government facility or a confirmed PHP2Shell breach. Cropped and overlaid with MCT text and branding. Original photo · CC0

That is why the new warning about PHP2Shell deserves attention here. It involves two serious weaknesses in PHP, software used to run websites. Fixes were released on October 21, and security authorities have reported attempts to exploit the flaws.

The immediate questions for Philippine agencies are which of their systems use the affected software, whether those systems have been repaired, and whether anyone got in before the repair.

1

AN ATTACKER COULD GET IN WITHOUT AN ACCOUNT

PHP helps a website process requests and produce the pages people see. The newly disclosed flaws can, under certain conditions, let an outsider run commands on the server without first signing in.

That puts the computer running the website at risk. Depending on what the attacker can reach, a successful break-in could expose information, change content or interrupt a service.

The PHP Foundation confirmed that researchers had demonstrated attacks that could run code on affected systems. The PHP team released fixes for its supported versions and told operators to update.

Changing your own password does not repair this software problem. The people running the website and its hosting service have to do that work.

WHAT TO WATCH

Look for confirmation that agencies and their contractors have checked the software behind their websites, including services that accept applications or store personal records.

2

A SECURITY WARNING DOES NOT PROVE A WEBSITE WAS HACKED

In its October 22 update, Singapore's Cyber Security Agency reported widespread attempts to exploit PHP2Shell. That is evidence of attackers trying, not proof that every attempt succeeded.

The official advisories reviewed for this article do not identify a Philippine government website confirmed to have been breached through these flaws.

A website going offline does not settle that question either. It may have been taken down for repairs, or it may have another problem. Likewise, a page that still opens normally tells visitors very little about the security of the server behind it.

Agencies should say what they have checked and what remains under investigation. Readers should be cautious about posts declaring a government-wide breach without evidence.

WHAT TO WATCH

Check whether an announcement describes a possible weakness, an attempted attack or confirmed unauthorized access. Those are different findings, and the public response should match the evidence.

3

PERSONAL INFORMATION CAN BE EXPOSED EVEN IF THE MAIN DATABASE IS INTACT

PhilHealth's September 2023 ransomware attack is a separate, documented example.

In its October 2 notice that year, PhilHealth said its main database remained intact, while data on some servers and local workstations had been compromised. It believed the affected information included names, addresses, birth dates, phone numbers and PhilHealth identification numbers.

That incident is not being linked to PHP2Shell.

It shows why a statement about one database cannot answer every question about people's records. Copies may be held elsewhere. After a breach, an agency should explain which systems were affected and what information they contained.

For someone who submitted an ID or a medical document, being told that the website is back online does not answer whether their information was exposed.

WHAT TO WATCH

Look for notices naming the types of records affected and the people who may need help. A broad assurance that a database is safe should not replace those details.

4

THE FIX HAS TO REACH THE SOFTWARE BEHIND THE WEBSITE

Updating a website's appearance will not solve a flaw in the software running it. The hosting team has to install the corrected PHP release or the equivalent security fix supplied by its software vendor.

The PHP team says temporary measures cannot make an affected installation fully safe. Its advice is to update.

The check also extends beyond the main website. Singapore's advisory tells organizations to inspect third-party applications and components, because those may use PHP even when the main site does not.

For Philippine agencies, that means asking contractors for evidence that the repair was completed. It also means checking for signs of earlier unauthorized access. Installing a fix does not establish what happened before it was installed.

WHAT TO WATCH

Agencies should provide a clear repair status and any changes to public services. If an application portal is temporarily unavailable, users also need a working alternative and an explanation of what happens to approaching deadlines.

5

AFFECTED PEOPLE NEED A NOTICE THEY CAN ACT ON

Under National Privacy Commission rules, mandatory notification generally applies when sensitive or identity-fraud-enabling data is believed to have been acquired without authorization, with a likely real risk of serious harm. When those conditions are met, the agency generally has 72 hours from knowledge or reasonable belief of the breach to notify the commission and affected people, subject to limited exceptions.

Outsourcing the service does not remove that responsibility.

For readers, check unexpected messages through an agency's established contact channels. Do not hand over passwords or one-time codes to someone claiming to be repairing your account.

PHLPost's September warning about fake parcel messages shows how scammers impersonate government services. A familiar agency name in a text message is not enough reason to trust its link or payment request.

WHAT TO WATCH

A useful notice should explain what happened, what information may be affected, what you can do and where to get help. Save any notice about your account and verify follow-up instructions before acting on them.

BOTTOM LINE

PHP2Shell gives government agencies a specific security problem to check and repair. We should expect evidence of that work, without inventing a list of Philippine websites that have supposedly been hacked.

People using government services should not have to understand server software to find out whether their records are safe. Agencies should explain what they know, what they are still checking and what affected users need to do.

GOOGLE PREFERRED SOURCES

FOLLOW MCT ON GOOGLE

Google’s Preferred Sources feature lets you choose publications you want Google to prioritize for you. Select “Add to Preferred Sources” to make MCT easier to find in Top Stories and other eligible Google results. This does not subscribe you to email.

← Back to MCT home

SUPPORT MCT

HELP KEEP INDEPENDENT POLITICAL WRITING GOING.

Morning Coffee Thoughts is reader-supported. Contributions help pay for research tools, hosting, and the work required to verify and explain each development.

Monthly PayPal subscription — choose your support amount.Subscribe monthly through PayPal

PayPal automatically charges your chosen amount every month until you cancel the subscription in PayPal.

Send support through GCash or Maya0969 314 4839