1. Quest Diagnostics Confirms Patient Data Stolen in Quanum Platform Breach Quest Diagnostics disclosed in an SEC 8-K filing that attackers accessed its Quanum lab-ordering platform and took protected health information, including patient records. The company has not said how many patients are affected or when the intrusion began. Quanum serves roughly half a million […]
Vendors Are the Weak Link in Kentucky Election Security
Kentucky Election Security is generally strong. Voting machines are well guarded; county offices should focus this week on the outside companies, email accounts, and related records. On August 7, a company that trains and registers poll workers for Wake County, North Carolina, told county officials that a hacker had obtained a password the company used […]
Cyber Security Weekly Roundup: Week of October 19-25, 2026
Top 5 Cyber Security News Stories 1. PHP2Shell: Two Critical PHP Flaws Under Active Exploitation Two CVSS 9.2 vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP core allow pre-authentication remote code execution across every PHP 7.x and 8.x release, regardless of CMS or framework. Exploit attempts began before public disclosure, forcing the PHP Foundation to move its […]
Subscription Bombing Turns Small Business Signup Forms Into Weapons
A crash course in subscription bombing. Over the past several weeks, the Commonwealth Sentinel website’s contact form has received a steady stream of submissions with the same odd fingerprints. The name and company never match the Gmail address, the phone number always begins with (202) 555, the visitor always says they heard about us on […]
Cyber Security Weekly Roundup: Week of October 12 to 18, 2026
1. Ivanti Connect Secure Zero-Day Gives Attackers Root Access, CISA Orders Immediate Patching A high-severity authentication bypass in Ivanti Connect Secure (CVE-2026-104935) has been exploited since early October, with Volexity tracking a threat actor that chained it with two other flaws to gain unauthenticated root-level code execution. CISA added the flaw to its Known Exploited […]
Phishing Ends With a Click, But Starts With a Leadership Failure
When an Employee Clicks a Phishing Link, the Failure Started Higher Up In August 2022, the City of Lexington discovered that criminals had intercepted its email with the Community Action Council. They used that access to steer about $4 million in federal rent assistance and housing funds into their own bank accounts through three wire […]