Cyber Security Weekly Roundup: Week of October 26 to November 1, 2026

1. Quest Diagnostics Confirms Patient Data Stolen in Quanum Platform Breach

Quest Diagnostics disclosed in an SEC 8-K filing that attackers accessed its Quanum lab-ordering platform and took protected health information, including patient records. The company has not said how many patients are affected or when the intrusion began. Quanum serves roughly half a million clinicians across North America, so the downstream exposure could be significant.

Source: TechCrunch URL: https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-during-breach/

2. CISA Confirms Active Exploitation of Critical GitLab Flaw (CVE-2026-97229)

A maximum-severity (CVSS 10.0) flaw in GitLab Community and Enterprise Editions lets an unauthenticated attacker run arbitrary code through a crafted regular expression in a CI/CD configuration. CISA added it to the Known Exploited Vulnerabilities catalog on October 29 with a remediation deadline of November 1. Fixed releases are 19.2.8, 19.3.5, and 19.4.2, and organizations should treat any unpatched, internet-facing instance as a priority.

Source: GBHackers URL: https://gbhackers.com/cisa-gitlab-vulnerability-cve-2026-97229/

3. China-Linked Warp Panda Exploited VMware ESX Zero-Day to Hide Its Tracks

rowdStrike attributes zero-day use of CVE-2026-41709, a VMware ESX logging flaw, to the China-nexus group Warp Panda, which has focused on U.S. legal sector targets. The flaw lets an admin-level attacker perform actions without audit logging, helping the group persist with tools like BRICKSTORM and SharpStorm. CISA added it to the KEV catalog, and federal agencies must patch by November 11.

Source: The Hacker News URL: https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

4. WordPress Core RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours

A remote code execution flaw (CVSS 8.1) in WordPress Core versions 4.7 through 7.1.3 abuses predictable, web-accessible staging paths during full-package upgrades. Wordfence blocked 62,969 attacks in a single day as attackers raced to win a narrow timing window. WordPress 7.1.4, released October 28, contains the fix, and site owners should update immediately.

5. Source: The Hacker News URL: https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html

Japan’s GMO Internet Faces Extortion Demand After Cloud Desktop Breach

GMO Internet shut down its Onamae Desktop Cloud service on October 21 after detecting unauthorized access, and the attackers reportedly demanded about 8 billion yen (roughly $50 million). By October 27 a suspected attacker had posted material linked to GMO and its customers, which the company is still verifying. Up to 27,000 servers may be affected, and GMO has reported unauthorized operations on customer trading accounts.

Source: TechCrunch URL: https://techcrunch.com/2026/10/27/japan-internet-giant-gmo-says-hackers-posted-stolen-customer-data/