2026-10-28 Daily Cyber News
Patient care can be interrupted long before investigators know the full scope of a cyberattack. Today’s issue examines how a University of New Mexico Health Sciences Center incident diverted ambulances, paused appointments and canceled classes before critical systems returned. It also covers confirmed exploitation of critical PHP weaknesses across widely used web infrastructure, with immediate patching and mitigation decisions for defenders. A fast-moving campaign abusing external Microsoft Teams chats shows how…
- Threat IntelligencePatient care resumes after cyberattack disrupts New Mexico health system
Patient care and teaching were interrupted after a cyberattack hit the University of New Mexico Health Sciences Center. UNM temporarily diverted ambulances, limited admissions, suspended outpatient procedures and canceled classes. It later said critical electronic systems were back online, hospitals were…
- Vulnerabilities & ExploitsWeb services face confirmed attacks through critical PHP weaknesses
Internet-facing PHP systems are under active attack through two critical memory-safety weaknesses. Successful exploitation can let an unauthenticated attacker execute code on an affected server. The flaws were added to the US government’s known-exploited list after researchers reported working remote code…
- Threat IntelligenceFake IT chats turn Microsoft Teams into a rapid malware path
Employees are being flooded with email and then contacted through external Microsoft Teams chats by attackers posing as internal IT support. More than 400 incidents followed a recurring pattern, with targets contacted in short windows and malware sometimes running in under 15 minutes. The impostors…
- Cloud SecurityShared compression bug exposes runtimes and cloud workloads to attack
A memory-corruption issue in the Brotli compression library reaches far beyond Node.js. Any application that decompresses attacker-controlled Brotli data with a vulnerable decoder may be exposed, including .NET, Python clients, proxies and data platforms. Public exploit code exists, and threat sensors…
- Vulnerabilities & ExploitsPeopleSoft attack chain turns trusted internal access into full compromise
A chained attack against Oracle PeopleSoft can turn an externally reachable integration feature into code execution on the server. Technical analysis describes three weaknesses spanning the Integration Gateway and Environment Management Hub. One issue lets an attacker make a request appear to come from…
- Government & PolicyTailscale SSH weaknesses could let one breached device spread access
Weaknesses disclosed in Tailscale SSH could let an attacker expand access after compromising an authorized device. In laboratory testing, chained issues produced root access on reachable servers and exposed keys that could add rogue devices. An automated attack moved between policy-approved servers…
- Supply Chain & Third PartyHijacked checkout script puts Brazilian shoppers’ card data at risk
Attackers compromised a shared analytics script loaded by checkout pages on stores using the Brazilian e-commerce platform Convertr. Malicious code inserted into the legitimate tracker collected payment information as shoppers completed purchases. The suspected initial vulnerability has not been…