Quest is breached; Black October passes 20 serious attacks

Quest Diagnostics suffers breach with patient data exposure

Quest Diagnostics was breached in the last 24 hours and patient data was exposed. The laboratory testing giant serves about half of US hospitals and physicians. The investigation is ongoing.

Quest's reach widens the impact: the company serves half of the country's hospitals, so the exposure may affect a large volume of patients. Health data enables fraud and creates notification obligations, with risk of fines and lawsuits.

Sources: @AndrewCurran_, @Kalshi, @DailyDarkWeb

Microsoft attributes ConnectWise attack carried out with AI agents to China

Microsoft attributed to China the supply chain attack against ConnectWise, a provider of IT management software. According to the company, the group used AI agents called ARTEX to quickly breach thousands of customers.

The attack remains active: Microsoft says the group uses the same techniques against organizations worldwide. Compromising a provider of IT management software attacks thousands of customer companies at once.

Takeaway: Vendor access concentrated in few points widens the damage of a single compromise.

Sources: TechCrunch Security, Cybersecurity Dive, The Record

High severity flaw disclosed in BIND, the most used DNS software

A high severity flaw was disclosed in BIND, described by a researcher as the most deployed DNS software on the internet. DNS converts domain names into the addresses that networks use.

DNS is basic infrastructure: if it fails, websites and internal services stop responding by name. The sources carry no CVE or fix; teams running their own DNS should follow the announcement.

Sources: @astuyve

PHP2Shell receives millions of attempts; only 0.3% of services patched

The phase changed since disclosure: attempts against PHP2Shell total millions, with attackers trying to deploy the Mirai malware. Sophos reversed its assessment of compromise: what it saw were scans and failed attempts, with no confirmed success.

Patching moves slowly: FOFA (a search engine for exposed devices) estimates 229.5 million PHP records collected in one year and only 0.329% reporting a patched version. In the US, more than 3 million potential targets.

Takeaway: A patch only protects after it is applied and verified; millions of services remain exposed days after the announcement.

Sources: @TheHackersNews, @ImposeCost, @fofabot, @zack0x01_, @sushicomabacate

Oracle publishes emergency fix for critical flaw in Java and GraalVM

Oracle released an emergency update outside the normal schedule for CVE-2026-91403, a 9.1 out of 10 flaw in Java and GraalVM. The issue affects the JSSE component, which decides how Java applications trust digital certificates.

Exploitation is remote and requires no password or user action, according to Oracle. Attacks can expose or alter sensitive data. Affected versions range from Java 8 to 27, which includes old systems still in production.

Sources: @markgadala, @The_Cyber_News

eMudhra exits the certificate business; old pip still trusts the CAs

eMudhra (a digital certificate authority from India) announced its exit from the certificate business, a new chapter in the predictable keys case. Researcher Scott Helme demonstrated that one of the company's private keys was simply the number four, instead of a random 384-bit number.

The problem reaches other environments: versions of pip, the Python package manager, earlier than 26.2.2 still trust the affected certificates. Developers need to update virtual environments, Docker images, and continuous integration servers.

Takeaway: A broken chain of trust at one vendor forces fixes in thousands of environments that do not even use it directly.

Sources: The Record, @rajkoshik

Industry speaks of Black October and assesses that AI changed the pace of attack

The industry named the month Black October: more than 20 serious incidents in three weeks, from malicious npm packages to compromised CAs (authorities that issue digital certificates). 404 Media reports fear that AI will find and exploit unknown flaws.

CrowdStrike assesses that low-skilled attackers will become far more dangerous in the next 12 months with AI agents that operate without detailed instructions. For companies, the fix cycle must shorten at the same rate.

Sources: 404 Media, Cybersecurity Dive, @cgtwts, @TGLetter

AI agent follows planted AGENTS.md file and tries to install malware

An AI agent tried to install real malware from npm by following instructions in an AGENTS.md file (an instruction file that AI agents read automatically) that the machine's owner had never seen. The block came from a security control.

Downloaded projects can contain malicious instructions that the agent executes without human review. Companies using code agents must define what they can install and require approval before execution.

Takeaway: Instructions read automatically by agents need human review before becoming execution.

Sources: @WeizmanGal

Qilin ransomware hits Coop Italia, the country's largest supermarket chain

Coop Italia, Italy's largest supermarket chain and consumer cooperative, was breached by the Qilin ransomware, according to researcher Alvieri. There is no indication of customer data theft so far.

Ransomware in food retail can paralyze stores, payments, and inventory, with losses per hour of downtime. If data had been stolen, the group would already have published it to pressure payment, the researcher assesses.

Sources: @AlvieriD

Functional Node2Shell exploit runs on official Node.js build

The Node2Shell exploit was demonstrated: researchers showed functional code running on the official version of Node.js, progress since the flaws were announced. Malformed Brotli data, a compression format used on the web, triggers remote code execution.

The demonstration raises the urgency: applications that process compressed data from untrusted sources can be breached remotely, without modifying Node.js itself. Updating and retesting Node.js environments is an immediate priority.

Takeaway: A functional exploit changes the deadline: what was theoretical risk becomes a testable breach today.

Sources: @TheHackersNews