CISO Briefing: PHP2Shell Patch Urgency, SafePay Ransomware, eMudhra CA Risk

CISA issued urgent patch guidance for the critical PHP2Shell vulnerabilities and warned that the SafePay ransomware group has hit roughly 600 victims worldwide, making both top priorities for security teams this week. Beyond those alerts, exposed certificate authority keys at eMudhra, continued exploitation of a Palo Alto GlobalProtect flaw, and a new patient-data breach disclosure from Quest round out a busy stretch for CISOs.

CISA Orders Immediate Patching of Critical PHP2Shell Flaws

CISA issued an alert urging organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution across every PHP installation that serves web requests. The agency instructed teams to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and to take systems offline if they cannot patch promptly or still run PHP 8.1 or earlier unsupported versions. CISA said it had not observed exploitation at the time of publication but warned the flaws pose significant risk to organizations that leave internet-facing systems unpatched. (CISA)

CISA, FBI Warn SafePay Ransomware Has Hit About 600 Victims

CISA, the FBI, U.S. Secret Service and international partners issued a joint advisory on SafePay, one of the most active ransomware groups of 2026, which has affected approximately 600 victims across the Americas, Europe and Australia. SafePay actors gain access by compromising credentials and exploiting known vulnerabilities in internet-facing VPN devices, then use legitimate IT tools to move through networks, disable backups, steal data and encrypt systems. The advisory urges organizations to patch the known exploited vulnerabilities it lists and to check whether systems were compromised before remediation. (CISA)

CISA Adds Six Actively Exploited Flaws to KEV Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including four Plex Media Server flaws, an OS command injection bug in EG Secure Solutions SiteGuard Server Edition, and an uncontrolled search path vulnerability in Siemens Software Center. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control post-exploitation. CISA encourages all organizations, not only federal agencies, to adopt the same risk-based approach and remediate these six flaws promptly. (CISA)

eMudhra Certificate Authority Keys Found Trivially Guessable

Eight intermediate certificates issued by certificate authority eMudhra carried private keys so weak that researchers recovered them from the public certificates in under a second, a flaw that could let attackers forge HTTPS certificates trusted by Apple, Google, Microsoft and Mozilla. The keys, generated in a batch from April 2025, were meant to be random numbers over 100 digits long but some were as small as single digits. Chrome and Firefox blocked the certificates the day of the report, Apple followed on October 19 and Microsoft on October 20, and eMudhra says about 30,000 customer certificates need replacing. (Help Net Security)

Ransomware Groups Exploiting Palo Alto VPN Flaw Since June

Several ransomware groups, including Qilin and Inc, have been exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks' PAN-OS GlobalProtect patched in May, to breach organizations in healthcare, education, government and energy sectors. Unit 42 incident responders have investigated related intrusions since early June, finding that attackers bypass multi-factor authentication to establish VPN sessions, then use legitimate IT tools to move laterally and steal credentials before deploying ransomware. ReliaQuest assesses that exploitation is highly likely to continue over the next three months and recommends ending active GlobalProtect sessions after patching, since access gained earlier may persist. (Help Net Security)

Quest Diagnostics Discloses Breach Affecting Patient Records

Laboratory operator Quest disclosed a cybersecurity breach affecting patient records, Reuters reported on October 22. The report did not specify the scope of the incident, how the breach occurred, or when it was discovered. Healthcare and clinical-services organizations should watch for additional disclosures from Quest, including any regulatory filings, as more details about the exposed patient data and the company's response become available in the coming days. (Reuters)

Hertz Names John Koester as Chief Information Security Officer

Hertz appointed John Koester as Senior Vice President and Chief Information Security Officer, the company announced October 20. Koester previously served as Vice President and CISO at Graphic Packaging International for two years and spent more than eight years at HD Supply in cybersecurity leadership roles, including Vice President and CISO. Earlier in his career he was Director of Security Operations at Viewpost. In a LinkedIn post, Koester said he looks forward to building on Hertz's existing cybersecurity foundation. (The National CIO Review)