CISO Brief: Quest Diagnostics Breach, SafePay Ransomware, PHP2Shell Patch Push

Security leaders head into the week with a confirmed healthcare breach at Quest Diagnostics and a joint CISA-FBI warning that SafePay ransomware has hit roughly 600 critical-infrastructure victims worldwide. CISA also pushed urgent php2shell patching guidance and added an actively exploited Arista VeloCloud flaw to its KEV catalog, while eMudhra's certificate authority crisis and new UK subsea-cable sabotage penalties round out a busy stretch for risk and compliance teams.

Quest Diagnostics confirms patient data compromised in cyberattack

Quest Diagnostics disclosed in an SEC 8-K filing that it learned of a cyberattack targeting Quanum, a lab-ordering and billing platform used by roughly half a million clinicians across North America. The company confirmed attackers accessed certain patient records, including personal information and protected health information, though it has not yet said how many patients or healthcare customers were affected. Quest notified law enforcement and is investigating. The incident is the company's second major breach in a decade, following a 2019 attack that exposed 11.9 million patient records. (TechCrunch)

CISA, FBI warn SafePay ransomware has hit about 600 victims

CISA, the FBI, the U.S. Secret Service and international partners issued a joint advisory on SafePay ransomware, describing it as one of 2026's most active ransomware operations with roughly 600 victims across critical infrastructure sectors in the Americas, Europe and Australia. The group gains access through compromised credentials and known vulnerabilities in internet-facing VPN devices, then deletes backups before stealing data and encrypting systems. CISA urges organizations to patch known exploited vulnerabilities, require multifactor authentication, maintain offline backups, and segment networks to reduce the likelihood and impact of an attack. (CISA)

CISA reinforces urgent patching for critical php2shell PHP flaws

CISA updated its alert on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, which allow unauthenticated remote code execution across PHP installations including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The agency added a SIGMA detection rule and reinforced guidance to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take unpatched systems offline. While CISA has not observed successful exploitation, Palo Alto Networks has confirmed all versions of PAN-OS and Panorama are affected, and Fortinet and Cisco are still reviewing dozens of products for exposure. (CISA)

CISA adds actively exploited Arista VeloCloud SQL injection to KEV

CISA added a SQL injection flaw in Arista VeloCloud Orchestrator, CVE-2026-114625, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The bug could let a remote attacker reach privileged internal functionality and compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed vulnerabilities on internet-exposed assets that grant full control after exploitation. CISA encourages all organizations, not just federal agencies, to adopt the same risk-based patching priority. (CISA)

eMudhra exits SSL/TLS business after weak CA signing keys exposed

Indian certificate authority eMudhra exposed eight intermediate TLS and code-signing certificates whose private keys were so weak that anyone could recover them from the public certificate in under a second, according to Help Net Security. The keys, generated in April 2025 and cross-signed by Sectigo, let an attacker forge HTTPS certificates for any domain. Chrome, Firefox, Apple and Microsoft blocked the certificates within days, and eMudhra revoked them, estimating about 30,000 customer certificates need replacement. On October 22, eMudhra announced it will exit the global SSL/TLS certificate business entirely. (Help Net Security)

UK proposes 14-year jail terms for subsea cable sabotage

The UK government published a White Paper proposing prison sentences of up to 14 years for intentionally damaging undersea cables or pipelines, alongside unlimited fines for ship owners and new security duties for subsea telecoms operators. Officials cited growing threats to infrastructure that carries about 99% of the UK's international data and 74% of its gas supply, pointing to suspicious Russian activity in UK waters. The proposal would also give the government power to direct cable providers on national security grounds. A 12-week public consultation is now open. (Help Net Security)

Saint-Gobain India names Chandrashekhar Chettiar as new CISO

Saint-Gobain Group in India named Chandrashekhar Chettiar as its new Chief Information Security Officer, bringing experience from financial services and industrial IT security. Chettiar joins from Motilal Oswal Financial Services, where he served as CISO from 2022 to 2026 handling cybersecurity governance, regulatory compliance and ransomware preparedness under SEBI, RBI and IRDAI rules. He previously built a centralized IT and OT security operations center at Tata Power and led ISO 27001 certification there, with earlier CISO and security roles at IIFL, L&T Finance, Essar and Avanse. (APAC News Network)