Quest Diagnostics Breach, PHP2Shell Patch Order Headline Oct 25 Briefing

Security leaders need to know that Quest Diagnostics disclosed an SEC 8-K breach of its Quanum lab-ordering system, and CISA issued an urgent alert directing immediate patching of the critical php2shell PHP vulnerabilities. Alongside those, a separate 11.7-million-record Capcom breach, a stolen-session campaign hitting 79 Microsoft 365 tenants, a second LiteLLM supply-chain compromise, new UK undersea-cable sabotage penalties, and a Houston CIO appointment round out the items worth a CISO's attention today.

Quest Diagnostics Discloses Breach of Lab Ordering System

Quest Diagnostics confirmed in an SEC Form 8-K filing that on October 21 it discovered unauthorized access to its Quanum LSM ordering system, which hospitals and clinicians use to request lab tests and retrieve results. The company said an unauthorized party "may have accessed certain patient records" and paused access to the affected platform while notifying law enforcement and bringing in outside experts. Quest has not disclosed how many patients are affected, how the intrusion began, or whether data was exfiltrated, and says core ordering operations remain unaffected. (TechCrunch)

Capcom Discloses Breach Exposing 11.7 Million CAPCOM ID Records

Capcom disclosed that a third party gained unauthorized access to customer data tied to CAPCOM ID, the account system used for the company's web services and online games. The company said attackers obtained 11,774,247 records worldwide containing email addresses and account metadata, with birthdate, gender, country and nickname exposed for 43 accounts. Capcom found no evidence that customer-set passwords were compromised but confirmed attackers changed passwords on 196 accounts, which it has reset. The company reported the incident to Osaka Prefectural Police and Japan's Personal Information Protection Commission. (Help Net Security)

CISA Urges Immediate Patching of Critical PHP2Shell Flaws

CISA issued an alert urging organizations to immediately patch CVE-2026-109618 and CVE-2026-109619, a pair of critical PHP vulnerabilities nicknamed "php2shell" that allow unauthenticated remote code execution across Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed deployments. The agency says it has not observed successful exploitation in the wild as of publication but still calls the flaws a risk if left unpatched, and directs organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take unpatched systems offline. CISA added a SIGMA detection rule and partner advisories from NSA, NCSC-UK and others on October 23. (CISA)

Token-Replay Campaign Compromised Microsoft 365 Accounts at 79 Organizations

Huntress tracked a campaign between July 14 and September 22 in which an attacker compromised Microsoft 365 accounts at 79 organizations by replaying stolen sign-in session tokens rather than passwords, recording 497 successful sign-ins and more than 200,000 failed attempts. The attacker used adversary-in-the-middle phishing and device-code tricks to capture tokens, then registered at least 48 rogue devices and swapped MFA methods at 19 organizations within three hours of first access. Hidden inbox rules hid payroll-fraud attempts from victims. Huntress says Conditional Access policies blocked a later wave of automated sign-in attempts at four organizations. (Help Net Security)

Second LiteLLM Supply Chain Attack Pushes Credential-Stealing Malware

A malicious LiteLLM release reached PyPI and Docker registries on October 21 after attackers compromised the project's release pipeline using stolen GitHub CLI OAuth tokens from three engineers' accounts. Version 1.107.0 contained compiled malware that harvested AWS, Azure, Google Cloud, Kubernetes, Git, SSH, and AI-tool credentials from any affected installation before being pulled. The package stayed on PyPI from 11:39 to 13:23 UTC, and Docker images were live roughly three hours longer. LiteLLM says the incident is contained but recommends anyone who installed the malicious version rotate every exposed credential, not just update. (Help Net Security)

UK Proposes 14-Year Sentences for Undersea Cable Sabotage

The UK government published a White Paper proposing up to 14 years in prison for people who intentionally damage undersea cables or pipelines carrying around 99% of the UK's international data and 74% of its gas supply. The plan adds unlimited fines for ship owners whose vessels damage this infrastructure, new security and resilience duties for subsea telecoms cable operators, and a national security direction power letting the Secretary of State instruct providers during a crisis. The push follows what officials describe as suspicious Russian activity in UK waters. A 12-week public consultation is now open. (Help Net Security)

Houston Names Kevin Berry CIO to Lead Citywide IT Modernization

Houston appointed Kevin Berry as Chief Information Officer, moving him from leading technology at Houston Public Works to oversee Houston Information Technology Services, a department with 319 budgeted full-time positions and a $161.4 million Fiscal 2027 budget supporting nearly 22,000 employees across 23 departments. Berry, who joined Public Works as CTO in March 2024, succeeds Lisa Kent, who retired in June after 30 years with the city, including a decade as CIO. His agenda includes replacing Houston's legacy website platform and developing an AI strategy with safeguards against exposing sensitive information, expected in early 2027. (Strategic Partnerships, Inc.)