Quest Diagnostics and Capcom Breaches Headline a Critical Patch Week for CISOs

Security leaders should note that Quest Diagnostics disclosed a cyberattack on its Quanum lab-ordering platform in an SEC 8-K filing, and CISA is urging immediate patching of two critical PHP remote-code-execution flaws tracked as php2shell. Rounding out the week: an 11.7 million-record breach at Capcom, a new Arista VeloCloud Orchestrator vulnerability added to CISA's KEV catalog, a Microsoft 365 token-theft campaign hitting 79 organizations, a ConnectWise Cloud Backup suspension, and UK plans for 14-year prison terms for undersea cable sabotage.

Quest Diagnostics discloses cyberattack on Quanum lab platform in SEC filing

Quest Diagnostics disclosed in an SEC Form 8-K that it detected a cyberattack on October 21 targeting Quanum, the lab-ordering and billing platform used by roughly half a million clinicians across North America. The company said unauthorized access included certain patient records and that it paused access to the affected system, notified law enforcement, and engaged outside cybersecurity experts. Quest has not yet said how many patients or healthcare customers were affected, and this marks its second major breach in a decade after a 2019 incident exposed 11.9 million records. (TechCrunch)

Capcom breach exposes 11.7 million CAPCOM ID account records

Capcom disclosed that a third party gained unauthorized access to CAPCOM ID account data after detecting suspicious activity on October 19. The intrusion exposed 11,774,247 records worldwide containing email addresses and account metadata such as creation date, last login time, login count, and the IP address of the most recent sign-in; 43 records also included date of birth, gender, country and nickname. Capcom said passwords were not compromised but 196 accounts had passwords changed without authorization, which the company has since reset. Payment card data was not affected. (Help Net Security)

ConnectWise suspends Cloud Backup service after Microsoft 365 access abuse

ConnectWise disclosed that attackers abused its application identities to break into customers' Microsoft 365 accounts, prompting the company to suspend its Cloud Backup service, formerly branded SkyKick. The intrusion relied on a compromised credential belonging to the Cloud Backup application rather than a flaw in customer environments, giving the attackers a trusted path into downstream Microsoft 365 tenants. The incident, reported in Help Net Security's week-in-review roundup, adds to a string of supply-chain compromises CISOs are tracking involving third-party application identities with broad cloud permissions. (Help Net Security)

CISA urges immediate patching of critical PHP2Shell remote code execution flaws

CISA issued an alert urging organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, which allow unauthenticated remote code execution across PHP installations including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The agency recommends updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and taking unpatched systems offline if immediate patching isn't possible. CISA said it had not observed successful exploitation as of publication but warned unpatched systems remain at risk, and pointed to guidance from NSA, NCSC-UK and other partner agencies. (CISA)

CISA adds Arista VeloCloud Orchestrator SQL injection flaw to KEV catalog

CISA added CVE-2026-114625, a SQL injection vulnerability in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog on October 23 based on evidence of active exploitation. The flaw can let a remote attacker reach privileged internal functionality on the orchestrator host, potentially compromising confidentiality, integrity and availability of the system and the data it manages. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on internet-facing assets that grant full control post-exploitation; CISA encourages all organizations to apply the same risk-based approach. (CISA)

Huntress tracks token-theft campaign that hit Microsoft 365 accounts at 79 orgs

Huntress researchers detailed a ten-week campaign in which an attacker replayed stolen Microsoft 365 sign-in sessions to break into email accounts at 79 organizations without ever needing a password. The intruder captured session tokens through adversary-in-the-middle phishing pages, device-code phishing and social engineering, then registered at least 48 rogue devices and swapped MFA methods at 19 organizations within three hours of the first sign-in. Hidden inbox rules hid payroll-related messages from victims in at least one case. Conditional Access policies were the only defense that consistently blocked the attacker's addresses, Huntress said. (Help Net Security)

UK proposes 14-year prison terms for undersea cable and pipeline sabotage

The UK government published a White Paper proposing prison sentences of up to 14 years for intentionally damaging undersea cables or pipelines, alongside unlimited fines for ship owners and new security obligations for subsea telecoms cable operators. The plan responds to concerns about suspicious Russian activity in UK waters, including a covert submarine operation the British Armed Forces exposed in April. Undersea cables carry around 99% of the UK's international data, and undersea pipelines deliver 74% of its gas. The proposals are open for a 12-week public consultation. (Help Net Security)