CISA Adds Brotli, PHP to KEV; CISA 2030 Launches; Hospital, University Breaches

CISA Adds Exploited Brotli and Adobe Commerce Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value vulnerability in Google's Brotli compression library. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on internet-facing systems that grant full control after exploitation. CISA encourages all organizations to adopt the same risk-based patching approach, since Brotli is embedded widely across runtimes including Node.js, .NET and Envoy Proxy. (CISA)

CISA Adds Exploited PHP2Shell Vulnerabilities to KEV Catalog

CISA added CVE-2026-109618 and CVE-2026-109619, both exploited PHP memory-corruption and request-state vulnerabilities enabling unauthenticated remote code execution, to its Known Exploited Vulnerabilities Catalog, updating its earlier PHP alert. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed flaws on publicly exposed systems that grant full post-exploitation control. The PHP flaws, nicknamed PHP2Shell, were patched days earlier in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and administrators who have not updated should do so immediately given confirmed in-the-wild exploitation. (CISA)

CISA Unveils CISA 2030 Strategy for Critical Infrastructure Defense

CISA released CISA 2030: Defend, Harden, Prevail, a new strategy built around three pillars: defending national cyber networks, hardening critical infrastructure, and mobilizing resilience. Acting Director Nick Andersen called on every company and vendor in the critical infrastructure community to act now. The agency commits to reviewing core services within 60 days, delivering an implementation plan within 180 days, and reporting progress within 365 days, moving from passive defense toward anticipatory efforts to identify and remove adversary footholds from US infrastructure. (CISA)

Cyberattack Disrupts University of New Mexico Hospitals, Extortion Group Claims Data Theft

University of New Mexico Health Sciences Center disclosed a cyberattack that forced its hospitals to divert ambulances and cancel all clinic appointments on Monday, October 26, 2026. IT security teams worked with external partners and law enforcement to contain the incident, and hospitals reopened with appointments resuming October 27. Extortion group BYOD claimed responsibility on a leak site, alleging theft of student and employee personal data including Social Security numbers, payroll records, and Entra tenant data, though the claims remain unconfirmed. (Help Net Security)

University of Copenhagen Breach Exposes Data of 525,000 People

The University of Copenhagen confirmed that attackers who breached a test environment, detected October 20, 2026, obtained data on roughly 525,000 individuals, including names, national identity numbers, and phone numbers. The university also disclosed that PIN codes for about 20,000 staff and student ID cards were compromised, prompting reissued codes and a temporary shutdown of administrative systems including Workzone and Nimbus on October 26. UCPH reported the incident to the Danish Data Protection Agency under GDPR and says operational systems were not affected. (Help Net Security)

Fortinet Patches Critical FortiOS Flaws, Withholds Details Until November 10

Fortinet shipped security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, but is withholding vulnerability details until November 10, 2026. CISO Carl Windsor said the fixes address critical and high-severity issues found with AI assistance, some remotely exploitable without authentication, and warned that attackers can also use AI to find flaws and build exploits once patches reveal what changed. Administrators are urged to upgrade internet-facing systems now rather than wait for disclosure, since the PHP2Shell vulnerabilities released the same week do not affect these products. (Help Net Security)

Aledade Names Suyesh Karki as Chief Information Security Officer

Value-based care company Aledade named Suyesh Karki as Chief Information Security Officer, leading its Security and IT organization. Karki joins from BambooHR, where he served as CISO and built security programs covering threat detection and AI-assisted development protections, and previously led cloud security and compliance at Domo. At Aledade, he will guide security strategy for the company's growing AI and data analytics work, which touches health information for more than 3 million patients across its network spanning 46 states and Washington, D.C. (Aledade)