Skip to content
Tuesday, October 20, 2026 · Daily edition · Vol. 1, No. 29Back issue

Vol. 1, No. 29Composed Oct 21 · 04:34 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

2 critical · 2 elevated5 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

Parkview Health Patient Portal Disabled After Suspicious Activity

Parkview blocked MyChart; patching, credential rotation, and hunts needed for exposed systems.

Composed by SitRep’s AI editors from 5 sources — Breaches.net, Unit 42, The Hacker News, BleepingComputer, Tenable Blog

Breaches[.]net reports Parkview Health disabled its network after suspicious activity, taking MyChart and online doctor search offline and directing urgent care to phone or walk‑ins. The outage impacts operations across two states.

Context

This outage occurs alongside active exploitation and short‑window disclosures for widely deployed network and management products — PAN‑OS (CVE‑2026‑0257) is actively exploited and FortiSIEM (CVE‑2026‑106173) has a public PoC; PHP has emergency patches scheduled tomorrow while Oracle releases a large CPU. Organizations running GlobalProtect, FortiSIEM, PHP stacks, or Oracle products face immediate exposure and a likely blast radius that includes VPN gateways, SIEMs, web apps, and enterprise middleware.

“The through‑line: patch early, hunt broadly, rotate credentials.”
From the analysis
The move

5 things to do today

  1. Patch or upgrade PAN‑OS to remove CVE‑2026‑0257 exposure and block external GlobalProtect interfaces until validated — hunt VPN and GlobalProtect logs for anomalous sessions and post‑auth activity.
  2. Upgrade FortiSIEM to 7.5.1+ or 7.6 (or apply vendor remediation) to mitigate CVE‑2026‑106173; block and monitor gRPC on port 27918 and search for unexpected file writes or new scheduled tasks.
  3. Prepare and deploy PHP emergency patches for CVE‑2026‑109618 and CVE‑2026‑109619 at Oct 21, 14:00 UTC — inventory PHP versions, test rollbacks, and schedule immediate patch windows.
  4. Rotate credentials and secrets after patching exposed gateway or management products; force password and service account rotations where VPN, SIEM, or web app compromise is suspected.
  5. Hunt for lateral movement and persistence: search EDR for abnormal ESXi/virtualization access patterns, NetNTLMv2 exfil attempts, and unexpected privilege escalation artifacts.

On the wire

  • 2critical
  • 2elevated
  • 1moderate
  • 0low
P0Incident

Parkview Health Network Outage Disrupts Patient Services

Parkview disabled networked systems after suspicious activity, impacting MyChart and online doctor search across Indiana and Ohio; treat this as an active incident requiring containment. Confirm affected subnets, isolate compromised hosts, validate offline backups, and coordinate external patient communications and regulatory notifications as needed.

BREACHES.NET · Suspected Cyber Incident Blocks Parkview Health Patient Portal

Copy link to “Parkview Health Network Outage Disrupts Patient Services”

P0Exploit

Active Exploitation of PAN‑OS CVE‑2026‑0257 Observed

Unit 42 reports multiple actors exploiting CVE‑2026‑0257 to bypass MFA and establish GlobalProtect VPN sessions, with pivots into virtualization layers and ESXi. Patch or upgrade PAN‑OS immediately, block externally exposed GlobalProtect interfaces until patched, and hunt VPN logs for anomalous sessions and post‑auth activity.

Previously in SitRep Oct 19: Active Exploitation of PAN‑OS CVE‑2026‑0257 Enabling VPN Access · CVE-2026-0257

UNIT 42 · Active Exploitation of PAN-OS CVE-2026-0257 by Ransomware Actors

Copy link to “Active Exploitation of PAN‑OS CVE‑2026‑0257 Observed”

P1Exploit

FortiSIEM CVE‑2026‑106173 Has Public PoC for Unauthenticated RCE

A public PoC demonstrates unauthenticated remote code execution via path traversal on FortiSIEM (gRPC port 27918); FortiSIEM 7.5.1+ and 7.6 are not vulnerable. Immediately upgrade affected FortiSIEM instances to 7.5.1+ or 7.6, block/monitor gRPC traffic on port 27918, and search for unexpected file writes or new scheduler tasks.

THE HACKER NEWS · Critical FortiSIEM Flaw Gets Public PoC for Unauthenticated RCE

Copy link to “FortiSIEM CVE‑2026‑106173 Has Public PoC for Unauthenticated RCE”

P1Patch Tuesday

PHP Announces Emergency Patches for Two Critical Rces Tomorrow

PHP warned of two critical RCEs (CVE‑2026‑109618, CVE‑2026‑109619) with emergency fixes due Oct 21, 14:00 UTC; affected versions span PHP 5–8. Inventory PHP versions, prepare rollback‑tested deployment playbooks, and schedule emergency patching the minute fixes release.

BLEEPINGCOMPUTER · PHP Warns Admins of Two Critical Flaws, Patches Coming Tomorrow

Copy link to “PHP Announces Emergency Patches for Two Critical Rces Tomorrow”

P2Intelligence

Oracle October CPU Addresses 1209 Cves; Prioritize Critical Fixes

Tenable reports Oracle's October 2026 CPU fixes 1209 CVEs across 33 product families, including 112 critical ratings. Map affected Oracle products in your estate, prioritize critical patches that match your deployment, and stage updates with configuration backups and functional testing.

TENABLE BLOG · Oracle October 2026 CPU fixes 1209 CVEs across 33 product families

Copy link to “Oracle October CPU Addresses 1209 Cves; Prioritize Critical Fixes”

Vulnerabilities named in this edition

CVE-2026-0257 · CVE-2026-106173 · CVE-2026-109618 · CVE-2026-109619

Known exploited

Added 20 Oct6 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-106931EG Secure Solutions SiteGuard Server Edition20 Oct23 Oct
CVE-2026-110936Siemens Software Center20 Oct3 Nov
CVE-2026-96652Plex Media Server20 Oct3 Nov
CVE-2026-96654Plex Media Server20 Oct23 Oct
CVE-2026-96655Plex Media Server20 Oct3 Nov
CVE-2026-96656Plex Media Server20 Oct23 Oct

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

Password1 and Forgotten Test Account Hit Welsh Organizations

A test account protected by 'Password1' enabled a ransomware breach exposing data of about 3,300 people, mostly children. The ICO reprimanded two Welsh organizations over the incident rather than fining them, marking regulatory rebukes for the breach dated 2026-10-20.

3 reports

Eight eMudhra CA Keys Compromised, Emergency Fixes Across Browsers

Eight eMudhra intermediate CA keys were compromised, prompting immediate revocation and blocking by Chrome and Firefox. The certificates affected span TLS, DV/OV/EV, and code signing. Fixes across Go, NSS, certifi, and other bundles were released; Apple, Microsoft, and other trust stores issued blocks. CVE-2026-111943 appears in Go’s patch, with broader root removals and CT/CRLSet updates.

2 reports

DHS Bans DeepSeek Products Across U.S. Federal Agencies

The DHS orders federal civilian agencies to stop using DeepSeek products and remove them from systems, covering affiliates and third-party offerings built on DeepSeek tech. Motivations include concerns about Chinese government access, data collection, and potential data transfers. The action cites a NowSecure 2025 report of iOS app vulnerabilities.

2 reports

Hackers Use Autonomous AI Agents (Cairn) to Breach 1,200+ Sites

A Chinese-speaking criminal used Cairn to drive autonomous AI agents against online shops, breaching 1,200+ sites and affecting Deere, SharkNinja, and Cummins. NorForge found exposed control panels on port 8000, stray upload forms, and weak Zend Framework code. Breaches averaged under 23 hours with ~10% success. Campaign cost around $5 per task, about $5,000 total.

2 reports

AOMEI Backupper Hit by Short-Burst Supply Chain Campaign

AOMEI Backupper was compromised via short, five-to-ten minute tampering windows during an April–July 2026 supply chain campaign. The attacker delivered CrossRoad, a modified Radmin Server and ShinyRoad backdoor, using AOMEI’s promo channel to push malware, with UNC7017 behind the operations and targeting higher education, IT services, and telecoms across multiple countries.

2 reports

Ahold Delhaize Restoring Services After Cyberattack Across Europe and US

Ahold Delhaize reports phased restoration after a cyberattack; many European websites and apps are back online, with Albert Heijn home deliveries expected to resume soon. On Oct 12, systems were taken offline; stores stayed open. The company says no evidence of customer, associate, or partner data theft, notified the Dutch National Cyber Security Centre, and filed a police report.

2 reports

Ex-OpenAI Worker Accused Of Bugging Conference Room

Former OpenAI engineer Abdulrahman Alfozan was charged with secretly installing a recording device in a conference room to gather company information. Prosecutors say he planned to flee to Saudi Arabia, with his wife and son leaving the U.S. after his arrest. The device was hidden in toilet paper and connected to a TV; he faces up to five years if convicted.

2 reports

OVHcloud CLI Backdoored on GitHub to Steal Secrets

Attackers compromised OVHcloud CLI's GitHub account, modifying versions 0.11.0–0.15.0 to deploy info-stealing malware. Older 0.10.0 and latest 0.16.0 remained clean. The incident, detected 16:21 after a 14:47 release, involved a disabled GitHub release immutability setting. Affected platforms: macOS, Linux, Windows. Users should revoke secrets and perform cleanup; no CI/CD pipelines were impacted.

2 reports

Also reported

End of the Tuesday, October 20, 2026 edition.

Colophon

SitRep · Vol. 1, No. 29

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.