P0hackcients
Parkview Health Disables Network and Patient Portal
Network taken offline · MyChart and doctor search unavailable · Operations redirected to phone and walk-in
Parkview Health shut down network services and disabled its MyChart patient portal after detecting suspicious activity, causing immediate loss of online appointment and doctor-search capability across facilities in Indiana and Ohio. The outage affects patient access and front-line scheduling systems while investigations continue.
BREACHES.NET · Suspected Cyber Incident Blocks Parkview Health Patient Portal
P0Intelligence
Unit 42 Reports Active Exploitation of PAN‑OS VPN Flaw
Active exploitation · GlobalProtect access and MFA bypass reported · Cross‑sector impact noted
Unit 42 documents active exploitation of PAN-OS CVE-2026-0257 that allows remote access via GlobalProtect and can bypass MFA, creating VPN footholds and cross-organization lateral risk. The brief provides incident-response indicators and mitigation steps for affected PAN-OS appliances.
Previously in SitRep Oct 20: Active Exploitation of PAN‑OS CVE‑2026‑0257 Observed · CVE-2026-0257
UNIT 42 · Threat Brief on Active Exploitation of PAN-OS CVE-2026-0257
P1Intelligence
Unit 42 Details eMudhra Intermediate CA Private Key Compromise
Eight compromised intermediates · Major vendor revocations applied · TLS MitM risk
Unit 42 reports attackers derived private keys from eight eMudhra intermediate CAs due to insufficient randomness, enabling certificate forgery and MitM attacks; vendors have revoked the affected intermediates. The advisory calls for comprehensive PKI audits, emergency reissuance planning, and trust-store updates to eliminate lingering trust of compromised keys.
UNIT 42 · Emudhra Intermediate CA Private Keys Compromised, TLS Risk
P1Intelligence
AWS Publishes WAF Mitigations for PHP2SHELL
Temporary WAF rules · Multipart/form-data blocking · Body-size caps and rate limits
AWS Security Blog provides WAF configurations to reduce exposure to PHP2Shell RCEs (CVE-2026-109618 and CVE-2026-109619) as an interim measure, including blocking multipart/form-data, capping request body size, and rate-limiting. The guidance reiterates that WAFs reduce risk during patch windows but do not replace applying PHP vendor fixes.
Previously in SitRep Oct 22: Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
AWS SECURITY BLOG · Using AWS WAF To Mitigate PHP2Shell RCE Vulnerabilities
P2Exploit
Keycloak Exploit Enables Unauthenticated Takeover
Keycloak 26.7.2 unauthenticated takeover
Exploit-DB hosts exploit details targeting Keycloak 26.7.2 that enable unauthenticated account takeover. The report lacks CVE identifiers and impact metrics but signals immediate exposure for instances running the cited release.
EXPLOITDB · Keycloak 26.7.2 Unauthenticated Account Takeover Exploit Details
