Stay Safe OnlineDaily cyber news

Today's briefing

Tuesday 27 October 2026

A cyberattack forces New Mexico's biggest hospital network to divert ambulances and cancel clinics, PHP2Shell attacks are confirmed to be working as CISA adds the flaws to its must-patch list, a Copenhagen university breach exposes 525,000 people's ID numbers, DreamHost forces password resets, and Microsoft and PHP rush out fixes for the Brotli flaw.

9 stories

Cyberattack forces New Mexico's largest hospital network to divert ambulances and cancel clinic appointments
Image: UNM Health Sciences Center
Outage

Cyberattack forces New Mexico's largest hospital network to divert ambulances and cancel clinic appointments

The University of New Mexico Health System diverted ambulances to other hospitals and cancelled appointments at its more than 30 clinics on Monday after what it called a cybersecurity event, temporarily leaving the state without its only Level 1 trauma centre. Staff were told to turn off and unplug their desktop computers, and several employees said messages appeared on their screens claiming that student, employee and patient data had been stolen. UNM Health says its hospitals are open again and clinics resume normal appointments on Tuesday; a ransomware gang called BYOD has claimed the attack on its leak site, but UNM has not confirmed this and the FBI is assisting the investigation.

Why it matters: Attacks on hospitals put lives at risk, not just data, because emergency patients have to be sent elsewhere. If you're a UNM Health patient, check the official UNM Health website for appointment updates, and be wary of calls, texts or emails mentioning the attack that ask for personal or payment details, as criminals often exploit incidents like this.

Sources
PHP2Shell update: first confirmed successful attacks, and CISA orders US agencies to patch by 29 October
Image: The Hacker News
Vulnerability

PHP2Shell update: first confirmed successful attacks, and CISA orders US agencies to patch by 29 October

A researcher at Perplexity who runs decoy 'honeypot' servers recorded attackers launching 35 working command shells across three of them on 24 October, using a chain of web requests that closely matched a public exploit for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). It is the first confirmed successful exploitation, although the researcher stresses the decoys used a deliberately favourable setup, so it doesn't show how reliably the attack works elsewhere. On 26 October the US cyber agency CISA added both flaws to its Known Exploited Vulnerabilities list, giving federal agencies until 29 October to patch. Censys estimates more than 32.5 million PHP services are still running affected versions.

Why it matters: The question is no longer whether PHP2Shell can be used to take over servers but how quickly attackers will scale it up. Anyone running a website or product built on PHP should update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now and check vendor advisories for appliances and software that include PHP.

Sources
University of Copenhagen breach exposes national ID numbers of 525,000 people
Image: BleepingComputer
Breach

University of Copenhagen breach exposes national ID numbers of 525,000 people

Denmark's oldest university says hackers got into one of its test environments, which held personal data on 525,000 people, including full names, Danish national identity (CPR) numbers, phone numbers and email addresses. In a later update it said PIN codes for another 20,000 staff and students were also exposed, so it has restricted access to some critical campus locations while it hands out new access codes. The university says it has blocked the attackers, has seen no sign they reached systems used for day-to-day operations, and has reported the breach to the Danish Data Protection Agency.

Why it matters: Test systems are often less protected than live ones but can still hold real personal data. Anyone who has studied or worked at the university should expect convincing phishing using their name and ID number, and should verify any unexpected request through official university channels.

Sources
Web host DreamHost forces email and FTP password resets but won't say why
Image: BleepingComputer
Breach

Web host DreamHost forces email and FTP password resets but won't say why

US web hosting company DreamHost has reset passwords for a subset of email and FTP/SFTP accounts after an incident that began on 23 October and knocked its online File Manager offline for about three days. Affected users cannot log in until their account owner sets a new password in the DreamHost control panel. Its notices also tell customers to check each mailbox for forwarding rules and remove any they don't recognise, which suggests some email accounts may have been accessed, but DreamHost has not explained the cause.

Why it matters: If you have a DreamHost email or website account, set new passwords only through panel.dreamhost.com, check for unknown email forwarding rules, and change the password anywhere else you used the old one. DreamHost says it will never email you asking for your password, so ignore any message that does.

Sources
Brotli update: Microsoft rushes out emergency .NET fixes and PHP rebuilds its Windows downloads
Image: BleepingComputer
Vulnerability

Brotli update: Microsoft rushes out emergency .NET fixes and PHP rebuilds its Windows downloads

Microsoft has released out-of-band security updates for .NET 8, 9 and 10 (8.0.33, 9.0.22 and 10.0.14) and .NET 11 Release Candidate 3 to fix CVE-2026-111497, the critical memory-corruption flaw in Google's Brotli decompression code also known as HTTP2Shell, Node2Shell or Broccoli2Shell. Apps are only exposed if they have switched on Brotli decompression, which is off by default, and .NET Framework is not affected. PHP has also rebuilt its official Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) because last week's builds bundled a vulnerable copy of Brotli. Proof-of-concept exploits are public, but no real-world attacks have been reported.

Why it matters: Because so many programs carry their own copy of the Brotli code, each needs its own update. Developers and admins should install the new .NET and PHP for Windows builds, then restart apps and rebuild containers; PHP's version number doesn't change, so check for the '-1' in the download file name.

Sources
Ukraine warns hackers are taking over Dahua security cameras through their cloud remote-access feature
Image: The Record
Threat

Ukraine warns hackers are taking over Dahua security cameras through their cloud remote-access feature

Ukraine's CERT-UA says hackers have broken into Dahua internet-connected cameras and video recorders, viewing video streams, changing settings and creating their own user accounts. The attackers appear to abuse Easy4IP, a cloud feature that lets owners reach cameras remotely using the device serial number, which follows a predictable pattern that can be guessed, even for cameras behind a firewall. They then get in with weak or default passwords or two old critical flaws, CVE-2021-33044 and CVE-2021-33045. Researchers at Hunt.io warn that rogue accounts can survive password changes and, on most firmware versions, factory resets.

Why it matters: Home and business security cameras can be turned into spying tools. If you own a Dahua camera or recorder, update its firmware, set a strong unique password, check for user accounts you didn't create, and turn off cloud remote access if you don't need it.

Sources
Hidden code planted on 953 online shops, mostly Magento, hides from security scanners
Image: The Hacker News
Threat

Hidden code planted on 953 online shops, mostly Magento, hides from security scanners

E-commerce security firm Sansec says an unknown group has infected 953 online stores, most running Magento, in a campaign active since July 2025. A small piece of code hidden in the shops' page content makes visitors' browsers ask the attackers' server what to do next, and the server checks whether the visitor is a real shopper or a security scanner so that scanners see nothing. Sansec says 471 stores were infected through the PolyShell flaw (CVE-2026-48356); what the final payload does is still unknown.

Why it matters: Malicious code on a legitimate shop can target you even though the shop looks normal. Shoppers can reduce risk by using virtual or one-time card numbers or trusted payment services where possible; shop owners should apply Adobe's PolyShell fix and check for unknown admin accounts and unexpected content blocks.

Sources
'Gheist' campaign uses stolen GitHub tokens to leak secrets from private code repositories
Image: The Hacker News
Supply chain

'Gheist' campaign uses stolen GitHub tokens to leak secrets from private code repositories

Cloud security firm Wiz says an automated campaign it calls Gheist is using stolen GitHub access tokens to add a hidden workflow to repositories that prints every secret, such as cloud passwords and API keys, into the build log in disguised form. The attackers download the log and delete the run within seconds. Wiz has found more than 13,500 planted branches from over 850 compromised accounts; GitHub's safeguard that holds suspicious runs stopped the attack in public repositories but does not cover private repositories or GitHub Enterprise Server.

Why it matters: Leaked build secrets can hand attackers the keys to a company's cloud systems. Developers should look for branches named 'ci-sync-' followed by six characters, rotate every secret a repository could read if one is found, revoke the token that pushed it, and check the owner's computer for password-stealing malware.

Sources
Alleged launderer for Cambodian crypto investment scam extradited from the Netherlands to the US
Image: The Record
Law & order

Alleged launderer for Cambodian crypto investment scam extradited from the Netherlands to the US

A 44-year-old Chinese national has been extradited from the Netherlands and appeared in a California court, accused of laundering money for scammers working from scam centres in Cambodia. Prosecutors say the scammers contacted victims through social media, calls, texts and dating sites, persuaded them to invest in fake digital asset services, and moved at least $36.9 million from at least 174 US victims through a bank account in the Bahamas before converting it to cryptocurrency. He is the ninth person charged in the case and faces up to 20 years in prison if convicted.

Why it matters: These 'investment' scams often start with a friendly message from a stranger online and use fake screenshots to show your money growing. Be very wary of anyone you've met online who encourages you to invest in crypto, and never send money to a platform you can't independently verify.

Sources