Today’s vibe: the internet keeps handing attackers “helpful” data paths, then acting surprised when those paths become exits for patient records, student PII, and remote code execution.

Today's Top 5

1. Quest patient records exposed: Quest says an intruder accessed its Quanum LSM test-order and results lookup system. The scope is still being nailed down, which is exactly when partners start asking awkward questions. Source
2. Millions of CA student files copied: A nonprofit tied to California schools had sensitive student data accessed and copied repeatedly for months. The part to watch is what the attacker did with that time window before discovery. Source
3. Node2Shell Brotli RCE: Node.js shipped fixes for a Brotli decoder out-of-bounds write that can lead to remote code execution. If any service decompresses attacker-controlled Brotli, this one lands in your incident backlog fast. Source
4. PHP2Shell PoC appears: A working proof-of-concept is circulating for the critical PHP RCE pair. The operational problem is not patching PHP, it is finding every place PHP is hiding behind “it’s just a small site.” Source
5. SBI dark web leak claim: State Bank of India says it was alerted to data allegedly for sale on the dark web and is investigating authenticity and source. Watch for whether this becomes credential-stuffing fuel at scale. Source

Why today matters: The common thread is “legitimate workflow, illegitimate caller.” Lab portals, student data stores, and compression libraries all assume input is sane because it usually is. Attackers are betting your org chart still treats these as someone else’s problem: vendor platforms, nonprofits, and language runtimes slip between teams, then become your breach headline.

XERJ Corpus Hub: Working the Node2Shell situation (CVE-2026-111497)? An AI agent loading nuclei-templates can draft an internal-only check for exposed Brotli decode paths and help your team quickly prioritize which internet-facing services actually process attacker-controlled Brotli. Then grab another corpus at hub.xerj.org.

Ok, let’s sort the wreckage into buckets.

Data Breaches

1. Quest Diagnostics discloses Quanum LSM intrusion: Quest reported unauthorized access to its Quanum Lab Services Manager system used by certain clients to place test orders and retrieve results. Quest says it believes “certain patient records” may have been accessed and is still determining scope and impact. Source: Fierce Biotech
2. California student PII stolen in nonprofit breach: Reporting says sensitive student information for current and former California public school students was accessed and copied over an extended period before detection. The exposure reportedly includes high-value identity fields that can power long-tail fraud and targeted harassment. Source: TechRadar
3. State Bank of India investigates alleged dark web data leak: SBI disclosed it was alerted by its threat intel provider and Indian authorities about data allegedly leaking on the dark web. The bank says it has triggered response processes and hired forensics, but does not yet know if the dataset is authentic or how it was obtained. Source: TechRadar
4. Nikkei confirms millions of records stolen: Nikkei acknowledged millions of records were stolen after describing it as a third breach in a month. The story to watch is whether identity data from repeated incidents gets merged into a single “super-dataset” for fraud and phishing at scale. Source: IT Pro

Security Research

1. Node2Shell analysis of Node.js Brotli RCE: Imperva published technical analysis of CVE-2026-111497, describing how malformed Brotli input can trigger memory corruption and potential remote code execution. This is the kind of bug that turns “compression for performance” into “decompression for incident response.” Source: Imperva
2. Node.js ships October security releases: The Node.js project published its coordinated security release covering multiple issues, including the Brotli decoder out-of-bounds write. If you run Node in containers, don’t forget the base image pin can silently preserve the vulnerable runtime. Source: Node.js
3. Public PoC reported for PHP2Shell CVEs: Sophos notes a proof-of-concept exploit has been reported for the critical PHP vulnerabilities and tracks community reporting around the release. For defenders, the race is inventory and patch coverage, not arguing about how the embargo broke. Source: Sophos
4. PHP emergency patch warning and version impact: BleepingComputer covered the PHP team’s warning about the two critical flaws and the accelerated release timeline. The practical risk is sprawling: legacy PHP versions, vendor appliances, and “temporary” apps that became permanent. Source: BleepingComputer
5. Patch diffing turns fixes into attacker roadmaps: Terra Security research (via IT Pro) argues attackers are using patches themselves to map exploitable bug patterns, and the rate of broken fixes has increased. Translation for CISOs: “patch and move on” is not a complete control when patches are noisy and often incomplete. Source: IT Pro

Top CVEs

1. CVE-2026-111497: Node.js Brotli decoder out-of-bounds write that can permit remote code execution when decoding malformed Brotli input. Patch the Node runtime across supported release lines and confirm container base images are rebuilt. Source
2. CVE-2026-109618: One of the PHP2Shell critical PHP core vulnerabilities enabling remote code execution. Treat as an internet-wide scan magnet, especially where PHP is embedded in appliances and vendor stacks. Source
3. CVE-2026-109619: The second PHP2Shell critical PHP flaw, also leading to remote code execution. The messy part is proving patch coverage across forks, distro packages, and “custom compiled once” servers. Source
4. CVE-2026-106173: Fortinet FortiSIEM unauthenticated path traversal leading to remote code execution, with public proof-of-concept activity called out in recent threat summaries. If FortiSIEM sits on a management network, assume the attacker wants to pivot into everything it monitors. Source
5. CVE-2026-101767: Oracle E-Business Suite SQL injection referenced in current daily security briefings. If you have legacy ERP with web exposure, this class of bug tends to show up right next to “we never rotate that service account.” Source

Podcasts & Talks

1. ISC Stormcast for Thursday, October 22, 2026 (SANS ISC): A quick daily brief that tracks what defenders are triaging right now. Useful for CISOs as a “what will my team be paged about this morning” reality check. Listen: SANS ISC
2. Darknet Diaries episode (Oct 20, 2026): A follow-up episode with a physical pen test gone sideways, and the aftermath. It’s a good reminder that response plans have to cover non-digital escalation, too. Listen: Darknet Diaries

Final Words

The uncomfortable pattern today is that “core business data” is no longer sitting in one crown-jewel database. It is distributed across portals, third-party platforms, and runtimes, then stitched together by workflows. Attackers don’t need to crack the whole enterprise if they can crack a single workflow that already has the data pre-joined for them.

This week, do three things:

• Patch Node.js everywhere for CVE-2026-111497, then rebuild and redeploy any container images that vendor-lock an older Node runtime.
• Run an urgent PHP inventory and patch sweep for CVE-2026-109618 and CVE-2026-109619, including vendor appliances and “forgotten” customer microsites.
• Review external-facing lab, results, and client portal integrations, and require step-up auth plus anomaly alerts for bulk lookup and export behavior, using the Quest Quanum LSM scenario as the tabletop.

Your turn: If a partner portal that your customers rely on was breached tomorrow, do you already know which downstream clients would demand an answer in the first two hours, and who owns that call? Hit reply with your take, or drop a comment on the web version. I read every reply.

Know someone running Node services that decompress user-supplied Brotli, or who is not sure if they are on a vulnerable build? Forward them this issue and tell them to start with CVE-2026-111497. It costs 30 seconds and the alternative costs a lot more. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!