Today’s vibe is the same old trap with a new coat of paint: the incidents that hurt the most are still the ones that interrupt real operations, and the bugs that spread the fastest are the ones hiding inside everybody’s dependencies.

Today's Top 5

1. 36,000 UNM systems claimed: UNM Health had to divert ambulances during a cyber event, then a ransomware group posted a big-number claim that doesn’t match the public recovery timeline. Source
2. 400,000 survey records, bank fields: Monitas says its Qzoo survey platform was hit via SQL injection and a database holding bank account details may be in scope. The exact leak set is still being verified. Source
3. Genesys internal LMS and CRM accessed: Genesys says an unauthorized party accessed internal business systems, and it is still working out what was downloaded, while customers brace for targeted phishing using real contact data. Source
4. PeopleSoft SSRF to RCE write-up drops: ZDI published a detailed breakdown of how CVE-2026-35273 can chain SSRF into RCE and slip past the very control admins were told to rely on. Source
5. New PHP upload-progress CVE: PHP’s CVE-2026-115560 is not getting an out-of-band patch, but it is still a sharp reminder that “weird config edge cases” become real once attackers automate the search. Source

Why today matters: The pattern connecting today’s biggest stories is “secondary truth.” Hospitals, SaaS vendors, and core web runtimes all had to communicate under uncertainty, while attackers and rumor mills filled the gaps. Your defenders do not just need patches and playbooks, they need a practiced way to publish the minimum credible facts fast, before someone else does it for you.

XERJ Corpus Hub: If CVE-2026-35273 (PeopleSoft) is on your risk register, an AI agent loading attack-flow can turn ZDI’s SSRF to RCE chain into a step-by-step attack flow, then hand your SOC a clean hunt narrative for web logs and egress in minutes. More at hub.xerj.org.

Alright, let’s get specific.

Data Breaches

1. UNM Health cyber event disrupts care, ransomware group claims responsibility: The University of New Mexico Health Sciences Center reported outages that diverted ambulances and canceled clinics. Separately, BYOD posted a claim about broad compromise that UNM has not confirmed. Source: BleepingComputer
2. Frontline Education breach notifications begin for K-12 data: Frontline says it started notifying impacted individuals tied to an August 2026 incident involving Frontline Central and School Health Management. The data elements listed include SSNs, dates of birth, and student IDs, with TransUnion services offered. Source: Frontline Education
3. Qzoo survey platform unauthorized access, ~400,000 records potentially exposed: Monitas says it detected unauthorized access on October 17, identified SQL injection-driven database viewing and updates, and took Qzoo offline. Financial fields including account number and branch name may be in the affected database. Source: Monitas
4. Genesys confirms unauthorized access to internal LMS and CRM platforms: Genesys says its customer platforms were not compromised, but internal systems holding business contact data were accessed and potentially downloaded. The scope and impact review is ongoing. Source: Genesys
5. Natsoft Corporation listed on LeakNet leak site with large data claim: A ransomware tracking index reported a LeakNet listing claiming 618 GB associated with “Natsoft Corporation.” Treat this as an extortion claim until corroborated by a victim disclosure or regulator filing. Source: Ransomnews

Security Research

1. CVE-2026-35273 (Oracle PeopleSoft) SSRF to RCE chain explained: ZDI published a deep technical walkthrough showing how SSRF can satisfy PeopleSoft’s access validation and reach RCE-capable endpoints. This is the kind of write-up that turns “patch soon” into “patch right now.” Source: Zero Day Initiative
2. HTTP2Shell/Brotli decoder flaw hunting guidance: Tanium published a hunt-focused post on CVE-2026-111497 and the practical problem of finding where Brotli decoding actually happens across fleets and products that bundle it. Source: Tanium
3. Brotli2Shell FAQ and product impact mapping: Tenable’s FAQ rounds up impacted ecosystems and fixed versions, and notes reports of attempted exploitation telemetry. Use it to drive inventory and “is Brotli even in our path?” triage. Source: Tenable
4. PHP informational advisory for session upload progress (CVE-2026-115560): The oss-security post points to PHP guidance recommending disabling session upload progress as a precaution until a regular bugfix release, and documents the unusual config preconditions needed to trigger the issue. Source: Openwall oss-security
5. Node.js ecosystem advisories cascade for Brotli RCE exposure: Vercel published a Node.js bulletin-style advisory summary for CVE-2026-111497, reflecting how cloud platforms are translating upstream decoder bugs into customer action items. Source: Vercel

Top CVEs

1. CVE-2026-35273: Oracle PeopleSoft PeopleTools remotely exploitable issue that Oracle warns can lead to remote code execution without authentication. If you run PeopleSoft, assume scanning is already happening. Source
2. CVE-2026-111497: Google Brotli decoder out-of-bounds write that can become RCE when attacker-controlled Brotli is decompressed by downstream products. The hard part is inventory, not patching. Source
3. CVE-2026-115560: PHP session upload progress edge-case that can create an unlikely RCE vector under a very specific serialize_handler configuration and runtime switching pattern. The immediate mitigation is to disable session upload progress. Source
4. CVE-2026-109619: One of the PHP2Shell pair, tracked as a critical PHP memory safety issue with major web exposure; many orgs mitigated by disabling upload progress, but you still want the fixed builds. Source
5. CVE-2026-109618: The other PHP2Shell vulnerability, associated with dangerous out-of-memory handling behavior that can lead to code execution in certain deployments, especially mod_php scenarios. Source

Podcasts & Talks

1. ISC Stormcast for Tuesday, October 27, 2026 (SANS ISC): A tight daily brief that helps CISOs track which vulns are turning into operational fire drills, and which ones are just loud. Listen: SANS ISC
2. Darknet Diaries (new episode posted Oct 20, 2026): A longer-form story useful for security leaders who need to explain to non-security execs how “small physical mistakes” can cascade into legal, operational, and reputational chaos. Listen: Darknet Diaries
3. Smashing Security Episode 489 (Oct 22, 2026): A lighter listen that still lands real risk lessons about supply chain trust and user deception, the two topics that keep reappearing in every incident report. Listen: Smashing Security

Final Words

Today’s underlying pattern is the collision of two timelines: defenders investigating and attackers publishing. The uncomfortable implication is that your incident response plan is also a communications race plan, and if you do not practice that, someone else will narrate your outage for you.

This week, do three things:

• Run an emergency dependency inventory for Brotli decoding exposure tied to CVE-2026-111497 across Node.js, proxies, and any embedded libraries, then patch or disable the decompression path where possible.
• Audit every Oracle PeopleSoft footprint for CVE-2026-35273 patch status and compensating controls, and add outbound egress monitoring for odd SSRF-style call patterns from PeopleSoft hosts.
• On every PHP fleet, set session.upload_progress.enabled=0 as an immediate safety measure for CVE-2026-115560, then schedule upgrades to the patched PHP2Shell builds where applicable.

Your turn: If your hospital had to divert ambulances for two hours tomorrow, do you already know who has the authority to unplug systems, and who has the authority to say it out loud? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone responsible for a healthcare environment that still treats “endpoint-only impact” as harmless? Forward them the UNM story, because ambulance diversion is the KPI nobody wants to discover during a tabletop. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!