The last 48 hours are a reminder that “security incident” is a spectrum. One end is a regulator with a checkbook. The other end is a single malformed packet that turns infrastructure into a shell.

Today's Top 5

1. 225,370 patients, $700,000 OCR check: HHS OCR just monetized a 2020 phishing incident into a modern playbook for risk analysis, unique IDs, and offboarding. The corrective action plan details are the part your auditors will quote back at you.
2. Unbound DNSSEC turns into RCE: A DNSKEY parsing path can overflow buffers and potentially execute code. The scary bit is the trigger: just querying a malicious zone with DNSSEC enabled.
3. Check Point management box, root RCE: A critical login-path bug can hand an unauthenticated attacker root on Security Management and Log Servers. If your firewall brain lives on a reachable network, assume attackers will notice.
4. PBX JWT forgery becomes shell: Issabel PBX shipped a hard-coded JWT signing key. If pbxapi is exposed, an attacker can mint tokens and reach command execution through telephony plumbing.
5. Diagnostics supply chain gets named: An extortion crew claims a major hospital lab vendor. If true, this is not just their problem, it is every hospital lab’s remote-support trust boundary.

Why today matters: The theme is “control plane compromise.” Management servers, resolvers, and PBX APIs are the quiet systems that everybody depends on, and almost nobody monitors like a crown jewel. Attackers are betting you patched endpoints, but forgot the glue.

Alright, let’s get tactical.

Data Breaches

1. HHS OCR settles Ambry Genetics HIPAA investigation (phishing, 225,370 impacted): HHS OCR announced a settlement tied to a January 2020 employee email compromise from phishing, with PHI for 225,370 individuals potentially exfiltrated. Ambry will pay $700,000 and operate under a corrective action plan OCR will monitor for two years, with specific findings around risk analysis, access termination, and unique user identification. Source: HHS
2. Mogren, Glessner & Ahrens, P.S. notifies 1,379 clients after server breach: The Washington law firm says it detected unauthorized access to a server in June 2026 and later confirmed client data was taken. Reported exposed data categories include SSNs, passwords, financial account numbers, tax returns, and other sensitive client files, affecting 1,379 individuals. Source: DataBreachWatch
3. Millennium Partners Management posts new incident notice (Sep 16): The firm published a public notice dated September 16, 2026 about a data security incident impacting some customers and employees. If you do business with boutique finance and real estate operators, watch for their vendor access paths into your environment. Source: Millennium Partners
4. Metaencryptor claims Beckman Coulter on leak site (unverified): A ransomware crew claims it has listed Beckman Coulter, a Danaher lab diagnostics company, as a victim, based on leak-site tracking. Treat as unverified until confirmed, but plan for knock-on risk: remote support channels and service accounts that touch hospital lab networks. Source: MedRisk

Security Research

1. Critical Unbound DNSSEC validator bug with possible remote code execution: NLnet Labs disclosed a critical issue where digesting crafted DNSKEY records can overflow a buffer, leading to DoS and possible RCE in some conditions. The fix lands in Unbound 1.26.1. If you run validating resolvers, this is not theoretical risk, it is “query meets exploit.” Source: NLnet Labs
2. Unbound also shipped multiple additional DNSSEC memory corruption fixes: Alongside the critical DNSKEY issue, NLnet Labs also published advisories for canonicalization and CNAME synthesis paths that can trigger heap issues and potential crash or corruption scenarios. The headline bug will get all the attention, but defenders should treat the release as a bundle and upgrade cleanly. Source: NLnet Labs
3. Check Point patches critical unauthenticated root RCE in Security Management / Log Server: A critical login-process vulnerability can allow unauthenticated attackers to execute code as root on Check Point management infrastructure. Even if your gateways are segmented, compromise of the management plane is how policies, certs, and VPN trust get rewritten. Source: BleepingComputer
4. Check Point also patches a second critical auth bypass plus RCE chain on firewalls: Reporting indicates Check Point issued fixes for an additional critical flaw that allows bypassing authentication and remote code execution on vulnerable firewalls. If you cannot patch immediately, isolate management and restrict trusted clients as an emergency step. Source: BleepingComputer
5. Issabel PBX hard-coded JWT key enables unauthenticated command execution (observed exploited): Issabel Framework shipped with a static HS256 JWT signing key identical across installs. Attackers can forge tokens and reach OS command execution through the PBX API call flow, with exploitation observed by Shadowserver per writeups. If pbxapi is exposed to the internet, assume scanning is already underway. Source: Tenable

Top CVEs

1. CVE-2026-81642: Critical Unbound DNSSEC validator heap overflow when digesting DNSKEY records, leading to denial of service and possible remote code execution. A malicious zone plus a validating resolver is enough to trigger the vulnerable path. Source
2. CVE-2026-82717: Unbound heap corruption path involving CNAME synthesis and compression pointers, leading to DoS and under certain builds potentially remote code execution. This is the kind of “eventual corruption” bug that becomes a stability nightmare under targeted traffic. Source
3. CVE-2026-81634: Unbound DNSSEC canonicalization heap buffer overflow that can crash the resolver. Even when it is “just” DoS, resolvers are shared infrastructure, so this becomes a blast radius multiplier fast. Source
4. CVE-2026-91843: Check Point Security Management Server and Log Server critical login-process flaw enabling unauthenticated remote code execution with root privileges. If an attacker owns the manager, they can rewrite the network’s rules of reality. Source
5. CVE-2026-89026: Issabel PBX hard-coded JWT signing key allows unauthenticated token forgery and OS command execution via PBX API paths. This is a classic “secret that is not a secret,” at PBX scale. Source

Podcasts & Talks

1. SANS Stormcast (Sep 18, 2026): Issabel 0-day, cyber decoys, Unbound vuln: A tight briefing that connects today’s operational reality: PBX exploitation, DNS resolver risk, and practical detection improvements. Good listening for the person who runs your patch and vuln triage meeting. Listen: Apple Podcasts

Final Words

The uncomfortable pattern today is that the highest leverage targets are not the shiny ones. Attackers want the systems that decide who is trusted, what is routed, and what is allowed, then they let your own tooling do the rest. The part most coverage misses is the operational blind spot: many teams cannot even answer “which resolver version is validating DNSSEC for our org” without a scavenger hunt.

This week, do three things:

• Patch or upgrade Unbound to 1.26.1 where applicable, and inventory every validating resolver path (including appliances) for exposure to CVE-2026-81642.
• Apply Check Point fixes for CVE-2026-91843, then restrict management-plane access to known admin subnets and verify no new administrators or policy changes appeared unexpectedly.
• Find any internet-exposed Issabel PBX pbxapi endpoints, rotate keys or update to remove the hard-coded JWT secret, and hunt logs for forged bearer token usage tied to CVE-2026-89026.

Your turn: If OCR showed up tomorrow and asked for proof you can offboard access within hours of termination, for every system that holds PHI, could you produce that evidence in one afternoon? Hit reply with your honest answer, or drop a comment on the web version. I read every reply.

Know a healthcare leader who still thinks phishing is an “IT training problem,” not a compliance and identity engineering problem? Forward them this issue and point them at the 225,370-patient OCR settlement. For everyone else, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!