US Cybersecurity Briefing – Monday, Oct 26, 2026 (includes weekend)

Llano Independent School District (4 campuses, ~2,000 students) lost internet and phones on Sep 29 and on Sep 30 acknowledged a cybersecurity incident affecting its IT network, took systems offline and brought in outside specialists. The Qilin ransomware group listed the district on its leak site (entry recorded Oct 18). Unconfirmed: the district has not confirmed ransomware, data theft, the attacker, entry vector, affected systems or full restoration.

DysruptionHub →

Frontline Education, a K-12 HR/applicant-tracking vendor, told districts an incident occurred Aug 14, 2026 and was contained Aug 15. Texas districts named as affected: Klein ISD (Texas AG filing Oct 16: ~37,966 Texas residents), Lubbock ISD, Waco ISD, Fort Worth ISD, Crowley ISD and Laredo ISD. Exposed data reportedly includes employee/applicant names, home and email addresses and Social Security numbers (Klein ISD's filing also lists driver license numbers); Frontline says no student data was exposed. Individual letters begin Oct 26 with two years of TransUnion monitoring. Unconfirmed: the exploited third-party application and the national total have not been disclosed.

Action: District HR teams should expect employee questions this week and warn staff about breach-themed phishing.

Fort Worth Star-Telegram via GovTech →    TX Lawyer Referral Service (district list, AG count) →

Quest learned Oct 21 of unauthorized access to Quanum LSM, the portal physicians use to order tests and view results, and disclosed it in an SEC filing. Quest says it believes some patient data in the system was accessed; data types and number of people are not yet determined. Essential Insights and LabHQ were paused as a precaution (no data accessed, per Quest). As of 7 pm ET Oct 23, Quest says the incident is remediated and all systems restored. Quest says it is unrelated to the recent PHP flaws. Unconfirmed: attacker, entry vector and count; no group has claimed it.

Action: Clinics that use Quanum LSM should reset credentials (Quest IT Connectivity Help Desk 1-800-697-9302).

Quest Diagnostics notice →    BleepingComputer →

University Hospitals took digital services offline Oct 22 after detecting unusual server activity; MyChart was unavailable and website services limited. UH says patient care delivery was not affected and warned disruptions could last “the next few days.” Unconfirmed: UH has not called it a cyberattack, named ransomware or an attacker, or said whether patient data was accessed.

DysruptionHub →

The City of Columbia, South Carolina confirmed the incident discovered Tuesday (Oct 20) was ransomware. MyColaSC, Animal Services, parks and recreation reservations and GIS are offline; police, fire, 911, Columbia Water and the Payment Center are operating. SLED is investigating, potentially with the FBI. Unconfirmed: whether sensitive data was accessed; no ransomware group named.

WACH Fox 57 →

Some vendors could not transact with families in Arizona's ESA program (administered by the Arizona Department of Education; 108,688 students enrolled) after a reported cyberattack on the program's platform, raised by state Sen. Shawnna Bolick. Unconfirmed: the platform operator has not been publicly named; attack method, start date, restoration and any student-data exposure are unknown.

DysruptionHub →

Authenticated low-privilege users can escalate to operator and impersonate the local superuser operator. Arista detected it and says it is actively exploited. Fixed in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted VCO already patched. Attack IPs: 74.82.197.86, 38.54.50.151. No victims publicly named.

Action: Patch on-prem VCO now; block the two IPs; review VCO web logs and recent admin changes.

Arista Security Advisory 0199 →    BleepingComputer (IOCs, hunting) →

Unauthenticated RCE via proxy.php when the bundled CODE server is stopped. Exploited since ~Sep 10 to plant PHP webshells and hunt for password databases and crypto wallets. Fixed in richdocumentscode 26.4.303; disabling the app is not sufficient. Standalone Collabora, Docker/package installs and Nextcloud AIO are not affected. No victims publicly named.

Action: Upgrade or remove richdocumentscode; check Nextcloud web roots for webshells.

BleepingComputer →    CVE Brief (KEV dates) →

New PHP RCE exploitable only with an unusual configuration (serialize_handler switched to php at runtime before session_start, with session upload progress enabled). Separate from the PHP2Shell flaws (CVE-2026-109618/109619). PHP will publish a full advisory with the next release.

Action: Set session.upload_progress.enabled=0 until patched.

BleepingComputer →

Unauthenticated RCE, command injection, SQL injection and auth-bypass flaws in ArubaOS used on mobility conductors, controllers, gateways and APs. HPE says it is not aware of public exploit code.

Action: Patch, and restrict CLI/web management to a dedicated VLAN or firewall policy.

BleepingComputer (links HPE advisory hpesbnw05162) →

1. DysruptionHub – Llano ISD cyber incident
2. GovTech/Star-Telegram – Frontline hack hits Fort Worth, Crowley ISDs
3. TX Lawyer Referral Service – Frontline breach, Texas districts
4. Quest Diagnostics – Quanum notice
5. BleepingComputer – Quest confirms data breach
6. DysruptionHub – University Hospitals systems offline
7. WACH – City of Columbia confirms ransomware
8. DysruptionHub – Arizona ESA vendor disruption
9. Arista – Security Advisory 0199
10. BleepingComputer – Arista VCO zero-day
11. BleepingComputer – Collabora RCE backdoors Nextcloud
12. CVE Brief – Oct 25, 2026 KEV list
13. BleepingComputer – PHP unpatched RCE mitigation
14. BleepingComputer – HPE AOS flaws