US Cybersecurity Briefing – Thursday, Oct 22, 2026

The Booba group listed Pearland Pediatrics, a pediatric primary-care practice, on its leak site on Oct 21, claiming about 35 GB of data. What data was taken is not described. Unconfirmed: no statement from the practice, no HHS or Texas AG filing found, and no independent verification.

Breachsense →

The n0n group listed this gastroenterology ambulatory surgery center on Oct 20. Leak size and data types are not stated. Unconfirmed: no victim statement, regulator filing or independent verification found.

Breachsense →

Frontline Education (K-12 HR/applicant-tracking software) told districts that an Aug 14, 2026 incident exposed staff and applicant data. Attackers reportedly exploited a flaw in a third-party application Frontline uses; Frontline has not named it. Exposed data includes names, addresses, emails and SSNs, plus driver license numbers per Klein ISD’s Texas AG filing (Oct 16, about 37,966 Texans). Texas districts named in reporting: Klein ISD, Lubbock ISD, Waco ISD, Fort Worth ISD, Crowley ISD, Laredo ISD. Frontline says no Texas student data was exposed. Individual notice letters start Oct 26, with 2 years of TransUnion monitoring. Threat actor not disclosed.

Action: Districts using Frontline should confirm with the vendor whether they are affected and prepare staff for phishing that uses the notice letters as a lure.

TX Legal Resource summary →

PHP shipped emergency fixes on Oct 21 for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) after details leaked on Oct 20. The flaws were found by Calif, Wiz and OpenAI researchers. CISA issued an alert urging operators to take sites offline until patched, and NSA urged partners to update. The White House said the US government learned of the flaws on Oct 16. Cloudflare, watchTowr, Hadrian and Patchstack report exploitation attempts. watchTowr had seen no successful compromise as of its Oct 22 update. Government sites in the Netherlands, Finland, Germany, France and Belgium went dark. Not confirmed: reports say US sites also went offline, but none of the sources reviewed named a specific US organization other than CivicPlus (below). There are no confirmed US victims.

Cybersecurity Dive →    BleepingComputer →

CivicPlus (Manhattan, KS), a major vendor of local-government websites, took Municipal Websites Open (all versions) and Community Development offline on Oct 21. Community Development v4 was later restored and is being monitored. The company says there is no evidence that customer data was compromised. Naples, FL is the only customer publicly named (its city website and agenda links were down). CivicPlus has not said how many customers are affected, and no Texas customers have been named. As of its last update (12:32 PM Oct 21), CivicPlus had given no restoration time.

Action: Texas cities and counties on CivicPlus should check the status page and plan alternate posting for meeting notices and agendas.

CivicPlus Status →    DysruptionHub →

The district shut off internet access as a precaution after a cybersecurity incident. Communications and online classroom tools were limited, and schools stayed open. Unconfirmed: alleged data theft, the attack type and the threat actor.

DysruptionHub →

On Oct 21 the Booba group listed the City of Everett (MA), the City of Mount Angel (OR), the Research Foundation of CUNY, Chicago Vein Institute and Coastal Carolina Neuropsychiatric Center, along with Pearland Pediatrics (TX). None of these victims has confirmed a breach.

Breachsense (October tracker) →

Unauthenticated RCE as the web worker user. Demonstrated pre-application on Apache mod_php; also affects PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; source backports exist for 7.4, 8.0 and 8.1. PHP says no mitigation is complete.

Action: Patch every internet-facing PHP host now. Where you cannot, apply PHP’s interim settings (session.upload_progress.enabled=0, memory_limit=-1 with a low post_max_size) or take the host offline.

BleepingComputer →    watchTowr →

Chained SSRF, URL-injection and file-write flaws give unauthenticated RCE. They are being used to drop cryptominers and proxy malware. Fixed in 1.43.3.10861. The same KEV batch added Siemens Software Center CVE-2026-110936 (used in Romulus ClickFix campaigns; fixed in 4.0.9.8) and SiteGuard Server Edition CVE-2026-106931. No victims named.

BleepingComputer →    The Hacker News →

1. Breachsense – Pearland Pediatrics
2. Breachsense – Memorial Hermann Endoscopy Center Kingwood
3. TX Legal Resource – Frontline Education breach in Texas
4. Cybersecurity Dive – Critical PHP vulnerabilities
5. BleepingComputer – PHP emergency patches for PHP2Shell
6. watchTowr – PHP2Shell FAQ
7. CivicPlus Status – Municipal Websites Open disruption
8. DysruptionHub – CivicPlus takes municipal websites offline
9. DysruptionHub – Richmond Public Schools
10. Breachsense – October 2026 breach tracker
11. BleepingComputer – CISA: Plex2Shell attacks
12. The Hacker News – CISA KEV: Plex2Shell, Siemens, SiteGuard