US Cybersecurity Briefing – Tuesday, Oct 20, 2026

Colorado County reported a disruption to its government information systems and operations. The county said the disruption threatened essential services, including systems that support public safety. County Judge Ty Prause called emergency Commissioners Court meetings on Oct 13 and Oct 15. The agendas covered system restoration, network protection, outside help, response spending, and legal and notification obligations. As of Oct 19 the county had not announced restoration, said what caused the disruption, or said whether data was taken. The ransomware tracker ransomware.live shows a NightSpire listing for a victim named “Colorado Texas” on Oct 14, but nobody has confirmed that the listing is the county. Not confirmed: that this was a cyberattack, which offices are affected, and whether emergency services were interrupted. Note: the disruption began before this coverage window; the reporting is new.

DysruptionHub →

An attacker used a stolen Microsoft 365 client credential for ConnectWise Cloud Backup to get Graph tokens into customer tenants. Huntress believes the attacker also abused other ConnectWise Cloud Management apps (Exchange Online, Teams, SharePoint, Graph and Partner Center). The apps then granted themselves directory roles; in one partner tenant, the Teams app made itself Global Administrator and added secrets to two other apps. Huntress confirmed unauthorized sign-ins in 162 tenants. Nearly 1,000 Entra tenants showed sign-in activity from the main attacker IP, 144.172.64[.]128, and more than 300 of those sign-ins succeeded. A second, targeted wave on Oct 15 went after 16 tenants in the policy, national security, trade and critical-minerals sectors. Earlier, on Oct 13–14, the same IP password-sprayed four law firms. ConnectWise has suspended Cloud Backup and its SaaS Security and Cloud Management platforms, and has revoked the app certificates. No customers are named and the attacker is not identified. Data theft has not been confirmed, and Huntress notes that Graph directory reads leave no audit trail.

Action: Disable (do not delete) the ConnectWise Cloud Backup and Cloud Management service principals. Remove any directory roles they hold. Review app secrets and certificates added since Oct 13, and search sign-in logs for 144.172.64[.]128.

Huntress →    The Record →

Bullhorn, a Boston-based staffing software company with more than 10,000 customers, took its platform offline to contain a cyberattack. Customers first reported problems on Friday. ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments suffered major outages. Bullhorn says it has eradicated the immediate threat and is restoring service with help from CrowdStrike. A forensic investigation is under way. Not yet known: whether customer data was taken, the attack vector, the attacker, and when service will be restored.

Action: Bullhorn customers should rotate API passwords. Users who don't sign in through SSO will have to reset their passwords at next login.

BleepingComputer →

Parkview Health, which runs hospitals and clinics in Indiana and Ohio, took its network offline on Oct 19 after detecting suspicious activity. Parkview calls it a “systemwide internet outage.” The MyChart patient portal is down. Parkview says there is no indication that data was compromised and that it is restoring services. Not confirmed: a cyberattack, ransomware, or the cause.

WPTA 21Alive →

The attack reached parts of the hospital's network over the weekend of Oct 17–18 and damaged business files and other systems. Images can no longer be sent to radiologists, so ambulances are taking critical patients to other hospitals. Some appointments have been canceled, staff are working on paper, and the ER remains open. The hospital is replacing its computers and building a new network with help from Bryan Health. CEO Ryan Larsen expects slowdowns to last most of the week. A local news report says the Qilin group appears to be behind the attack, but nobody has confirmed this, and ransomware has not been confirmed. The hospital says patient data reportedly was not compromised; outside experts are checking.

MSC News →

Between May 22 and Sept 18, 2026, an intruder used a compromised login to copy files from the SFTP site that ETS used to share state testing data with the California Department of Education. ETS spotted the activity on Sept 25. The data covers all students enrolled in the past three school years. It includes names, birth dates, addresses, student IDs, demographics, disability and Section 504 status, program eligibility and test results. CDE says Social Security numbers, financial data, passwords and parent information were not involved. No total count has been given; California enrolled more than 5.7 million students in 2025–26. How the credential was stolen has not been disclosed.

California Dept. of Education →    SecurityWeek →

Ahold Delhaize confirmed that malicious actors caused the incident that forced it to take websites and apps offline for most of its US and European brands. Online shopping for Food Lion and Stop & Shop was still down as of Oct 19. Stores have stayed open, and US online services are expected back “in the coming days.” The company says it has no current evidence that sensitive customer, employee or partner data was taken. The attack type, attacker and any ransom demand have not been disclosed.

Ahold Delhaize →    The Record →

This authentication bypass in the GlobalProtect portal and gateway lets attackers get around MFA and open VPN sessions. Unit 42 now ties exploitation to Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius). ReliaQuest links it to Settra ransomware. After getting in, the attackers move to vCenter and ESXi, turn off security controls, and dump credentials from domain controller virtual disks, which gets around EDR inside the guest. They have also chained this access with the Veeam flaw CVE-2023-27532. No victims are named. Targeted sectors include education, healthcare, government and utilities.

Action: Patch or apply the vendor mitigations. Then search GlobalProtect logs for the IPs and host IDs Unit 42 published.

Unit 42 →

Attackers are bundling a genuine, signed copy of Software Center 3.5.8.7 with malicious DLLs, which the program then loads. Siemens links the activity to Romulus, a ClickFix delivery platform. Siemens says its own distribution channels were not tampered with. The fix is in version 4.0.9.8, which installs automatically the next time the program starts. Siemens recommends hunting for the behavior and folder paths rather than file hashes, because the Siemens binary itself is legitimate.

Siemens ProductCERT →    SecurityWeek →

Chained together, these four flaws give unauthenticated code execution on exposed Plex servers. A proof of concept was published Oct 16. A researcher's honeypot was hit on Oct 17, and the attackers installed an XMRig cryptominer and proxyware. Plex's advisory covers v1.43.2 and earlier; fixes shipped on Sept 1.

Action: Update any Plex server that is exposed to the internet, including ones on employee home networks that connect to corporate resources.

SecurityWeek →

For short windows on May 28, July 16 and July 20 (UTC), attackers altered AOMEI's update configuration files to deliver the CROSSROAD downloader and the SHINYROAD backdoor, which abuses Radmin. The research came from ManageEngine, Google GTIG and Mandiant. Victims were found in the US and five other countries, in IT services, telecom and higher education; none are named. AOMEI's server-side fix does not remove backdoors that were already installed. Indicators include IP 8.210.84[.]56 and hostnames under storage-data[.]com.

BleepingComputer →

F5 released out-of-band fixes for CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479. They affect NGINX Plus and Open Source, Ingress Controller, Gateway Fabric and Instance Manager, and allow DoS or code execution under non-default configurations. Drupal fixed critical RCE flaws CVE-2026-108097 (Field UI, core) and CVE-2026-108099 (the Entity List module) in core 11.4.10, 11.3.19 and 10.6.19 and Entity List 3.0.10. Drupal had warned that exploits could appear within hours or days. CISA KEV: no new additions found for Oct 19; the last update, on Oct 16, added BeyondTrust Remote Support CVE-2026-102764 and Fortinet CVE-2025-61624. The KEV catalog page itself could not be loaded to double-check this.

BleepingComputer (NGINX) →    SecurityWeek (Drupal) →    CVE Brief (KEV) →

1. DysruptionHub – Colorado County, Texas, systems disruption
2. Huntress – Vendor credential enables unauthorized access
3. The Record – ConnectWise suspends Cloud Backup service
4. BleepingComputer – Bullhorn takes platform offline
5. WPTA 21Alive – Parkview systemwide outage
6. MSC News – CMC in Falls City targeted by cyber attack
7. California Dept. of Education – ETS data incident notice
8. SecurityWeek – California students' records exposed
9. Ahold Delhaize – Update on cybersecurity incident
10. The Record – Ahold Delhaize confirms malicious actions
11. Unit 42 – Active exploitation of PAN-OS CVE-2026-0257
12. Siemens ProductCERT – Exploitation of CVE-2026-110936
13. SecurityWeek – Siemens Software Center exploited
14. SecurityWeek – Plex2Shell weaponized
15. BleepingComputer – AOMEI update servers hijacked
16. BleepingComputer – F5 NGINX patches
17. SecurityWeek – Drupal core RCE
18. CVE Brief – Oct 19, 2026 (KEV list)