US Cybersecurity Briefing – Wednesday, Oct 21, 2026

Klein Independent School District in north Houston filed a report with the Texas Attorney General listing 37,966 affected people. The exposed data includes addresses, Social Security numbers and driver's license numbers. The Houston Chronicle and KHOU reported it Oct 20–21. Unconfirmed: the cause. The district has released no details. One news headline ties it to the Frontline Education vendor breach, an intrusion through a flaw in third-party software that exposed SSNs of K-12 employees, but this briefing could not open that article to verify the link.

Action: Texas districts that use Frontline should check whether they received a vendor notice. Frontline's deadline for districts to opt out of its notifications was Oct 16.

Rankiteo (AG filing summary) →    BleepingComputer (Frontline) →

A public registry of Texas AG filings lists seven new reports dated Oct 20: Hardin-Jefferson ISD (listed as “Hardi Jefferson ISD”), Walnut Creek Special Utility District, Heritage Pediatrics PLLC, Citizens Bank, Computer Task Group Inc., STS Aviation Group, and Toyo Tire Holdings of Americas Inc. The source gives no counts of affected Texans, data types or causes. These have not yet been checked against the official AG portal.

DataBreachRecords →

Colorado County, seated in Columbus, has issued emergency notices since Oct 13. They describe an “imminent threat to public health and safety” from a disruption of county information systems, including systems that support public safety. The NightSpire ransomware group posted “Colorado Texas” (co.colorado.tx.us) on its leak site on Oct 14. The county has not confirmed a cyberattack or any data theft. This briefing found no new update in the window.

DysruptionHub →

Unauthorized access damaged parts of the network at this 24-bed critical access hospital over the weekend. Staff moved to paper records, and the hospital is building an entirely new network. Critical patients were diverted elsewhere because staff could not send images to radiologists. The ER stayed open, and some appointments were canceled. Preliminary findings show no patient data affected, but that is not yet verified. MSC News named Qilin as the group responsible; this has not been confirmed independently.

DysruptionHub →

City staff found suspicious activity on the network and called in SLED. Services that are down: the MyColaSC app and online business licensing, parks and recreation, planning and development, GIS, and animal services. Police, fire, 911, Columbia Water and the City Payment Center are still working. The city has not said whether ransomware was involved or data was compromised.

DysruptionHub →

The FBI, with German and UK agencies, calls SafePay one of the most active ransomware groups of 2026, with at least 600 victims in the US and Europe since August 2024. Named victims include Ingram Micro, Conduent and Microlise. The group gets in through password guessing, phishing and exploited flaws, including CVE-2020-3259, CVE-2023-20269 (Cisco ASA), CVE-2023-27532 (Veeam) and CVE-2024-40711 (Veeam). Before encrypting, it steals data and uses AnyDesk or TeamViewer. It also calls victims by phone to pressure them. The CISA advisory page would not load for this briefing.

The Record →

An attacker used a compromised ConnectWise credential to sign in to customers' Microsoft 365 tenants. Huntress counted 162 tenants on Oct 15–16, and sign-ins from the attacker's IP across almost 1,000 Entra tenants, with more than 300 successful. In one tenant, the Cloud Management app gave itself Global Administrator rights and added client secrets to MSP apps. No threat actor has been named, and no restoration date has been given.

Action: MSPs and their clients should audit Entra role assignments and app secrets against the IOCs ConnectWise published.

SecurityWeek →

Paradigm, a San Francisco billing vendor for California's Medicaid program, reported to HHS that an intruder was on its network Oct 8–15, 2025. Names, dates of birth, gender and Medi-Cal ID numbers were exposed. Notification letters went out about 11 months after detection. No attacker or access method has been disclosed.

SecurityWeek →

The grocery operator took systems offline Oct 12 after what it calls “malicious actions of others.” Online ordering and delivery were disrupted for most of its brands in Europe and the US. The update does not name the affected US brands. Stores stayed open, and the company reports no evidence that data was stolen. No attribution has been made.

SecurityWeek →

There are two critical flaws (CVSS v4 9.2) whose details leaked before coordinated disclosure, and public reporting says they allow remote code execution. PHP has not yet published affected versions; outside reports say PHP 5 and later. watchTowr says it reproduced one flaw. watchTowr and Huntress have not seen exploitation yet, but Sansec expects mass exploitation within about 15 minutes of the release.

Action: Stage PHP upgrades now and deploy as soon as the release is out.

PHP.net →    SecurityWeek →

Plex Media Server (“Plex2Shell” chain, used to drop cryptominers and proxy malware; fixed in 1.43.3.10861): CVE-2026-96652, -96654, -96655, -96656. Siemens Software Center CVE-2026-110936 (DLL sideloading abused by the Romulus ClickFix platform; fixed in 4.0.9.8). EG Secure Solutions SiteGuard Server Edition CVE-2026-106931 (command injection). Federal agencies must patch CVE-2026-96654, -96656 and -106931 by Oct 23 and the other three by Nov 3. The CISA alert page would not load for this briefing; the CVE details come from The Hacker News.

The Hacker News →    SecurityWeek (Siemens) →

This auth bypass gives attackers VPN sessions without MFA. Unit 42 says Qilin and INC ransomware operators, and per ReliaQuest Settra operators, are still exploiting it. In one case attackers moved from the VPN to vCenter, turned off ESXi protections, and dumped domain controller credentials from its VMDK. Unit 42 also saw it chained with Veeam CVE-2023-27532. Victim sectors include education, healthcare, government and utilities; no victims are named. The Oct 20 update warns that GlobalProtect profiles mapped onto management interfaces expose those interfaces on ports 4443 and 3879.

Action: Patch, test from outside whether the management interface is reachable on 4443/3879, lock it down with Interface Management profiles, and hunt for signs of earlier compromise.

Unit 42 →    The Register →

1. Rankiteo – Klein ISD breach (AG filing)
2. BleepingComputer – Frontline Education breach
3. DataBreachRecords – Texas AG filings
4. DysruptionHub – Colorado County, Texas
5. DysruptionHub – Community Medical Center, Nebraska
6. DysruptionHub – Columbia, SC outage
7. The Record – FBI SafePay advisory
8. SecurityWeek – ConnectWise cloud services
9. SecurityWeek – Paradigm Healthcare breach
10. SecurityWeek – Ahold Delhaize restoration
11. PHP.net – Upcoming critical security release
12. SecurityWeek – PHP2Shell
13. The Hacker News – CISA KEV additions Oct 20
14. SecurityWeek – Siemens Software Center exploited
15. Unit 42 – PAN-OS CVE-2026-0257 threat brief
16. The Register – PAN-OS ransomware attacks