US Cybersecurity Briefing – Wednesday, Oct 28, 2026

Frontline Education, a school administration software provider used by more than 10,000 districts and organizations, was breached on Aug 14 via a vulnerability in a third-party software system it used to build, test and manage software. The Austin American-Statesman reports a Texas AG posting (dated Oct 12) lists 44,652 current and former Austin ISD employees affected. Exposed: names, Social Security numbers, personal and work email addresses, home addresses. Frontline began mailing notices with credit monitoring on Oct 26; Austin ISD reported the incident to Texas DIR. Unconfirmed: the threat actor, the specific vulnerable product, and how many other Texas districts using Frontline were affected (Frontline has not said).

Action: Texas districts using Frontline Education should ask the vendor directly whether their staff data was in scope.

Austin American-Statesman →    KXAN →

A cyberattack hit the UNM Health Sciences Center, including UNM Hospital, the state's only Level 1 trauma center, burn unit and children's hospital. Ambulances were diverted for about two hours, outpatient surgeries and appointments were suspended Monday, and Tuesday classes at the four health sciences schools were canceled. A new group, Byod, claimed 36,000 compromised machines and theft of SSNs, HR/payroll, research and patient data. Those claims are unverified; UNM says only “some end-user devices” were affected, not core servers, and that critical systems and hospitals are fully back. UNM has not confirmed ransomware.

BleepingComputer →    The Record →

The FEC shut down web-facing services after reported hacking attempts, taking down the e-filing system used for campaign-finance reports, including 24- and 48-hour independent expenditure reports, about a week before the Nov 3 midterms. Search of existing reports still works. The FEC has not confirmed a breach or data access, named an actor, or given a restoration time. This affects campaign-finance disclosure, not voting systems.

Newsweek →

An access key to a database run by vendor SquareML (no-code healthcare analytics) was posted on a public website from June 27, 2025 until it was revoked Aug 18, 2026. The read-only database held names, birth dates, ZIP/city/state, demographics, health metrics, eligibility, admission/discharge and provider data for 238,083 DHMP members. No SSNs or financial data. DHMP says it has no evidence the data was viewed or misused.

SecurityWeek →

Ukrainian national Artem Stryzhak, 36, who pleaded guilty in Dec 2025, was sentenced for work as a Nefilim affiliate (2021) and Hive affiliate (Oct 2021–Jan 2023) targeting US, Canadian and Australian hospitals, governments and businesses. Prosecutors cite more than $100M in losses. Specific victims were not named in the coverage. Alleged Nefilim/LockerGoga/MegaCortex admin Volodymyr Tymoshchuk remains at large ($11M reward).

The Record →

Sansec ties PolyShell (plus SessionReaper, CVE-2025-54236) to a skimmer-loader campaign that has injected a JavaScript loader into Magento CMS blocks on 953 stores since July 2025; the current loader domain is deepveindrilling.com. Infected stores were not named.

Action: Apply Adobe's patch, check CMS blocks/pages for injected scripts and block deepveindrilling.com.

Sansec →    The Hacker News →

Unchecked return value lets an unauthenticated attacker send a crafted Brotli stream to corrupt memory, leak data, crash or possibly execute code where apps decode attacker-supplied data (e.g. Node.js node:zlib). Exploit attempts seen on honeypots (Previdian, ELLIO); scale unknown and no victims named. Node.js fixed versions: 22.23.4, 24.22.1, 26.12.1 (no workaround). Microsoft also shipped emergency .NET patches.

The Hacker News →

Engine-level flaws in all PHP versions that handle web requests (code dates to PHP 5.4), patched Oct 21. Working shells confirmed on honeypots over the weekend; Amazon saw targeting four days before patches. No compromised organizations named. A separate unpatched PHP RCE, CVE-2026-115560, has mitigation guidance only.

Action: Update PHP to the Oct 21 releases on all internet-facing hosts.

BleepingComputer →    Security Affairs →

Fix, first shipped in September for current OSes, now covers iPhone XS/XS Max/XR, iPad 7th gen, iPad Air 4+, iPad 9th gen+, iPad mini 6+. Targets not named.

BleepingComputer →

Cyberdione Labs disclosed flaws in Tailscale SSH socket forwarding (root code execution for an authorized user), experimental app connectors, headscale, DERP client and tailscale serve. Tailscale said fixes were due by end of Oct 27.

Action: Install the patched client; until then set TS_SSH_DISABLE_FORWARDING=1 and tighten SSH ACLs.

BleepingComputer →

1. Austin American-Statesman – Austin ISD employee data breach
2. KXAN – Austin ISD staff data compromised
3. BleepingComputer – UNM Health attack
4. The Record – UNM hospital diverts ambulances
5. Newsweek – FEC offline after hacking attempt
6. SecurityWeek – Denver Health Medical Plan key leak
7. The Record – Nefilim/Hive operator sentenced
8. Sansec – Magento CMS block loader hits 953 stores
9. The Hacker News – PolyShell and Brotli KEV additions
10. BleepingComputer – PHP2Shell exploited
11. Security Affairs – CISA adds PHP2Shell to KEV
12. BleepingComputer – Apple CoreGraphics backport
13. BleepingComputer – Tailscale SSH flaws