Cyber News Bytes: What’s Happening in Cybersecurity This Week

This week has been HUGE for cybersecurity headlines and not in a good way. 😅

As always, if you want to walk into your next interview able to talk through cyber news stories exactly like these, my Cybersecurity Interview Prep Mastery course gets you ready for the questions that actually come up, from technical scenarios to behavioral rounds.

It has seven full modules and is built for roles like SOC Analyst, Security Engineer, and GRC. Hiring managers love asking about recent incidents, and this week gave you plenty of material.

Let’s get into the biggest news stories of the week to recap. →

1. Quest Diagnostics says hackers accessed patient records in a portal doctors use to order lab tests

Quest Diagnostics disclosed in an SEC filing on October 22 that it learned the day before of unauthorized access to its Quanum Lab Services Manager, a platform healthcare clients use to place test orders and look up results. The company believes an unauthorized party accessed patient records, and a provider FAQ confirms that personal and health information was involved. Quest has not said how many people are affected, what data was taken, how the intruder got in, or whether anyone has demanded payment.

Quest notified law enforcement, hired outside experts, and paused the platform, which pointed some clinics to another portal or to faxed paper orders. It says the incident did not materially disrupt its business and is unrelated to the PHP vulnerability disclosed the same week. This is Quest's second major breach in a decade, after the 2019 incident that exposed 11.9 million patient records through a third-party billing company.

Why it matters: Most patients never log into a system like this, so you may not hear about it unless a notice arrives. If you've had lab work done through Quest, watch for a notice, review your insurance statements, and consider a credit freeze once the company says what was taken.

Read more at TechCrunch

2. A school safety tip platform confirms hackers stole 8.3 million "anonymous" tip records, including student Social Security numbers

Navigate360, the Ohio-based company behind anonymous tip lines used by schools, police departments, and the US military, confirmed on October 23 that an unauthorized party had access to its systems from November 21, 2025 to March 5, 2026. The attackers took about 8.3 million tip records, which, depending on the record, include student and family names, addresses, dates of birth, student ID numbers, Social Security numbers, and medical information.

The confirmation came a day after Nevada announced that its SafeVoice tip line was affected, with roughly 10% of tips containing personal information during that period compromised. Nevada blames the company for waiting almost seven months and giving incomplete reports, and says the incident has drawn congressional inquiries and a Justice Department criminal investigation. Because the tips are anonymous, the state says it can't notify the students whose data may be at risk. Navigate360 says it has found no evidence the data has been used for fraud.

Why it matters: Systems built to protect anonymity end up holding exactly the details people were promised would stay private, and when something goes wrong there is no way to warn them. If your organization collects sensitive reports, gather only what you need and set clear retention limits.

Read more at Cybernews

3. Two critical PHP flaws put a huge slice of the web at risk, and attackers were probing before the patch

PHP released emergency updates on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2. Both let an attacker run code on a server with specially crafted web requests and no login. PHP powers up to 80% of websites, including those built on WordPress, Drupal, and Joomla, and researchers demonstrated working attacks against all three. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and PHP moved the release up after details leaked early.

Amazon says the first exploitation attempts began on October 17, four days before patches shipped, and that the flaws are now being broadly exploited, though it's unclear how many attempts succeed. Dataminr reports that activity so far looks like scanning and non-working exploits with no known compromises, but warns a working exploit is only a matter of time. VirusTotal tracks more than 5.1 million PHP hosts exposed online.

Why it matters: The flaw is in PHP itself, so updating WordPress or your plugins does not fix it. If you run a website, ask your host whether PHP has been updated, and if you manage your own server, upgrade and restart PHP. Older unsupported PHP versions did not get the standard fixes, so those sites need to move to a supported version.

Read more at BleepingComputer

4. A secret committed to GitHub in May was used to push malware into a popular AI tool in October

LiteLLM, an open-source gateway that many teams use to connect to AI models, confirmed that attackers published a malicious version 1.107.0 to PyPI and Docker on October 21. The package carried a credential stealer and backdoor designed to harvest cloud logins, developer secrets, and AI API keys. PyPI quarantined it within a couple of hours, but anyone who installed it or pulled the affected Docker images should assume their secrets were stolen.

LiteLLM's root cause analysis points back to May 27, when a configuration file containing the master key for an experimental agent platform was committed to a public repository and never revoked. On October 10 the attacker used that key to steal a GitHub token belonging to an organization owner, then took tokens from two maintainers, disabled branch protections, and published the malicious release through a lookalike repository. This is the second LiteLLM supply chain attack this year.

Why it matters: The key leaked in May and the attack landed five months later, a reminder that deleting a secret from a repo does not make it safe. If a key is ever exposed, revoke it right away, turn on secret scanning, pin your dependencies, and think twice before adopting brand new releases the moment they appear.

Read more at The Hacker News

This week's stories share one idea: a trusted piece of infrastructure failed behind the scenes.

A lab ordering portal, an anonymous tip system, the language half the web runs on, and a package developers install without a second thought.

Stay secure out there!

Sandra | Cyber with Sandra