THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 4 min read
UNM says its hospitals are open and clinics are scheduled to resume appointments and procedures on October 27 after a cybersecurity incident disrupted care. The continuing IT alert leaves technical recovery unresolved, while claims of stolen patient, employee and student information remain unverified.
Cybersecurity
AT A GLANCE
Researchers at Enclave found that apps on an Android device could impersonate Microsoft apps when requesting tokens from Microsoft Authenticator, without requiring permissions or user interaction. The researchers said stolen tokens could enable access to email, files, calendars, SharePoint and Teams, and could let an attacker alter sign-in methods. Microsoft fixed the issue, CVE-2026-80097, in Authenticator version 6.2606.4246; versions before that are affected, and Microsoft rated it CVSS 8.6.
What changed Microsoft released a fix on September 8, 2026; Android Authenticator versions before 6.2606.4246 remain affected.
Why it matters For affected work accounts, removing the malicious app may not end the compromise: an attacker-added passkey could preserve access.
HelpNet Security ↗Rapid7’s Q3 2026 threat report says 71% of tracked exploitation began within a week of public disclosure, with an average of three days for high-severity flaws. Researchers tracked 43 newly exploited high- and critical-severity vulnerabilities, 34 of which required neither authentication nor user interaction. Rapid7 also said AI appeared as an operational component in 8% of the threat reporting it reviewed, while humans continued to choose targets and objectives in documented cases.
Why it matters For vulnerability-management teams, a weekly patch cycle may leave systems exposed before the next scheduled deployment: most tracked exploitation occurred inside that interval.
HelpNet Security ↗Rapid7 says CVE-2026-111497 affects Node.js 22.x, 24.x and 26.x and can corrupt process memory when an application decompresses attacker-supplied Brotli data. The Node.js Project says the flaw could cause a crash, disclose sensitive process memory or allow remote code execution; Rapid7 reported no known in-the-wild exploitation as of October 26. Fixed releases are 22.23.4, 24.22.1 and 26.12.1 or later, and Rapid7 advises urgent upgrading.
What changed Fixed releases are now available across all three affected supported Node.js lines, giving operators an upgrade path rather than relying solely on exposure reduction.
LESS NOISE. MORE CONTEXT.
Why it matters Application owners need to identify where untrusted Brotli input reaches node:zlib; that processing path, rather than Node.js installation alone, determines exposure to crashes, memory disclosure or code execution.
CISA added CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability, to its Known Exploited Vulnerabilities Catalog. The agency says the flaws pose significant risks to the federal enterprise and encourages organizations to prioritize remediation of KEV-listed vulnerabilities. Its BOD 26-04 directs federal civilian agencies to rapidly remediate specified high-risk KEVs on publicly exposed assets and sets expectations for checking for compromise.
Why it matters For federal civilian agencies, remediation can involve checking for an existing compromise as well as patching. The alert does not establish whether either PHP flaw meets every condition for the directive’s highest-priority treatment.
US Certs Alerts ↗Fortinet released security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, but is withholding details about the fixed vulnerabilities until November 10, 2026. Fortinet CISO Carl Windsor said AI models helped uncover the flaws and humans validated them. Windsor also warned that attackers can use AI tools to find vulnerabilities.
Why it matters Administrators of the five named Fortinet product families have updates to evaluate, but the withheld vulnerability details limit exposure-specific prioritization from this announcement.
What to watch next Fortinet says it will disclose the fixed vulnerabilities’ details on November 10, 2026.
HelpNet Security ↗Amutable opened signups for a private preview of Foundations, a Linux system that produces signed reports of each machine’s software and configuration, using hardware-backed measurements to help verify the reports. The design removes SSH, interactive shells and package managers, with changes delivered through new signed images. Amutable says its control plane can compare reported state against the declared configuration and deny secrets or cluster access to machines that do not match.
Why it matters Fleet operators adopting this design would have to replace interactive repairs and package-level changes with signed-image deployments—a concrete operational constraint alongside the proposed security benefits.
HelpNet Security ↗