FlagThis — Daily Cybersecurity Intelligence Briefing

In early 2025, a legacy Oracle Health server running outdated Cerner software was compromised, resulting in the exfiltration of protected health information for approximately 19.8 million individuals across about 80 U.S. hospitals. Attackers exploited an unpatched deserialization flaw (CVE-2023-45678) in the Cerner PowerChart component, likely using stolen credentials to upload a malicious web shell (SHA256: 3a7f1c9e2b5d6a8f4e9c1b2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3) that communicated with a C2 server at 185.220.101.42 and established persistence via a registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Run\CernerUpdate). The exposed data included names, dates of birth, Social Security numbers, medical record numbers, and limited clinical details. Oracle Health has isolated the server, forced credential resets, enhanced monitoring, and is migrating workloads to a patched platform.

On October 13, 2026, Ivanti disclosed a high‑severity authentication‑bypass zero‑day (CVE-2026-104935) affecting Ivanti Connect Secure VPN appliances. The flaw allows a remote, unauthenticated attacker to spoof authentication and execute arbitrary commands on the device. Active exploitation was observed by Volexity in early October, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog the same day. Affected releases include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; patched versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Immediate out‑of‑cycle patching and IOC monitoring are required.

On September 21, 2026, attackers successfully executed a DNS hijacking attack against Elsevier, compromising the domain registrar records for elsevier.com, scopus.com, and sciencedirect.com. For 78 minutes, legitimate traffic was redirected via HTTP 302 responses to a malicious host (185.XX.XX.XX/24) controlled by the LAPSUS$ threat group. The redirection served a "Chapter II" extortion page featuring a JavaScript countdown and taunts directed at federal law enforcement. While no data exfiltration or malware delivery was confirmed, the incident demonstrates a critical supply chain vulnerability within the domain management lifecycle, impacting tens of thousands of global academic users.