UNM Health breached and more - Nov 1, 2026
UNM Health breached and more - weekly security news and updates roundup for Oct 25 - Nov 1, 2026
Featured
UNM Health has revealed they were victim of a data breach
The attacker has disrupted patient care and surgeries. Byod ransomware group has claimed responsibility.
This Week’s Updates
Breaches
- DreamHost forces email, FTP and SFTP password resets during an ongoing security incident
- University of Copenhagen confirms a breach of a test environment exposing data of 525,000 people
- ENGIE confirms attackers stole French customer data through a partner marketing platform
- Warp discloses a breach via a vendor exposing AI agent logs and user telemetry
- GMO confirms stolen data was published after an intrusion at its Onamae Desktop Cloud VPS service
- Sony Network Communications confirms So-net breach exposing 2.5 million customer records
- Polymarket confirms a compromised third-party provider after a crypto-draining script attack
- Japan Airlines confirms an Amadeus supplier breach exposed data of about 92,000 customers
- Binance confirms a roughly 6.3 billion dollar crypto theft traced to a compromised DevOps laptop
- Chainalysis confirms a breach exposing customer names and emails after an agentic AI attack
- Northflank acknowledges unauthorised use of customers’ AI API keys after a security breach
Vulnerabilities
- CISA confirms PHP2Shell remote code execution flaws are now exploited, patches released
- Apple backports patches for the exploited CoreGraphics zero-day to older iPhones
- Tailscale confirms serious SSH flaws allowing root privilege escalation and works on patches
- CISA warns the critical Brotli decoder flaw is exploited, with emergency patches available
- Critical Oracle E-Business Suite SQL injection flaw patched as attackers start scanning
- Cisco patches an ASA and FTD zero-day exploited to crash SSL VPN devices
- Hackers exploit a patched Cisco SD-WAN flaw to deploy custom KeyDrift malware
- Drupal confirms a critical Commerce Core flaw is exploited in attacks, update released
- GitLab patches a max-severity flaw now exploited in attacks
- Linux kernel MPTCP flaw allows remote root attacks, fixes backported
- New Android SMS of Death exploit can remotely crash unpatched phones