← Wednesday 28 Octobernote 6 of 10
CybersecurityWed 28 Oct 2026 · 6 of 10

Data breach at Denver Health Medical Plan exposes 238,000 members' information

Verified · 10/10 supported1 cited · 1 min read

securityweek.com reports that Denver Health Medical Plan (DHMP) notified roughly 238,000 members that their personal and health information may have been compromised . securityweek.com reports that the breach involved third‑party vendor SquareML, which provides a no‑code platform for healthcare analytics . securityweek.com reports that SquareML’s access key was inadvertently leaked on a publicly accessible website on June 27, 2025, and the vendor informed DHMP of the leak on August 14, 2026, with the key revoked on August 18, 2026 . securityweek.com reports that the compromised account was read‑only, meaning the key could not be used to download, export, delete, or change any information . securityweek.com reports that potentially compromised data includes members’ names and health information, and that DHMP is a non‑profit managed‑care organization within the Denver Health and Hospital Authority system, administering Medicaid benefits in Denver and three surrounding counties .

Why it matters. securityweek.com reports that the breach puts the personal and health information of about 238,000 members at risk .

Earlier on Cybersecurity

Tue 27 Oct 2026Industrial Vendors Alert Customers to PHP2Shell Vulnerabilitiessecurityweek.com reports that industrial vendors Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have confirmed that some of their OT products are affected by the PHP2Shell vulnerabilities. securityweek.com reports that PHP2Shell refers to CVE‑2026‑109618 and CVE‑2026‑109619, two critical unauthenticated remote code execution flaws in the PHP engine. securityweek.com reports that PHP released patches on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after a leak of the vulnerabilities. securityweek.com reports that the first exploitation attempt was observed on October 17, before the patches, and Cloudflare has reported millions of attempts, with the first confirmed attacks aimed at honeypots reported over the weekend. securityweek.com reports that Schneider Electric identified three affected products—EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering—while other vendors are still assessing exposure or have determined no impact.Sat 24 Oct 2026Mirai Botnet Targets Newly Patched PHP2Shell Vulnerabilitiessecurityweek.com reports that researchers linked PHP2Shell attack attempts to the Mirai botnet and demonstrated an ASLR bypass, but no successful in‑the‑wild compromise has been confirmed. securityweek.com reports that emergency patches for the PHP2Shell vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) were released on October 21, one day earlier than planned after the CVE identifiers leaked online. securityweek.com reports that the two critical bugs allow unauthenticated remote code execution and have a CVSS v4.0 score of 9.2. securityweek.com reports that precautionary shutdowns affected many organizations, with European government, school and hospital websites going dark on October 21 and the UK government reporting 32 services unavailable and four partially unavailable. securityweek.com reports that Amazon detected the first exploitation attempt on October 17, that attack activity surged after the patches were released, and that a security firm built an exploit that bypasses a key memory protection (ASLR).Sat 24 Oct 2026Self‑Rebuilding Heartbreaker macOS Ransomware Remains Undetectedsecurityweek.com reports that Heartbreaker is a Rust‑based macOS ransomware sample that was uploaded to VirusTotal in May 2025. securityweek.com reports that the malware remains undetected by every antivirus engine on VirusTotal as of the report. securityweek.com reports that it attempts to establish persistence via a LaunchAgent before encrypting files in the user’s Downloads folder. securityweek.com reports that Heartbreaker tries to change its hash by extracting its embedded source code, randomizing identifiers, adding junk functions, and recompiling itself, even attempting to install Rust if missing. securityweek.com reports that researcher Patrick Wardle believes the ransomware is unlikely to become a major threat because it uses a single hardcoded AES key that allows free file recovery.
Next · CybersecurityTailscale prepares patch after uncoordinated Tailworm disclosure →