Healthcare & Pharma — Cybersecurity News & Threat Intelligence | CyberSecureToday

Saturday, 31 October 2026Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

35 articlesUpdated 18 Oct 2026

ThreatsCloud & SaaSCritical

Critical SQL Injection in IBM Cloud Portal Infrastructure Allowed Database Exfiltration

A critical SQL injection flaw on an enterprise IBM Cloud portal enabled unauthenticated remote attackers to extract backend database records.

18 Oct 202613 min read

Daniel Okafor

ThreatsHealthcare & PharmaHigh
Thermo Fisher Torrent Suite Path Traversal Flaw Exposes Clinical Genomics Servers to File Exfiltration
A path traversal vulnerability in Thermo Fisher Torrent Suite Software (CVE-2026-107777) allows authenticated attackers to exfiltrate clinical genomics data.
CST Editorial Desk18 Oct 20269 min read
ThreatsIndustrial & OTCritical
Thermo Fisher Torrent Suite Flaws Expose Genomic Sequencing Labs to Authentication Bypass
CISA Advisory ICSMA-26-288-01 warns of critical authentication bypass and execution vulnerabilities in Thermo Fisher Torrent Suite software used in clinical genomic sequencing.
CST Editorial Desk17 Oct 20269 min read
NewsIndustrial & OTCritical
ABB System 800xA Flaw Allows Recipe Injection in Chemical and Pharma Plants
ABB releases emergency advisories for System 800xA Batch Management software after researchers uncover an unauthenticated recipe injection vulnerability.
CST Editorial Desk13 Oct 20268 min read
NewsIndustrial & OTCritical
Honeywell IQ4 BACnet Flaw Allows Unauthenticated Denial of Service and HVAC Override
Honeywell and CISA issue advisory for IQ4 building automation controllers, patching a critical BACnet/IP stack buffer overflow (CVE-2026-73850).
CST Editorial Desk11 Oct 20268 min read
NewsIndustrial & OTCritical
ABB Ability System 800xA Batch Management Server Flaw Enables Unauthenticated Recipe Parameter Manipulation (CVE-2026-71880)
ABB and CISA issue advisory for Ability System 800xA Batch Management, patching a critical flaw (CVE-2026-71880) allowing unauthenticated recipe tampering.
CST Editorial Desk11 Oct 20268 min read
InsightsBanking & Fintech
India DPDP Rules 2026 Enforce Mandatory Algorithmic Audits and Biometric Tokenization for Significant Data Fiduciaries
MeitY and Data Protection Board of India issue binding DPDP Rules 2026 requiring annual algorithmic audits, biometric tokenization, and strict 6-hour breach reports.
Priya Raman11 Oct 20268 min read
NewsHealthcare & Pharma
SEC Form 8-K Disclosure: Global Pharmaceutical Conglomerate Reports Advanced Clinical Trial Data Breach
Global pharmaceutical enterprise files SEC Form 8-K disclosing a material cyber incident involving unauthorized exfiltration of proprietary Phase 3 clinical trial datasets.
CST Editorial Desk8 Oct 20268 min read
InsightsBanking & Fintech
The Multi-Clock Compliance Trap: Navigating Conflicting 6-Hour, 24-Hour, and SEC 8-K Incident Deadlines
Disparate incident reporting windows across the SEC, EU DORA, and India's RBI create a legal hazard for CISOs. Here is how enterprise response playbooks must adapt.
Tom Verhoeven6 Oct 20268 min read
Cyber AttackGov & Defence
Compromised Partner Integration Exposes 8.8 Million Citizen Records in Denmark National Registry Breach
Danish authorities confirmed an unauthorized entity abused legitimate commercial partner API credentials to exfiltrate 8.8 million CPR citizen identity records.
Tom Verhoeven5 Oct 20268 min read
NewsCloud & SaaS
AWS Powertools for Python Lambda Utility Fail-Open Defect Leaks Unmasked Sensitive Data to Logs (CVE-2026-104002)
AWS resolved a fail-open defect in Python Lambda Powertools data masking (CVE-2026-104002) that emitted unmasked sensitive records to logs during masking errors.
Aisha Noor5 Oct 20268 min read
ThreatsCloud & SaaSCritical
Kiteworks Email Protection Gateway Flaw Lets Unauthenticated Attackers Run Code as Root
Kiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
Daniel Okafor4 Oct 20266 min read
ThreatsCloud & SaaSHigh
Citrix NetScaler SAML Overflow Forces Second Round of ADC and Gateway Upgrades
Citrix fixes CVE-2026-88779, a SAML memory overflow that crashes NetScaler ADC and Gateway. Last week's 14.1-73.37 and 13.1-64.23 builds are still vulnerable.
Daniel Okafor4 Oct 20265 min read
ThreatsCloud & SaaSHigh
Microsoft Exchange Flaw Lets Authenticated Users Read Other Mailboxes, Update Reissued
Exchange Server CVE-2026-96940 lets authenticated users read other mailboxes. Microsoft rates it Exploitation More Likely. Install the September 2026 v2 SU.
Daniel Okafor3 Oct 20265 min read
ThreatsCloud & SaaSCritical
HPE Fixes 18 Instant On Access Point Flaws, Including Unauthenticated RCE Bugs
HPE bulletin HPESBNW05150 fixes 18 Instant On AP flaws, including two CVSS 9.8 unauthenticated RCE bugs (CVE-2026-76721, CVE-2026-76722). Update to 3.4.2.0.
Aisha Noor3 Oct 20265 min read
Cyber AttackHealthcare & Pharma
General Santos Doctors Hospital Hit by 2.4TB Rhysida Ransomware Extortion of Patient Clinical Records
Rhysida ransomware group exfiltrates 2.44 Terabytes of clinical patient files and medical records from General Santos Doctors Hospital in an 8-Bitcoin extortion scheme.
Daniel Okafor1 Oct 202611 min read
Cyber AttackHealthcare & Pharma
MedImpact Pharmacy Benefit Manager Breach Exposes Prescription Histories Across Corporate Health Plans
Qilin ransomware syndicate exfiltrates MedImpact pharmacy benefit databases, exposing prescription records, provider details, and SSNs across employer health plans.
Mei-Lin Chen30 Sep 202610 min read
ThreatsCloud & SaaSHigh
AWS HealthLake MCP Server SSRF Flaw Exposes IAM Credentials and Healthcare Data
AWS discloses high-severity SSRF flaw CVE-2026-15643 in the HealthLake MCP server, enabling attackers to leak temporary SigV4 IAM credentials and healthcare FHIR records.
Priya Raman26 Sep 202617 min read
Cyber AttackHealthcare & Pharma
AdaptHealth Files SEC Form 8-K Disclosing Unauthorized Network Intrusion and Healthcare Data Exfiltration
AdaptHealth Corp files an SEC Form 8-K under Item 1.05 disclosing a cyberattack that disrupted internal systems and resulted in unauthorized patient data exfiltration.
Priya Raman24 Sep 202616 min read
Cyber AttackHealthcare & Pharma
Astrana Health Discloses SEC Form 8-K Breach After Phone Spoofing Social Engineering Intrusion
Astrana Health files SEC Form 8-K Item 1.05 after threat actors spoofed corporate phone numbers to socially engineer IT support and compromise patient systems.
CST Editorial Desk23 Sep 202614 min read
Cyber AttackHealthcare & Pharma
Nutex Health 8-K Discloses Cyber Extortion After Patient PHI Exfiltration and Leak
Nutex Health files amended SEC Form 8-K Item 1.05 confirming patient PHI and provider records exfiltrated and published following ransomware double extortion.
Priya Raman23 Sep 202615 min read
Cyber AttackHealthcare & Pharma
West Pharmaceutical Services Discloses Material Cyberattack and Global Manufacturing Outage in SEC Form 8-K Filing
Injectable drug packaging leader West Pharmaceutical Services files SEC Form 8-K Item 1.05 disclosing data exfiltration and systems encryption halting global manufacturing.
CST Editorial Desk22 Sep 202616 min read
Cyber AttackHealthcare & Pharma
iRhythm Holdings Discloses Social Engineering Attack and Patient PHI Extortion in SEC Form 8-K Filing
Digital healthcare firm iRhythm Holdings files SEC Form 8-K Item 1.05 following social engineering compromise of cloud apps and extortion threats over patient cardiac data.
CST Editorial Desk22 Sep 202616 min read
Cyber AttackHealthcare & Pharma
Amgen Discloses Unauthorized Cloud Data Exfiltration and Patient PHI Theft in SEC Form 8-K Filing
Biotechnology giant Amgen files SEC Form 8-K Item 1.05 after unauthorized actors infiltrated third-party cloud environments and exfiltrated sensitive patient PHI and clinical research data.
CST Editorial Desk22 Sep 202616 min read

Threat scope

EHR systems, hospital ransomware, connected medical devices, HIPAA compliance and clinical trials.

Free newsletter

The Daily Brief

The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.

Exploited CVEs, with affected products and patch status
Patch priorities ranked by real-world exploitation
Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2

FreeOne email per weekdayUnsubscribe anytime

See a sample issue Privacy policy