Briefings ·
OTASEC Daily Briefing | 28-10-2026
A hospital ransomware attack in New Mexico that disrupted patient care leads today, alongside new PHP2Shell vendor advisories and more detail on the Dahua camera hijackings in Ukraine.
1Cyberattack disrupts University of New Mexico hospitals
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. Ambulances were diverted for about two hours on Monday and outpatient surgeries and appointments were suspended for the rest of the day. An extortion group has claimed the attack, and a substantial data breach is possible.
For asset owners: Healthcare operators and their suppliers should check that downtime procedures for clinical and building systems work and that IT and operational networks are segmented.
2Update: PHP2Shell advisories from Siemens and METTLER TOLEDO
Siemens published SSA-166980 on the impact of the two critical, unauthenticated remote code execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619) on its software products, and says it is still assessing implications. CERT@VDE reports that METTLER TOLEDO OCTO Image Server ships a vulnerable PHP version and strongly recommends upgrading to PHP 8.2.35.
For asset owners: Inventory where PHP is embedded in OT-adjacent and vendor-supplied applications, and apply vendor updates or the PHP 8.2.35 upgrade where advised.
3Update: Dahua cameras in Ukraine hijacked via P2P access and authentication weaknesses
Following the earlier CERT-UA warning, new reporting says compromised IP cameras and DVRs gave attackers access to the video stream, allowed configuration changes and the creation of third-party accounts. The reporting links the attacks to P2P access and authentication weaknesses in Dahua devices.
For asset owners: Check whether surveillance cameras and DVRs are reachable from the internet or via P2P, review accounts and configurations for unknown changes, and change default credentials.
4CISA 2030 strategy targets resilience of critical infrastructure
CISA released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure. It addresses intersecting cyber, physical and geopolitical threats that can disrupt essential services, and relies on work with public and private partners.
For asset owners: Asset owners in US-linked infrastructure can use the strategy to align their own resilience and OT security priorities with CISA's direction.
5Other advisories: Mendix SAML bypass and GoAhead TLS flaws
Siemens reports an authentication bypass in the Mendix SAML module that lets an unauthenticated attacker replay a valid SAML assertion in IdP-initiated flows, and has released new versions. Separately, the GoAhead embedded web server does not enforce certificate revocation in OpenSSL mutual-TLS builds, so a revoked client certificate can still log in.
For asset owners: Update Mendix SAML to the latest version and check whether devices running GoAhead rely on certificate revocation for access control.
6Manufacturing security hampered by governance gaps
Industrial Cyber reports persistent governance gaps in manufacturing cybersecurity, with accountability, funding and operational priorities diverging. Initiatives are described as more likely to stall for these reasons than for policy ones.
For asset owners: Clarify who owns OT security decisions and budget at your sites so security work is not blocked by competing priorities.
7Dutch minister: privacy risk of Chinese patient monitors limited
According to Security.NL, a Dutch minister states that the risks to patient data privacy from Chinese patient monitors at the St. Antonius Hospital are limited.
For asset owners: Healthcare organisations should review which connected medical devices come from higher-risk suppliers and how they are networked and monitored.