Week of October 26, 2026: CISA 2030 Strategy, UNM Health Cyberattack, Brotli Flaw Exploited

Security leaders faced a run of disclosed incidents and patches between October 26 and November 1, 2026, headlined by CISA's release of its CISA 2030 strategy, a cyberattack that briefly disrupted University of New Mexico Health Sciences Center hospitals, and a University of Copenhagen breach exposing data on 525,000 people. The week also brought a wide-reaching Brotli compression library flaw added to CISA's KEV catalog, fresh Ivanti Connect Secure exploitation, the FBI's seizure of bulletproof host Virtualine, and Tailscale's fix for SSH flaws enabling lateral movement within tailnets.

CISA Releases CISA 2030: Defend, Harden, Prevail Strategy

On October 26, 2026, CISA published CISA 2030: Defend, Harden, Prevail, a strategy built around three pillars—Defend, Harden and Prevail—meant to strengthen national cyber defense and critical infrastructure resilience. The agency said it would move toward a more anticipatory posture against nation-state and other adversaries, prioritizing operational technology security, software security and continuity of emergency communications. CISA set milestones for the plan: a review of core services within 60 days, an implementation plan within 180 days, and a progress report within 365 days. (CISA)

CISA Adds Two Actively Exploited Ivanti Connect Secure Flaws to KEV

On October 30, 2026, CISA added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The first is a missing-authentication flaw for a critical function; the second involves generation of predictable numbers or identifiers. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed vulnerabilities on internet-facing assets that could grant attackers full control, and CISA urged all organizations to adopt the same risk-based patching approach. (CISA)

Cyberattack Disrupts University of New Mexico Health System

On October 26, 2026, University of New Mexico Health Sciences Center experienced a cyberattack that forced ambulance diversions and the cancellation of clinic appointments and some classes. IT security teams, external partners and law enforcement responded, and hospitals and clinics resumed normal operations within two days. An extortion group calling itself BYOD claimed on a leak site to have compromised 36,000 machines and stolen records including Social Security numbers, payroll data and electronic health record rosters; those claims remained unconfirmed. UNM said core systems and servers were not penetrated. (Help Net Security)

University of Copenhagen Breach Exposes Data of 525,000 People

The University of Copenhagen confirmed that a cyberattack detected October 20, 2026 and first disclosed October 23 exposed data belonging to about 525,000 people, including names, national identity numbers and phone numbers. The university shut down Workzone, Nimbus and other administrative systems on October 26 after activity it initially feared was a second attack, later attributing the activity to the original intrusion. PIN codes for roughly 20,000 staff and student ID cards were also compromised and reissued. The university reported the incident to the Danish Data Protection Agency. (Help Net Security)

345,000 Email Addresses Stolen in Breach of Germany's AfD Party

Have I Been Pwned added a breach of Germany's Alternative für Deutschland party to its database on October 27, 2026, listing more than 345,000 unique email addresses and email messages exposed in a September intrusion. Reporting tied the entry point to a poorly secured WordPress site that let attackers reach the party's mail management system and copy data twice before detection. Journalists who reviewed the leaked emails reported new details about party campaign finance timelines, and the stolen files, including voter registry data, were later distributed via a torrent link. (Help Net Security)

Brotli Decompression Flaw Reaches Node.js, .NET and Other Runtimes

Node.js disclosed CVE-2026-111497, a remotely exploitable out-of-bounds write in Google's Brotli compression library, on October 21, 2026, and researchers found the bug affecting software far beyond Node.js, including .NET, Bun, Envoy Proxy, Istio and FFmpeg. Fixed Brotli versions arrived the week of October 26 alongside patched Node.js releases. By October 28, threat intelligence firm ELLIO reported exploit traffic in the wild, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 28, 2026. (Help Net Security)

FBI Seizes Bulletproof Hosting Domain Virtualine.net

The FBI seized the domain of bulletproof hosting provider Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, as part of Operation Omegaline, announced October 28, 2026. Investigators, working with police in Germany, the Netherlands and the UK plus private partners OverRIPE and Lumen, said the provider laundered money for criminal customers and kept a forum selling child sexual abuse material online despite warnings from police and child-protection groups starting in January 2026. Virtualine reportedly sold customers a plan to migrate infrastructure to a different shell company after law enforcement requests. (Help Net Security)

Tailscale Patches SSH Flaws Enabling Lateral Movement Within Tailnets

Tailscale shipped version 1.104.4 on October 28, 2026, fixing vulnerabilities researcher Erica Windisch of Cyberdione Labs dubbed "Tailworm," including flaws in Tailscale SSH that could let an attacker who had already compromised one approved device gain elevated access to other machines permitted by a tailnet's policy file. The company disputed describing the issue as self-spreading, framing it instead as lateral movement bounded by policy. Tailscale also addressed denial-of-service issues affecting self-hosted control servers and advised customers to review SSH access policies and enable Check mode for sensitive systems. (Help Net Security)