12 October 2026
China-linked campaign targets healthcare; Green Clinic rebuilds after ransomware
A multinational advisory maps a China-linked campaign targeting healthcare, while Green Clinic details its ransomware recovery and six CVEs enter the weekly tracker.
Coverage: October 5–11, 2026, Eastern time. The evidence cutoff was October 12 at 12:00 a.m. ET. Primary pages checked after cutoff were used only to verify dated facts.
CISO Quick Read
- A China-linked campaign targets healthcare. The joint advisory names U.S. healthcare among targets and reports email theft from healthcare systems in Southeast Asia. Compare indicators with local telemetry, close unused services, enforce MFA and patch applicable exposed systems. Read the campaign brief.
- Green Clinic is rebuilding after ransomware. Its October 8 update said EHRs remained unavailable and care was limited. A new clinical system and broader care were planned for October 14, not completed at cutoff. See the dated recovery update.
- Atlassian fixed arbitrary file access across eight self-managed product families. Unauthenticated attackers who know a file's exact path and name can retrieve it from the web-application root. Atlassian Cloud was patched; self-managed teams should match their branch to a fixed release and investigate access separately. CVE-2026-21589 was not in CISA KEV at cutoff. Match products and fixed versions.
- FDA issued a Philips Lumify Early Alert. Listed iOS and Android versions may require transducer re-registration or have unstable USB connections. Use Lumify only where signal is readily available unless an immediate backup ultrasound is present, and maintain backup imaging capacity. At cutoff, this was not a classified Class I recall. Review the alert and supported action.
- NSA published zero-trust guidance for operational technology. Review access, segmentation and monitoring with facilities and clinical engineering, while accounting for safety and availability.
Priority CVEs
Five historical vulnerabilities entered CISA’s Known Exploited Vulnerabilities catalog on October 8, and Atlassian disclosed one critical non-KEV flaw in the reporting window. CISA’s October 11 remediate-by dates are binding operational directives for U.S. federal civilian agencies, not universal private-sector legal deadlines.
Atlassian self-managed products · CVE-2026-21589 · CVSS 4.0 9.3 · Not in CISA KEV at cutoff · Update the applicable branch; Atlassian Cloud is patchedDetails
Unauthenticated arbitrary file access across eight Atlassian product families
Atlassian says an unauthenticated attacker who knows an exact path and filename can retrieve a file from the web-application root. The flaw does not itself provide directory enumeration. Affected self-managed products are Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.
Patch: Move the installed supported branch to Bitbucket 9.4.26, 10.2.8 or 10.5.1; Confluence 9.2.26 or 10.2.19; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Jira Software 9.12.40, 10.3.26 or 11.3.12; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible 4.9.15; or Fisheye 4.9.15—or a later supported release.
Temporary mitigation: Removing or restricting internet exposure and using Atlassian’s exact WAF, proxy, Tomcat RewriteValve or Bitbucket urlrewrite.xml patterns can reduce risk while updating. Do not improvise the vendor expressions or treat them as the fix.
Investigation: URL-decode access logs up to twice and use Atlassian’s traversal search or raw-log expression. If protected configuration files were accessed, contain the system and rotate exposed credentials or secrets separately from patch verification.
Cloud boundary: Atlassian says Cloud was patched and Cloud customers do not need to act on this advisory.
Atlassian advisory and fixed-version table for CVE-2026-21589. Go to the tracker record and dates.
ISC BIND · CVE-2015-5477 · CISA KEV · Known exploited · Install a supported vendor package and verify the running named service · CISA remediate-by: October 11Details
Crafted TKEY traffic can terminate recursive or authoritative DNS servers
ISC lists BIND 9.1.0–9.8.x, 9.9.0–9.9.7-P1 and 9.10.0–9.10.2-P2 as affected. ACLs and configuration limits do not prevent the assertion failure, and ISC supplied no workaround. The historical fixed builds—9.9.7-P2 and 9.10.2-P3—are not sensible 2026 deployment targets.
Patch: Use the supported distribution or appliance-vendor package. Debian bookworm is fixed at 1:9.18.49-1~deb12u1 and trixie at 1:9.20.26-1~deb13u1; later Debian security builds may supersede them. Ubuntu’s current page shows historical Trusty, Precise and Vivid fixes only; do not use those old releases as a modern target.
Running-state check: Restart or reload as the package directs, then verify both the installed package and the running named process.
Investigation: An availability-only crash does not by itself prove deeper compromise. Review repeated TKEY requests or crash patterns separately where logs permit.
ISC advisory for CVE-2015-5477; Debian package status; Ubuntu status. Go to the tracker record and dates.
Apache Struts · CVE-2016-3081 · CISA KEV · Known exploited · Move off obsolete 2.3 branches; disabling DMI is temporary · CISA remediate-by: October 11Details
Dynamic Method Invocation can enable remote code execution
The affected range is Struts 2.3.20–2.3.28, except 2.3.20.3 and 2.3.24.3, when Dynamic Method Invocation is enabled. The historical fixes—2.3.20.3, 2.3.24.3 and 2.3.28.1—are on obsolete branches.
Patch: Move the application to a currently supported Struts release rather than stopping at a historical maintenance boundary.
Workaround: Disable Dynamic Method Invocation only as temporary risk reduction while completing the supported upgrade.
Investigation: Hunt method-prefixed malicious requests and assess post-exploitation separately from update verification.
Apache Struts security bulletin S2-032. Go to the tracker record and dates.
Strapi · CVE-2023-22894 · CISA KEV · Known exploited · Move to a supported release; v3 is end of life · CISA remediate-by: October 11Details
Filter queries can expose sensitive fields and enable administrator takeover
Strapi versions 3.2.1 and later before 4.8.0 are affected. Exposed reset tokens or administrator data can enable account takeover; on older releases, chaining with CVE-2023-22621 can reach unauthenticated code execution.
Patch: Move to a currently supported Strapi release—Strapi 5 where appropriate. Version 4.8.0 is the historical fixed boundary, not a durable target for an end-of-life v3 deployment.
Investigation: Review GET query parameters for encoded or bracketed references to email, password, reset_password_token or resetPasswordToken. A match is a triage lead, not proof by itself.
Strapi security disclosure; GitHub advisory record. Go to the tracker record and dates.
ONLYOFFICE Document Server · CVE-2021-3199 · CISA KEV · Known exploited · Deploy a current supported package or image and verify it is running · CISA remediate-by: October 11Details
Path traversal can lead to remote code execution when JWT is used
The historical affected range is ONLYOFFICE Document Server before 5.6.3 when JWT is used. ONLYOFFICE’s cited changelog does not provide a workaround.
Patch: Install a currently supported ONLYOFFICE Docs release from the deployment’s official package or container channel; do not stop at the historical 5.6.3 boundary.
Running-state check: Restart or redeploy the service and verify the actual running image or package version.
Investigation: Review uploaded files, document-service processes and relevant web and application logs separately from patch verification.
ONLYOFFICE Document Server 5.6.3 changelog. Go to the tracker record and dates.
ProFTPD mod_copy · CVE-2015-3306 · CISA KEV · Known exploited · Use supported distribution packages; disabling mod_copy is temporary · CISA remediate-by: October 11Details
Unauthenticated file copy can enable arbitrary read and write
An unauthenticated remote user can issue SITE CPFR and SITE CPTO when mod_copy is enabled. The upstream historical fix was 1.3.5a, but an upstream commit alone is not a supported 2026 deployment remedy.
Patch: Use a supported distribution or vendor package. Debian bookworm is fixed at 1.3.8+dfsg-4+deb12u5 and trixie at 1.3.8.c+dfsg-4+deb13u3. Ubuntu’s listed Trusty, Precise and Vivid fixes are historical; Xenial and Yakkety were marked not affected.
Workaround: For a self-built legacy service, disable mod_copy temporarily and migrate to a supported release.
Running-state check and investigation: Confirm the installed package, loaded module and running daemon. Separately review FTP logs for SITE CPFR/SITE CPTO and inspect for unauthorized files or web shells.
Debian package status for CVE-2015-3306; Ubuntu status. Go to the tracker record and dates.
Healthcare Incident Watch
China-linked actors use automated discovery, stolen credentials and known flaws against healthcare and other critical infrastructure
On October 8, the FBI, CISA, NSA and international partners published a joint advisory on activity by China government-linked actors enabled by Integrity Technology Group. The advisory identifies U.S. critical infrastructure—including the Healthcare and Public Health sector—as a target and says the FBI observed email-data theft from healthcare systems in Southeast Asia. It does not establish that any particular reader organization was targeted.
The reported playbook combines automated internet scans, cross-site-scripting credential harvesting, password spraying against Microsoft Exchange and Office 365, SoftEther VPN for persistence, and email or database exfiltration. Recovered scripts included checks for CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199 and CVE-2023-22894.
CISA’s readable joint cybersecurity advisory AA26-281A; FBI/partner advisory PDF.
Green Clinic plans a new clinical system after ransomware limits care
Green Clinic said on October 8 that it had identified a cybersecurity incident on October 2, halted computer and network-related operations, begun containment work and determined that ransomware associated with an actor calling itself “Wall Street” or an affiliate had encrypted its network and files. Electronic health records were unavailable and the clinic was providing limited care. It notified the FBI and CISA and continued to investigate possible unauthorized access or acquisition of data.
- October 2: The clinic identified the incident.
- October 8: It publicly described the ransomware, encrypted systems, unavailable EHRs and reduced care.
- October 14 plan: The clinic expected to introduce a new clinical system and expand care. That date was announced in-window but fell after the evidence cutoff; it was not a completed recovery. Historical records and schedules were not expected to be restored immediately.
The clinic told patients to call 911 or go to an emergency department for emergencies and, where possible, bring medication and insurance information. That patient guidance should not be read as a general clinical protocol for other organizations.
Green Clinic’s October 8 statement, republished by Lincoln Parish Journal.
Photon Health notifies people after a previously unknown Metabase flaw exposed dashboard data
Photon Health’s notice was distributed October 8 at 9:00 p.m. ET. The company said it learned on August 21 that an unauthorized third party had exploited a previously unknown flaw in its self-hosted Metabase business-intelligence and customer-dashboard environment. Photon completed its review on September 4. The in-window development is the notification and public disclosure—not the earlier access or review.
Photon said names, addresses, phone numbers, dates of birth and prescription medication information may have been exposed. It said Social Security numbers and financial information were not involved and that it had no evidence of misuse as of the notice. Photon’s notice does not identify whether the company acted as a covered entity or business associate, or who handled notification. Those facts are needed before assessing HIPAA duties, and the notice does not establish a violation.
AI & Clinical Automation
Utah adds a healthcare pillar and named pilots to its AI regulatory sandbox
On October 5, the Utah Department of Commerce announced a healthcare pillar, six independent evaluators and five regulatory mitigation agreements lasting one to three years. University of Utah Health and Intermountain Health received umbrella agreements for future pilots that must be individually vetted; the agreements are not blanket authorization or evidence that a product is safe or effective.
Named pilots include Nolla Health’s acne assessment under specialist oversight, Expect Fitness’s postpartum and pelvic-health physical therapy, and August AI’s routine non-controlled prescription refills subject to physician review. Utah says required safeguards include telling patients when AI is used, specialty malpractice coverage, 24-hour incident-response plans, preservation of legal remedies, state oversight and public or legislative data sharing.
UK backs lifecycle oversight for healthcare AI and opens the next AI Airlock phase
On October 6, the UK government and MHRA accepted all 44 recommendations from the National Commission into the Regulation of AI in Healthcare. The response emphasizes monitoring across a product’s life rather than relying only on one-time assessment. It is a UK policy development, not a U.S. requirement.
Applications opened for AI Airlock Phase 3, with a prospective-applicant webinar on October 22 and a first wave planned for November. MHRA also committed to draft change-management guidance by December 2026, a qualification and classification consultation in 2027, and an implementation roadmap by spring 2027.
FDA’s still-open generative-AI medical-device request for feedback is listed under Active / Ongoing with its October 19 deadline.
Regulatory & Privacy
NSA publishes zero-trust guidance for operational technology
NSA’s October 8 sheet advises national-security systems, Department of War networks and the defense industrial base to assume breach and continuously verify users, devices, workflows and communications in operational technology. The goal is to reduce unauthorized access, lateral movement and persistence in systems that often include legacy components.
Hospitals can use the design questions when reviewing building automation, facilities OT and connected clinical environments, but this is voluntary technical guidance—not a regulation, privacy requirement or healthcare mandate. It does not establish that every medical device can implement native zero trust. Segmentation, identity or monitoring changes around clinical technology need safety, availability and vendor-support validation before implementation.
NSA announcement and scope; NSA operational-technology zero-trust guidance PDF.
This week
S. 3315, Health Care Cybersecurity and Resiliency Act · Passed Senate; received in House and held at the desk October 5 · Not law · Track House actionDetails
House receipt is movement, not enactment
Congress.gov records House receipt at 4:32 p.m. and “Held at the desk” at 5:02 p.m. on October 5. The bill passed the Senate on September 30, but it has not passed the House or become law. Proposed coordination, minimum-practice, grant and breach-notice provisions are not current obligations.
Deadline: No next House action date is announced.
Congress.gov action history for S. 3315; engrossed Senate bill text.
HHS OCR–Shen Smiles settlement · $140,000 entity-specific HIPAA resolution announced October 8 · No reader deadline · Check access, training, physical safeguards and records accountabilityDetails
A patient access complaint exposed broader privacy-program failures
HHS announced a $140,000 resolution agreement with Shen Smiles, a Pennsylvania dental covered entity. OCR’s findings included missing Right of Access, Privacy Rule and Breach Notification policies; no formal workforce privacy training; and paper records kept in clear plastic boxes in a hygienist office, on the floor and in a private bathroom. Records moved among offices and the dentist’s home and were regularly missing.
- April 21, 2020: OCR received the former patient’s complaint after repeated access requests.
- November 2023: OCR completed its investigation and notified the practice of its findings.
- July 31, 2024: OCR issued its Notice of Proposed Determination.
- August 11, 2026: The parties dated the resolution agreement.
- October 8, 2026: HHS announced the settlement.
The practice had asserted that a former workforce member stole records, but the October announcement was not a newly discovered breach. HIPAA access requests are generally due within 30 calendar days, with one possible written 30-day extension; applicability should be evaluated against the actual request and extension record.
HHS announcement of the Shen Smiles resolution; OCR Notice of Proposed Determination and case materials.
Active / Ongoing
FDA generative-AI-enabled medical devices discussion paper · Open for feedback · Comments due October 19, 2026 · Decide whether to submit evidence on risk, review and monitoringDetails
Discussion paper and request for feedback—not guidance
Docket FDA-2026-N-7874 asks for input on risk assessment, premarket evaluation and postmarket monitoring for generative-AI-enabled medical devices. FDA lists October 19 as the comment deadline but does not state an exact closing time on the cited page.
FDA draft guidance on robotically assisted surgical devices · Draft; open for comment · Comments due November 24, 2026 · Assess evidence on testing, clinical data and labelingDetails
Draft premarket recommendations remain nonbinding and not for implementation
Docket FDA-2026-N-9505 covers premarket submissions for teleoperated, software-controlled robotically assisted surgical devices. A draft guidance is neither a final rule nor an operative requirement.
FDA robotic-device benefit-risk workshop · Registration open · In-person registration closes November 23 or earlier at capacity; virtual registration remains open · Workshop December 2–3, 10 a.m.–4 p.m. ETDetails
Public workshop on autonomous functions and remote teleoperation
FDA plans a hybrid workshop on benefit-risk evaluation for robotic medical devices with autonomous functions or remote teleoperation. The agenda and pre-workshop materials were still forthcoming when verified. This is a policy discussion, not a current cybersecurity rule.
FDA CDRH FY2027 proposed guidance priorities · Open for comment · Comments due November 30, 2026 · Suggest or rank guidance topics; the lists are not guidanceDetails
CDRH asks for input on its A-list, B-list and under-construction priorities
CDRH published proposed publication and development priorities on October 5 under docket FDA-2012-N-1021. Inclusion on a list does not create guidance or a current obligation.
FDA CDRH FY2027 proposed guidance priorities and docket information.
Standing Watch
CISA CIRCIA final rule · Pending; no announced date · Mandatory CIRCIA reporting does not apply until the final rule takes effect · Maintain readiness and watch CISA’s pageDetails
No current CIRCIA reporting duty under the unfinished rule
CISA says it continues work on the final rule and has not announced a final-rule date. Healthcare organizations can maintain incident-reporting readiness without treating proposed requirements as operative.
HHS HIPAA Security Rule NPRM · Pending proposal; current rule remains in effect · Unified Agenda estimates Final Action in July 2027; Legal Deadline: None · Keep proposal and current duties separateDetails
Rulemaking remains pending
The current HIPAA Security Rule remains in effect. The official Unified Agenda lists the rule under Long-Term Actions, estimates Final Action in July 2027 and states “Legal Deadline: None.” That estimate is not a final-rule publication date, effective date, compliance date or legal deadline.
HHS HIPAA Security Rule NPRM page; official Unified Agenda entry for RIN 0945-AA22.
Clinical Engineering & Medical Device Watch
Philips Lumify Early Alert: unexpected re-registration and unstable USB connections can delay scanning
FDA posted an Early Alert on October 9 for listed iOS and Android Lumify versions. A transducer can unexpectedly require re-registration, which needs Wi-Fi or cellular service before scanning, and USB connections may disconnect or become unstable. The risk is greater in ambulances, aircraft and field settings where signal may be unreliable.
As of September 29, Philips reported eight serious injuries and four deaths associated with the issue. FDA and Philips advise using Lumify only where signal is readily available unless a backup ultrasound device is immediately available, maintaining backup ultrasound or other imaging capacity, and circulating or posting the customer letter. Philips was developing a software update; none was available in the notice.
Classification boundary: FDA calls this a potentially high-risk Early Alert. It is not a formally classified Class I recall and does not enter the Class I Standing Watch below.
BD Alaris update adds affected sets and low-rate performance detail
FDA’s October 5 update says some restrictive Alaris pump infusion sets perform worse than previously disclosed, especially below 1 mL/h and at bolus volumes of 5 mL or less. Possible outcomes include under- or over-infusion, delayed occlusion alarms and inaccurate bolus delivery. FDA reported no serious injuries or deaths as of August 19.
Identify and discard discontinued sets, use clinically appropriate alternatives, and prioritize critical-care, neonatal, infant and pediatric settings when alternatives are limited. Review BD’s exact performance disclosures rather than substituting a generic pump-setting change. The Class I event remains in Standing Watch; the material update did not reset its finite Newsletter Drop Date.
Class I Standing Watch
This watch contains every formally classified Class I event in the scoped continuity set whose finite routine display date has not passed. A record normally leaves this display on its item-specific Newsletter Drop Date unless a sourced material development supports a new date. Leaving routine display does not mean the recall ended, the device is safe or remediation is complete.
CooperSurgical INCA infant/neonatal CPAP sets · FDA Class I · Open/Classified · Stop, segregate and return affected sets · Newsletter Drop Date: October 19Details
Loose tubing connection can interrupt CPAP
Identity: FDA event 99643; recall numbers Z-3139-2026 and Z-3140-2026. FDA database records list 13,215 complete sets and 745 replacement sets.
Risk: A loose connection can cause loss of CPAP and decreased oxygenation. FDA reported no serious injuries or deaths as of August 11.
- Last material update
- September 18, 2026—FDA posting and Class I classification
- Next review
- October 19, 2026
- Newsletter Drop Date
- October 19, 2026—not recall closure or a vendor deadline
FDA CooperSurgical INCA alert; FDA event 99643 and exact records.
AVID/Halyard kits containing recalled sodium chloride ampules · FDA Class I · Open/Classified · Quarantine, label and remove affected ampules · Newsletter Drop Date: October 15Details
Convenience kits include ampules recalled for a quality and sterility concern
Identity: FDA event 99758.
- Last material update
- September 16, 2026—FDA posting and Class I classification
- Next review
- October 15, 2026
- Newsletter Drop Date
- October 15, 2026—not recall closure or a vendor deadline
FDA event 99758 and kit records; FDA sodium chloride ampule removal notice.
Abiomed Impella controllers · FDA Class I · Open/Classified · Continue inventory while awaiting service; use backup controller if the purge alarm does not clear · Newsletter Drop Date: October 14Details
Phased controller service action addresses purge-cassette recognition failures
Identity: FDA event 99671; recall numbers Z-3148-2026, Z-3149-2026 and Z-3150-2026. FDA says all Automated Impella Controller units globally are in scope of a phased removal and service action.
Risk: A purge-flag component can fail, preventing purge-cassette recognition. Exchanging controllers briefly interrupts support.
- Last material update
- September 16, 2026—FDA posting and classification of three records
- Next review
- October 14, 2026
- Newsletter Drop Date
- October 14, 2026—not recall closure or a vendor deadline
FDA Impella controller alert and action; FDA event 99671 records.
BD Alaris pump infusion sets · FDA Class I · Open/Classified · October 5 material update · Discard discontinued sets and prioritize alternatives for high-risk care · Newsletter Drop Date: October 13Details
Updated performance measures expand the operational picture
Identity: FDA event 99298. Scope includes listed BD Alaris Pump Infusion Sets compatible with Pump Module model 8100 and Guardrails Suite MX through version 12.6; use FDA’s current spreadsheet and customer letter for exact products.
Risk: Some restrictive sets perform worse than previously disclosed, especially below 1 mL/h and at bolus volumes of 5 mL or less, creating possible under- or over-infusion, delayed occlusion alarms and inaccurate bolus delivery. FDA reported no serious injuries or deaths as of August 19.
- Last material update
- October 5, 2026—FDA added affected products, current actions and updated performance measures
- Next review
- October 13, 2026
- Newsletter Drop Date
- October 13, 2026—preserved despite the October 5 update; not recall closure or a vendor deadline
FDA BD Alaris recall page and current action; FDA affected-product list for BD Alaris infusion sets; BD customer letter with performance data and instructions; FDA event 99298 records.
Boston Scientific Imager II angiographic catheters · FDA Class I · Open/Classified · Stop, segregate, verify UPN and lot, and return affected product · Newsletter Drop Date: October 23Details
Catheter-tip degradation can cause detachment
Identity: FDA event 99687; recall number Z-3214-2026.
Risk: Reduced stabilizing agents can permit tip degradation and detachment. FDA says the most likely result is delay while exchanging the catheter; a remote worst case includes embolism and organ failure. As of July 16, FDA reported two serious injuries and no deaths.
- Last material update
- September 25, 2026—FDA Class I classification
- Next review
- October 23, 2026
- Newsletter Drop Date
- October 23, 2026—not recall closure or a vendor deadline
FDA Imager II removal notice; FDA affected-device list with Imager II UPNs and lots; FDA event 99687 records.
Draeger VentStar Resus Neo hoses, model MP00310 · FDA Class I · Open/Classified · Inspect before use and discard cracked or detached hoses · Newsletter Drop Date: October 30Details
Cracked or detached neonatal resuscitation hose can restrict ventilation
Identity: FDA event 99787; model MP00310, UDI 04048675422358, for infants up to 22 lb.
Risk: A cracked or detached hose can restrict ventilation or delay therapy, leading to desaturation, hypoxia or death. Draeger reported no serious injuries or deaths as of September 3.
- Last material update
- October 2, 2026—FDA update formally classified the event as Class I
- Next review
- October 19, 2026
- Newsletter Drop Date
- October 30, 2026—not recall closure or a vendor deadline
FDA Draeger VentStar Resus Neo removal notice; FDA event 99787 record.
CVE Tracker
A record is labeled NEW only when its first public disclosure falls inside this reporting window. The five October 8 KEV changes below are new catalog additions for older vulnerabilities, not newly disclosed flaws. Open any record for applicability, dates, remediation and primary links.
New this issue
NEW · Atlassian self-managed products · CVE-2026-21589 · CVSS 4.0 9.3 · Not in CISA KEV at cutoff · Update self-managed branches; Cloud is patched · No CISA remediate-by date at cutoff · Newsletter Drop Date: November 9Details
CVE-2026-21589 — arbitrary file access
- Disclosure
- October 5, 2026—inside this window
- First CCD tracking
- October 12, 2026; no prior newsletter appearance is established
- Last material update
- October 5, 2026
- CISA status
- Not listed in KEV catalog version 2026.10.08; no CISA remediate-by date
- Newsletter Drop Date
- November 9, 2026
Affected self-managed families are Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. The attacker must know a precise path and filename; the flaw does not enumerate directories.
Read the fixed-version and investigation detail in Priority CVEs. Atlassian primary advisory.
NEW KEV ADDITION · ISC BIND · CVE-2015-5477 · CISA KEV · Known exploited · Install a supported package and verify named is running it · CISA remediate-by: October 11 · Newsletter Drop Date: November 9Details
CVE-2015-5477 — BIND TKEY denial of service
- Current event
- CISA added the historical vulnerability to KEV on October 8, 2026
- First CCD tracking
- October 12, 2026; no prior newsletter appearance is established
- CISA remediate-by
- October 11, 2026—federal civilian agency directive, not a universal private-sector deadline
- Newsletter Drop Date
- November 9, 2026
ISC lists BIND 9.1.0–9.8.x, 9.9.0–9.9.7-P1 and 9.10.0–9.10.2-P2. ACLs do not prevent the crafted TKEY crash, and ISC supplied no workaround.
1:9.18.49-1~deb12u1 and trixie at 1:9.20.26-1~deb13u1; later Debian security builds may supersede them. Investigate repeated crash traffic separately.NEW KEV ADDITION · Apache Struts · CVE-2016-3081 · CISA KEV · Known exploited · Move to a supported release; disable DMI only temporarily · CISA remediate-by: October 11 · Newsletter Drop Date: November 9Details
CVE-2016-3081 — Dynamic Method Invocation RCE
- Current event
- CISA added the historical vulnerability to KEV on October 8, 2026
- First CCD tracking
- October 12, 2026; no prior newsletter appearance is established
- CISA remediate-by
- October 11, 2026—federal civilian agency directive
- Newsletter Drop Date
- November 9, 2026
Struts 2.3.20–2.3.28 is affected, except 2.3.20.3 and 2.3.24.3, when Dynamic Method Invocation is enabled. Those old branches are obsolete.
Read the complete Priority CVE record. Apache bulletin S2-032.
NEW KEV ADDITION · Strapi · CVE-2023-22894 · CISA KEV · Known exploited · Move to a supported release; v3 is EOL · CISA remediate-by: October 11 · Newsletter Drop Date: November 9Details
CVE-2023-22894 — sensitive-data exposure and administrator takeover
- Current event
- CISA added the historical vulnerability to KEV on October 8, 2026
- First CCD tracking
- October 12, 2026; no prior newsletter appearance is established
- CISA remediate-by
- October 11, 2026—federal civilian agency directive
- Newsletter Drop Date
- November 9, 2026
Strapi 3.2.1 and later before 4.8.0 is affected. Strapi v3 is end of life, and older versions can be chained with CVE-2023-22621.
NEW KEV ADDITION · ONLYOFFICE Document Server · CVE-2021-3199 · CISA KEV · Known exploited · Deploy a current supported package or image and verify it is running · CISA remediate-by: October 11 · Newsletter Drop Date: November 9Details
CVE-2021-3199 — path traversal and remote code execution
- Current event
- CISA added the historical vulnerability to KEV on October 8, 2026
- First CCD tracking
- October 12, 2026; no prior newsletter appearance is established
- CISA remediate-by
- October 11, 2026—federal civilian agency directive
- Newsletter Drop Date
- November 9, 2026
The historical condition is Document Server before 5.6.3 with JWT in use. ONLYOFFICE’s cited changelog does not provide a workaround.
Read the complete Priority CVE record. ONLYOFFICE changelog.
NEW KEV ADDITION · ProFTPD mod_copy · CVE-2015-3306 · CISA KEV · Known exploited · Use supported packages; disabling mod_copy is temporary · CISA remediate-by: October 11 · Newsletter Drop Date: November 9Details
CVE-2015-3306 — unauthenticated arbitrary file copy
- Current event
- CISA added the historical vulnerability to KEV on October 8, 2026
- First CCD tracking
- October 12, 2026; no prior newsletter appearance is established
- CISA remediate-by
- October 11, 2026—federal civilian agency directive
- Newsletter Drop Date
- November 9, 2026
The flaw permits unauthenticated SITE CPFR/SITE CPTO use when mod_copy is enabled. An upstream commit alone is not a supported remediation.
1.3.8+dfsg-4+deb12u5 and trixie at 1.3.8.c+dfsg-4+deb13u3. For a self-built legacy service, disable mod_copy only while migrating. Verify the loaded module and running daemon, then inspect FTP logs and unexpected files separately.How to read the dates: A Newsletter Drop Date is the end of routine display in this tracker; it is not a patch deadline or proof that remediation is complete. CISA remediate-by dates apply to federal civilian agencies and are shown separately. A fresh check alone does not reset either tracking date.
Continuing Watch
These records remain inside their preserved finite tracking terms. Product ownership, hosting model, configuration and exact supported branch determine whether an action applies.
Newsletter Drop Date: October 19
Cisco Secure Email Gateway · CVE-2026-76461 · CVSS 3.1 9.8 · CISA KEV · Known exploited · Upgrade customer-managed appliances; Cisco cloud was updated · CISA remediate-by: September 17 · Drop: October 19Details
CVE-2026-76461 — Secure Email Gateway injection
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 17, 2026
- KEV added
- September 14, 2026
- CISA remediate-by
- September 17, 2026
- Newsletter Drop Date
- October 19, 2026
Cisco Identity Services Engine and ISE-PIC · CVE-2026-76460 · CVSS 3.1 10.0 · CISA KEV · Known exploited · Install the exact branch patch; migrate ISE 3.0 · CISA remediate-by: September 19 · Drop: October 19Details
CVE-2026-76460 — authentication bypass in identity infrastructure
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 16, 2026
- KEV added
- September 16, 2026
- CISA remediate-by
- September 19, 2026
- Newsletter Drop Date
- October 19, 2026
access.log on every node and external telemetry; re-image affected nodes if malicious activity is suspected.Acronis Backup control-panel plugins · CVE-2026-87886 · CVSS 3.0 7.8 · CISA KEV · Known exploited · Update the applicable cPanel, Plesk or DirectAdmin extension · CISA remediate-by: September 19 · Drop: October 19Details
CVE-2026-87886 — locally exploitable backup extension flaw
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 17, 2026
- KEV added
- September 16, 2026
- CISA remediate-by
- September 19, 2026
- Newsletter Drop Date
- October 19, 2026
Google Pixel cellular modem · CVE-2026-58704 · CISA KEV · Known exploited · Update supported devices to patch level 2026-09-05 or later · CISA remediate-by: September 19 · Drop: October 19Details
CVE-2026-58704 — Pixel modem vulnerability
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 16, 2026
- KEV added
- September 16, 2026
- CISA remediate-by
- September 19, 2026
- Newsletter Drop Date
- October 19, 2026
Google reported indications of limited, targeted exploitation.
Linux kernel AF_ALG · CVE-2025-39964 · CISA KEV · Known exploited · Use exact distro or appliance fixes and verify the running kernel · CISA remediate-by: September 21 · Drop: October 19Details
CVE-2025-39964 — AF_ALG kernel flaw
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 18, 2026
- KEV added
- September 18, 2026
- CISA remediate-by
- September 21, 2026
- Newsletter Drop Date
- October 19, 2026
Exact distribution release, kernel package/flavor and product support path control applicability. Embedded appliances need the appliance maker’s firmware or advisory unless that vendor explicitly supports a distribution kernel.
Patch examples: Ubuntu: 25.04 generic 6.14.0-37.37; 24.04 generic 6.8.0-90.91; 22.04 generic 5.15.0-164.174; 20.04 generic 5.4.0-224.244; 18.04 generic 4.15.0-245.257; 16.04 generic 4.4.0-276.310. Debian: bullseye 5.10.247-1; bookworm 6.1.158-1 (DSA-6053-1); trixie 6.12.57-1; bullseye linux-6.1 6.1.158-1~deb11u1. SUSE: SLES 15 SP7 kernel-default ≥ 6.4.0-150700.53.81.1; SLES 16.0 ≥ 6.12.0-160000.37.1; SLES 15 SP6 LTSS ≥ 6.4.0-150600.23.92.1; SLES 12 SP5 LTSS ≥ 4.12.14-122.296.1.
Qualification: Ubuntu cloud, HWE and vendor flavors and SUSE cloud/image branches have separate status. Red Hat says no mitigation meets its criteria, and its advisory does not publish a fixed-package table; use Red Hat’s product-specific status.
Verification and investigation: Follow reboot guidance and verify the running kernel. Patching does not determine prior compromise; investigate that separately.
Linux kernel ebtables SNAT · CVE-2026-53266 · CISA KEV · Known exploited · Patch exact kernel flavor; remove affected ARP SNAT rules only as a workaround · CISA remediate-by: September 21 · Drop: October 19Details
CVE-2026-53266 — ebtables SNAT kernel flaw
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 18, 2026
- KEV added
- September 18, 2026
- CISA remediate-by
- September 21, 2026
- Newsletter Drop Date
- October 19, 2026
Red Hat says exposure requires bridge-netfilter ebtables SNAT rules that rewrite ARP hardware addresses. Exact distribution, release and flavor still control status; embedded appliances need vendor-supported firmware.
Patch examples: Ubuntu 26.04 generic 7.0.0-31.31 and 24.04 HWE 7.0 7.0.0-31.31~24.04.1. Ubuntu still marked generic 24.04, 22.04 and 20.04 and many cloud flavors as vulnerable or work in progress, so those two examples are not universal Ubuntu remediation. SUSE: SLES 15 SP7 kernel-default ≥ 6.4.0-150700.53.66.1; SLES 16.0 ≥ 6.12.0-160000.36.1; SLE Micro 6.0/6.1 ≥ 6.4.0-49.1; SLE Micro 6.2 ≥ 6.12.0-160000.36.1. Debian lists DLA-4664-1, DLA-4665-1 and DLA-4671-1 without a consolidated fixed-version table; use the advisory for the installed release.
Workaround: Where the Red Hat condition applies and a patch is pending, remove or disable ARP hardware-address rewriting in the affected rules. This is not the patch.
Verification and investigation: Reboot as directed, verify the running kernel and investigate possible prior compromise separately.
Linux kernel TLS receive path · CVE-2025-39682 · CISA KEV · Known exploited · Match kTLS applicability and exact distro flavor; verify the running kernel · CISA remediate-by: September 21 · Drop: October 19Details
CVE-2025-39682 — kernel TLS receive-path flaw
- First CCD tracking
- September 21, 2026; no prior newsletter appearance is established
- Last material update
- September 18, 2026
- KEV added
- September 18, 2026
- CISA remediate-by
- September 21, 2026
- Newsletter Drop Date
- October 19, 2026
Red Hat says the trigger requires the kTLS ULP. That is an applicability condition, not a workaround or a reason to remove the KEV status. Appliance firmware and exact distro flavor remain controlling.
Patch examples: Ubuntu: 25.04 generic 6.14.0-34.34; 24.04 generic 6.8.0-86.87; 22.04 HWE 6.8 6.8.0-86.87~22.04.1; 22.04, 20.04 and 18.04 generic were marked not affected. Debian: bullseye not affected; bookworm 6.1.153-1 (DSA-6009-1); trixie 6.12.48-1 (DSA-6008-1); bullseye linux-6.1 6.1.153-1~deb11u1; unstable 6.16.5-1. SUSE: SLES 15 SP6 kernel-default ≥ 6.4.0-150600.23.73.1; SLES 15 SP7 ≥ 6.4.0-150700.53.19.1; SLES 16.0 ≥ 6.12.0-160000.6.1; SLE Micro 6.0/6.1 ≥ 6.4.0-35.1.
Qualification: Cloud, HWE and vendor branches have separate status. Red Hat’s advisory does not publish a fixed-package table; use its product-specific status.
Verification and investigation: Reboot as directed, verify the running kernel and investigate possible prior compromise separately.
Newsletter Drop Date: October 26
Zyxel GS1900 switches · CVE-2026-7273 · CISA KEV · Known exploited · Apply model-specific firmware and restrict management to trusted LANs · CISA remediate-by: September 24 · Drop: October 26Details
CVE-2026-7273 — GS1900 stack-based buffer overflow
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 21, 2026—KEV addition; vendor disclosure was June 16
- CISA remediate-by
- September 24, 2026
- Newsletter Drop Date
- October 26, 2026
2.90(...2)C0 fixed firmware from Zyxel’s table for the ten listed GS1900 models, and restrict management to trusted LANs until upgraded.Check Point Security Gateways and Spark · CVE-2026-85102 · CVSS 3.1 9.8 · CISA KEV · Known exploited · Apply the exact supported-branch fix and investigate exposed systems · CISA remediate-by: September 25 · Drop: October 26Details
CVE-2026-85102 — exploited gateway flaw
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 22, 2026
- KEV added
- September 22, 2026
- CISA remediate-by
- September 25, 2026
- Newsletter Drop Date
- October 26, 2026
Check Point Security Management · CVE-2026-93616 · CVSS 3.1 9.8 · CISA KEV · Known exploited · Apply the exact management fix and review exposure and logs · CISA remediate-by: September 25 · Drop: October 26Details
CVE-2026-93616 — pre-authentication management vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 22, 2026
- KEV added
- September 22, 2026
- CISA remediate-by
- September 25, 2026
- Newsletter Drop Date
- October 26, 2026
Arista VeloCloud Orchestrator · CVE-2026-93952 · CVSS 3.1 10.0 · CISA KEV · Known exploited · Patch on-prem VCO; hosted service was patched · CISA remediate-by: September 25 · Drop: October 26Details
CVE-2026-93952 — VeloCloud Orchestrator compromise
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 22, 2026
- KEV added
- September 22, 2026
- CISA remediate-by
- September 25, 2026
- Newsletter Drop Date
- October 26, 2026
F5 BIG-IP APM · CVE-2026-94127 · CISA KEV · Known exploited · Apply F5’s branch-specific fix; vendor iRule is detection support, not a patch · CISA remediate-by: September 25 · Drop: October 26Details
CVE-2026-94127 — BIG-IP APM vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 22, 2026
- KEV added
- September 22, 2026
- CISA remediate-by
- September 25, 2026
- Newsletter Drop Date
- October 26, 2026
Applicability includes an access policy and OAuth profile; match the installed branch and configuration to F5’s table.
WSO2 products · CVE-2026-5430 · CISA KEV · Known exploited · Use WSO2’s exact product and update-level table · CISA remediate-by: September 27 · Drop: October 26Details
CVE-2026-5430 — unsupported JWT algorithm authentication bypass
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Vendor disclosure
- May 3, 2026
- KEV added / last material update
- September 24, 2026
- CISA remediate-by
- September 27, 2026
- Newsletter Drop Date
- October 26, 2026
Adobe Commerce and Magento Open Source · CVE-2026-71362 · CISA KEV · Known exploited · Apply Adobe’s fixed release for the installed 2.4.x branch · CISA remediate-by: September 27 · Drop: October 26Details
CVE-2026-71362 — Adobe Commerce / Magento vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Vendor disclosure
- August 11, 2026
- KEV added / last material update
- September 24, 2026
- CISA remediate-by
- September 27, 2026
- Newsletter Drop Date
- October 26, 2026
MikroTik RouterOS · CVE-2026-67279 · CISA KEV · Known exploited · Upgrade exact branch, restrict SSH and review flagged changes · CISA remediate-by: September 28 · Drop: October 26Details
CVE-2026-67279 — exact KEV identity in a multi-flaw RouterOS chain
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 25, 2026
- KEV added
- September 25, 2026
- CISA remediate-by
- September 28, 2026
- Newsletter Drop Date
- October 26, 2026
CISA’s KEV identity is CVE-2026-67279. MikroTik’s chain page also names related identities, so do not assign every step in the chain to this one CVE.
Microsoft SharePoint Server · CVE-2026-65660 · CVSS 3.1 8.8 · CISA KEV · Known exploited · Install both required KBs where specified and verify the build · CISA remediate-by: September 28 · Drop: October 26Details
CVE-2026-65660 — exploited SharePoint vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Last material update
- September 25, 2026
- KEV added
- September 25, 2026
- CISA remediate-by
- September 28, 2026
- Newsletter Drop Date
- October 26, 2026
WordPress Core · CVE-2026-87902 · CISA KEV · Known exploited · Update to 7.1.2 or the supported-branch backport; preserve configuration conditions · CISA remediate-by: September 28 · Drop: October 26Details
CVE-2026-87902 — WordPress Core vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Disclosure / last material update
- September 25, 2026
- KEV added
- September 25, 2026
- CISA remediate-by
- September 28, 2026
- Newsletter Drop Date
- October 26, 2026
page-; the PEAR route also depends on register_argc_argv being on.Citrix NetScaler ADC and Gateway · CVE-2026-88771 · CVSS 4.0 9.5 · CISA KEV · Known exploited · Upgrade exact branch and investigate independently · CISA remediate-by: September 30 · Drop: October 26Details
CVE-2026-88771 — exploited NetScaler vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Disclosure / last material update
- September 27, 2026
- KEV added
- September 27, 2026
- CISA remediate-by
- September 30, 2026
- Newsletter Drop Date
- October 26, 2026
Citrix NetScaler ADC and Gateway with DTLS · CVE-2026-88772 · CVSS 4.0 9.5 · CISA KEV · Known exploited · Upgrade exact branch and verify DTLS exposure · CISA remediate-by: September 30 · Drop: October 26Details
CVE-2026-88772 — DTLS-conditioned NetScaler vulnerability
- First CCD tracking
- September 28, 2026; no prior newsletter appearance is established
- Disclosure / last material update
- September 27, 2026
- KEV added
- September 27, 2026
- CISA remediate-by
- September 30, 2026
- Newsletter Drop Date
- October 26, 2026
Applicability requires DTLS, including default behavior on VPN virtual servers.
ServiceNow AI Platform · CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859 and CVE-2026-86860 · CVSS 4.0 8.4–9.3 · Not in CISA KEV at cutoff · Hosted updated; self-hosted teams must map to exact fixed floors · No CISA remediate-by date at cutoff · Drop: October 26Details
Five distinct ServiceNow identities
CVE-2026-86857 (8.4); CVE-2026-86858 (8.7); CVE-2026-13016 (9.3); CVE-2026-86859 (8.7); and CVE-2026-86860 (9.3) were first tracked September 28. No prior newsletter appearance is established. Their last material update was September 24 and their Newsletter Drop Date is October 26.
ServiceNow reported no known malicious exploitation. Hosted instances were updated.
ServiceNow KB3159623 fixed-version mapping; CNA records for 86857, 86858, 13016, 86859 and 86860.
Newsletter Drop Date: November 2
Apple CoreGraphics · CVE-2026-86950 · CISA KEV · Known exploited · Install the applicable fixed Apple release · CISA remediate-by: October 2 · Drop: November 2Details
CVE-2026-86950 — malicious-file code execution
- First CCD tracking
- October 5, 2026; no prior newsletter appearance is established
- Disclosure
- September 28, 2026
- Last material update
- September 29, 2026—KEV addition
- CISA remediate-by
- October 2, 2026
- Newsletter Drop Date
- November 2, 2026
Supported devices older than iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1 are in scope. Apple described possible use against specific targeted individuals on iOS before iOS 27.
Apple iOS/iPadOS advisory; macOS Tahoe advisory; macOS Sequoia advisory.
Cisco Catalyst SD-WAN Manager · CVE-2026-76504 · CVSS 3.1 9.8 · CISA KEV · Known exploited · Upgrade exact branch; Live Protect is partial and temporary · CISA remediate-by: October 3 · Drop: November 2Details
CVE-2026-76504 — administrator-level authentication bypass
- First CCD tracking
- October 5, 2026; no prior newsletter appearance is established
- Disclosure
- September 30, 2026
- Last material update
- October 2, 2026
- KEV added
- September 30, 2026
- CISA remediate-by
- October 3, 2026
- Newsletter Drop Date
- November 2, 2026
serviceproxy-access.log and vmanage-server.log for encoded j_security_check requests and viptela-reserved users; preserve admin-tech evidence.Fortinet FortiMail · CVE-2026-104286 · Numeric CVSS not stated in the cited Fortinet advisory · CISA KEV · Known exploited · Follow current fixed-release table or exact temporary mitigation · CISA remediate-by: October 4 · Drop: November 2Details
CVE-2026-104286 — unauthenticated arbitrary file write
- First CCD tracking
- October 5, 2026; no prior newsletter appearance is established
- Disclosure / last material update
- October 1, 2026
- KEV added
- October 1, 2026
- CISA remediate-by
- October 4, 2026
- Newsletter Drop Date
- November 2, 2026
FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9 are affected.
Zammad · CVE-2026-102489 · CISA KEV · Known exploited · Consult current vendor releases; cited vendor page does not state exact fixed branches · CISA remediate-by: October 5 · Drop: November 2Details
CVE-2026-102489 — session fixation and code execution as the Zammad user
- First CCD tracking
- October 5, 2026; no prior newsletter appearance is established
- Last material update / KEV added
- October 2, 2026
- First public disclosure
- Not stated on the cited CISA or Zammad pages
- CISA remediate-by
- October 5, 2026
- Newsletter Drop Date
- November 2, 2026
Zammad · CVE-2026-102490 · CISA KEV · Known exploited · Consult current vendor releases and investigate possible root compromise · CISA remediate-by: October 5 · Drop: November 2Details
CVE-2026-102490 — local Zammad-user to root escalation
- First CCD tracking
- October 5, 2026; no prior newsletter appearance is established
- Last material update / KEV added
- October 2, 2026
- First public disclosure
- Not stated on the cited CISA or Zammad pages
- CISA remediate-by
- October 5, 2026
- Newsletter Drop Date
- November 2, 2026
Citrix NetScaler ADC and Gateway with SAML · CVE-2026-88779 · CVSS 4.0 8.7 · CISA KEV · Known exploited · Upgrade the applicable customer-managed branch; Citrix cloud was updated · CISA remediate-by: October 7 · Drop: November 2Details
CVE-2026-88779 — SAML-conditioned denial of service
- First CCD tracking
- October 5, 2026; no prior newsletter appearance is established
- Disclosure
- October 3, 2026
- Last material update / KEV added
- October 4, 2026
- CISA remediate-by
- October 7, 2026
- Newsletter Drop Date
- November 2, 2026
Applicability is customer-managed NetScaler ADC or Gateway configured as a SAML service provider or identity provider. Citrix-managed cloud is provider-updated.
Sources
This issue covers events from October 5 through October 11, 2026, Eastern time. Dates beside individual developments distinguish disclosure, incident, review, notification, classification, deadline and later verification.
Primary source index and date context
Campaign and healthcare incidents
- CISA joint advisory AA26-281A — published October 8, 2026.
- FBI and partner advisory PDF — October 8, 2026.
- Green Clinic statement republished by Lincoln Parish Journal — October 8 update about an incident identified October 2.
- Photon Health notice — distributed October 8 at 9:00 p.m. ET.
AI and clinical automation
- Utah Department of Commerce healthcare AI sandbox announcement — October 5, 2026.
- UK government response to the healthcare AI commission — October 6, 2026.
Regulatory and privacy
- Congress.gov actions for S. 3315 — House receipt and held-at-desk entries on October 5, 2026.
- Engrossed Senate text of S. 3315.
- HHS OCR Shen Smiles settlement announcement — October 8, 2026.
- Shen Smiles Notice of Proposed Determination and enforcement materials.
- FDA generative-AI medical-device discussion paper and request for feedback — comments due October 19, 2026.
- FDA draft guidance on robotically assisted surgical devices — comments due November 24, 2026.
- FDA robotic-device benefit-risk workshop — December 2–3; in-person registration closes November 23 or at capacity.
- FDA CDRH FY2027 proposed guidance priorities — published October 5; comments due November 30.
- CISA CIRCIA status page — CISA says final rulemaking remains in progress; no date has been announced.
- HHS HIPAA Security Rule NPRM page — proposal pending; current rule remains in effect.
- Official Unified Agenda entry for the HIPAA Security Rule NPRM — lists a July 2027 Final Action estimate under Long-Term Actions and Legal Deadline: None.
Clinical engineering and medical devices
- FDA Philips Lumify Early Alert — posted October 9, 2026; not a formal Class I classification.
- FDA BD Alaris infusion-set recall page — material update October 5.
- FDA BD affected-product list; BD customer letter.
- FDA event 99298 — BD Alaris records.
- NSA announcement on zero trust for operational technology — October 8, 2026.
- NSA operational-technology zero-trust guidance.
- FDA CooperSurgical INCA alert and event 99643 records.
- FDA event 99758 — AVID/Halyard kit records and related sodium chloride ampule removal.
- FDA Abiomed Impella controller alert and event 99671 records.
- FDA Boston Scientific Imager II removal, FDA Boston Scientific affected-device list and event 99687 records.
- FDA Draeger VentStar Resus Neo removal and event 99787 record.
Current CVE additions and priority records
- CISA Known Exploited Vulnerabilities catalog — catalog version 2026.10.08, observed October 12.
- Atlassian CVE-2026-21589 advisory and fixed-version table — released October 5.
- ISC CVE-2015-5477 advisory; Debian BIND status; Ubuntu BIND status.
- Apache Struts S2-032 / CVE-2016-3081.
- Strapi CVE-2023-22894 disclosure and GitHub advisory record.
- ONLYOFFICE Document Server 5.6.3 changelog / CVE-2021-3199.
- Debian ProFTPD status and Ubuntu ProFTPD status.
Continuing CVE watch — vendor and distribution sources
- Cisco Secure Email Gateway CVE-2026-76461.
- Cisco ISE CVE-2026-76460.
- Acronis SEC-10986 / CVE-2026-87886.
- Google Pixel September 2026 security bulletin.
- Linux AF_ALG CVE-2025-39964: Ubuntu, Debian, Red Hat, SUSE.
- Linux ebtables CVE-2026-53266: Ubuntu, Debian, Red Hat, SUSE.
- Linux TLS CVE-2025-39682: Ubuntu, Debian, Red Hat, SUSE.
- Zyxel CVE-2026-7273 advisory.
- Check Point CVE-2026-85102 and CVE-2026-93616 advisory.
- Arista VeloCloud Orchestrator advisory 0183.
- F5 BIG-IP APM advisory K000162605.
- WSO2-2026-5328.
- Adobe APSB26-92.
- MikroTik September 2026 vulnerability notice.
- Microsoft CVE-2026-65660.
- WordPress CVE-2026-87902 advisory.
- Citrix CVE-2026-88771/CVE-2026-88772 bulletin.
- ServiceNow KB3159623; CNA records for CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859 and CVE-2026-86860.
- Apple CVE-2026-86950: iOS/iPadOS, macOS Tahoe, macOS Sequoia.
- Cisco Catalyst SD-WAN Manager CVE-2026-76504.
- Fortinet FortiMail FG-IR-26-175.
- Zammad chain: CISA CVE-2026-102489, CISA CVE-2026-102490, and Zammad releases.
- Citrix CTX697174 / CVE-2026-88779.