Briefing · 2026-10-27

Oct 27: Desk Briefing

Oct 27 security desk briefing covering 7 published reports, with links to the underlying coverage and available primary records.

October 27, 2026

tldr.txt

CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication.
UNM Health System diverted ambulances and closed 30 clinics Monday after a cybersecurity incident. The FBI is assisting; operations are resuming in phases.
Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.

Oct 27’s desk briefing covers 7 reports published that day. Follow each report for its sourcing and any later updates.

Fortinet Patches CVSS 9.8 Auth Bypass in FortiSandbox. CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication. Sources: CVE-2026-107656, FortiGuard PSIRT advisory.
New Mexico Hospital Diverts Ambulances in Cyber Incident. UNM Health System diverted ambulances and closed 30 clinics Monday after a cybersecurity incident. The FBI is assisting; operations are resuming in phases.
Teams IT Support Scams Deploy Ransomware at Scale. Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones. Apple extended patches for CVE-2026-86950, a CoreGraphics zero-day confirmed in targeted attacks, to older iPhone and iPad models that cannot run iOS 26. Sources: CVE-2026-86950.
PHP2Shell KEV Deadline: Federal Agencies Must Patch by Oct 29. CISA confirmed active exploitation of PHP2Shell and set an October 29 patch deadline for federal agencies. CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1) hit PHP 8.3/8.4/8.5. Sources: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog, CVE-2026-109618, CVE-2026-109619.
ENGIE Discloses Customer Data Breach via Partner Platform. French energy giant ENGIE confirmed attackers stole customer data after compromising a third-party marketing platform used by its business partners.
Tailscale SSH Flaws Exposed Before Patches Ready. Nearly a dozen Tailscale SSH vulnerabilities went public before fixes were available. Root privilege escalation and credential theft confirmed as possible impact. Sources: security advisories page.

Sources