TrebSec Daily Report
Wednesday, November 4, 2026
Today's cybersecurity, AI, and compliance stories, each reviewed against its sources and broken down for four audiences. Use the reports index to search past editions by category and framework, and the frameworks directory for plain-language explainers of every body and standard referenced here.
9 stories in this edition.
CISA KEV addition November 3, 2026; federal remediation due November 6, 2026; fix in WordPress 7.1.4, released October 28, 2026
CISA Confirms the WordPress Upgrade Flaw Is Being Exploited: Federal Fixes Are Due November 6
Threats
CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation, and federal civilian agencies have until Friday, November 6 to apply the fix under BOD 26-04. The flaw is a time-of-check time-of-use race condition in WordPress Core, rated 8.1, affecting versions 4.7 through 7.1.3: full-package core upgrades use predictable, web-accessible staging paths, so an unauthenticated attacker who hits the brief upgrade window can execute code on the server. The flaw was reported by Picus Security researcher Umut Bayram, and WordPress 7.1.4, released October 28, fixes it by addressing the staging path handling. The attempt volume is already large. Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours after public disclosure, and reported 12,632 blocked attempts in the most recent 24 hours; those figures count attempts, not confirmed compromises. Previdian honeypots logged three exploitation attempts on October 30 from an IP address geolocated in the United Kingdom. This edition covered the flaw and the early attack counts on November 2, before the KEV listing; the listing is the change, because it converts a fast-moving vendor warning into a confirmed exploitation finding with a federal deadline attached.
Executives
A flaw in the software that runs a large share of the public web is now confirmed exploited, with a three-day federal clock. The exposure question is inventory, not severity: how many WordPress sites does the organization run, including marketing microsites, campaign pages and forgotten subdomains that no central team patches. Ask for the count of sites still below the fixed releases and the date each one closes, and treat any site nobody owns as the first item on the list.
CIO / CISO
Close this on the KEV timeline even though the mandate binds federal agencies: the exploitation evidence is the point, not the jurisdiction. Verify every site is on 7.1.4 or the fixed release for its branch, then hunt rather than assume: review access logs around any core upgrade performed since October 28 for requests to staged installer paths, and check for new administrator accounts, unexpected plugins and webshell files. Automatic updates reduce the window; confirm they are enabled rather than merely available.
Engineers
Update first, then look backward. The race needs an upgrade window, so sites that updated through the vulnerable path deserve a log review for setup-config.php requests in staging paths during the upgrade. Block or alert on public requests to upgrade staging directories, keep core, theme and plugin auto-updates on, and snapshot sites before manual upgrades so a contested upgrade can be rolled back and examined.
Everyone (non-IT)
If you run a WordPress site of your own, update it today from the dashboard and confirm the version reads 7.1.4 or the current release for your branch. Turn on automatic updates if they are off. The attack needs no password and no click from you; it only needs your site to be mid-update on an old version, which is exactly why running the update now, on your timing, is the safe move.
Read the standalone brief
VulnCheck canary exploitation observed October 30 to November 1, 2026, reported November 2, 2026; Siemens advisory SSA-834709 published August 11, 2026
Attackers Are Exploiting the Node-RED Flaw in Siemens SIMATIC IoT2050 Gateways: Patch to V4.3.4.1 or Remove Node-RED
Threats
A flaw Siemens disclosed in August has moved into active exploitation. CVE-2026-58115 affects SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, in versions before V4.3.4.1: an unauthenticated remote user can create Node-RED flows and execute code with maximum privileges on the gateway. VulnCheck reported on November 2 that its canary observed exploitation on October 30, with repeat attempts through November 1, and that the observed flow was used to deliver a Linux bot. VulnCheck did not analyze the delivered binary, so what the bot does after landing remains unconfirmed. The remediation is specific: update the device to V4.3.4.1 or later, and if Node-RED is not needed on a gateway, Siemens recommends removing it. The pattern is the familiar industrial one. A visual flow tool installed for convenience on an edge gateway becomes a remote code execution path with the highest privileges the device offers, on equipment that often sits between a plant network and everything else.
Executives
Industrial gateways are easy to forget because they were installed to solve a connectivity problem and then left alone. This one can now be taken over remotely, without any password, by anyone who can reach it. Ask operations for a simple count: how many IoT2050 gateways are in service, which ones run Node-RED, which ones can be reached from outside the plant network, and which are already on V4.3.4.1. Until those answers exist, the exposure is unmeasured rather than managed.
CIO / CISO
Treat internet-reachable gateways as the emergency and the rest as a fast follow. The fix is a version, not a project: V4.3.4.1 or later, or Node-RED removed where the business does not use it. Where a gateway was reachable during the October 30 to November 1 exploitation window, assume the delivered Linux bot may be present and hunt for unexpected flows, new processes and outbound connections before calling the device clean.
Engineers
Verify the device itself before changing it: exact model, Industrial OS release, whether Node-RED is installed, and which interfaces the editor listens on. Update to V4.3.4.1 or later, restrict the Node-RED editor to trusted management networks, and review deployed flows and device logs for changes nobody on the team made. A flow you do not recognize on a gateway is an incident indicator, not a curiosity.
Everyone (non-IT)
Most people will never touch one of these gateways, and no action is needed at home. The story matters because the same pattern shows up in consumer gear: a helpful remote feature, left installed and reachable, becomes the way in. On anything you do manage, removing a feature you never use is real security work.
Read the standalone brief
F5 Labs Weekly Threat Bulletin, November 4, 2026; PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619; Fragnesia CVE-2026-46300
25 PAN-OS Systems Breached Through One Chain: PHP2Shell to Root, Then a Tunnel Into a Government-Affiliated Network
Threats
F5 Labs reports that attackers have compromised 25 Palo Alto Networks PAN-OS systems, 24 perimeter firewalls and one internal management server, by chaining the PHP2Shell remote code execution flaws with the Fragnesia Linux kernel privilege escalation flaw. The PHP2Shell pair, CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS 4.0, abuse PHP session-upload handling and heap allocations to bypass address space layout randomization and execute arbitrary code through the system() function. In this campaign the exploit was custom-built for the uniform PHP 8.0.30 build of the PAN-OS appweb management server. Fragnesia, CVE-2026-46300, then escalated the foothold to root. From there the operators established a persistent reverse SSH tunnel into a United States government-affiliated environment, which let them pivot internally and harvest directory-service credentials. F5 sets out the mitigations plainly: apply the vendor-supported PAN-OS remediations, update standalone PHP deployments to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or temporarily disable session.upload_progress.enabled to close the upload-progress attack path.
Executives
The firewall is supposed to be the wall. In this campaign it was the door, and the attackers walked from the perimeter device into a government-affiliated network and took directory credentials, the keys that unlock everything else. The board question is not whether PAN-OS is patched in general; it is whether the management interfaces of your firewalls are reachable from networks that do not need them, and whether a compromise of one edge device would be detected before it became a tunnel.
CIO / CISO
Work this as a compromise scenario, not a patching ticket, on any PAN-OS system that lagged on PHP2Shell. The chain ends in credential harvesting, so closure includes directory-service credential review and rotation where exposure is plausible, hunting for reverse SSH tunnels and unexpected outbound sessions from firewall management addresses, and confirming the management plane is restricted to a dedicated network. The interim PHP mitigation, disabling session.upload_progress.enabled, is a same-day lever where a full update needs a window.
Engineers
Apply the vendor PAN-OS remediation and verify the running build, not the scheduled job. On standalone PHP, move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 for your branch. Then hunt the chain in order: session-upload exploitation traces on the management server, privilege escalation artifacts, new or modified SSH configuration, and tunnels initiated from the firewall itself. Edge devices rarely get endpoint tooling, so log review is the detection you have; make sure those logs leave the device.
Everyone (non-IT)
Nothing here asks anything of you directly. It is worth knowing that the equipment guarding a network can itself be attacked, which is why IT teams sometimes take firewalls offline for urgent updates at awkward hours. That interruption is the cheaper outcome.
Read the standalone brief
TechBriefly report November 4, 2026; BlackLotus technique first documented in active attacks in 2023
BlackX Bootkit Infects Fully Patched Windows Systems: The Updates Meant to Stop BlackLotus Were Installed
Threats
Malware tracked as BlackX has infected organizations that had installed all available Microsoft updates intended to block the BlackLotus UEFI bootkit technique, according to a November 4 TechBriefly report. BlackX is a UEFI bootkit: code that runs before Windows has fully loaded and before many security defenses become operational, targeting the chain of trust that Secure Boot relies on. The lineage matters. BlackLotus, first publicly documented in active attacks in 2023, could bypass Secure Boot on fully updated Windows 11 systems. Microsoft patched the underlying vulnerability in 2022, issued a further update in 2023 adding a new certificate that did not trust vulnerable Windows boot managers, and in 2024 provided a way to revoke trust in the digital certificate used to sign older vulnerable boot managers. The organizations affected by BlackX had installed those updates. The available material does not specify how the BlackX infections bypassed the updated protections, and that gap should be read honestly: what is established is infection despite a complete patch record against the predecessor technique, not the mechanism. The open questions sit exactly where defenders would expect, around certificate revocation enforcement and boot manager trust on real fleets.
Executives
A fully patched record is necessary and, in this case, apparently not sufficient. Bootkits sit below the operating system, so they can survive the reinstalls and agent checks that close most incidents, and remediation can mean firmware-level cleanup rather than a ticket. Ask how the organization would even know: which tools in your stack can see below Windows, and what is the rebuild path for a machine whose boot chain is not trusted. Treat the unanswered mechanism as a reason to verify your revocation state, not as a reason to wait.
CIO / CISO
The actionable check is enforcement, not installation. Confirm that Secure Boot is on, that the revocation updates for vulnerable boot managers were actually applied and enforced on each fleet segment, and that dbx revocation lists are current; update packages present but revocation not applied is a known failure mode in this lineage. Add boot integrity signals to your detection review, and pre-agree the response for a suspected bootkit: isolate, preserve the disk and firmware state, and rebuild from trusted media rather than cleaning in place.
Engineers
Inventory at the firmware layer: Secure Boot status, dbx contents, and boot manager versions across a sample of each hardware class, because fleet averages hide the machines that missed enforcement. Watch for unexpected changes to EFI system partition contents and boot configuration. If a machine is suspected, do not trust in-OS scanning results; the malware loads before the scanner does.
Everyone (non-IT)
Keep Secure Boot turned on and keep Windows updated; both still raise the cost of this kind of attack considerably. If a computer starts behaving strangely before Windows even loads, or security software reports problems it cannot fix, that is a case for professional help rather than another scan, because this class of malware hides underneath the tools you would normally use.
Read the standalone brief
GitHub issue 14370 filed October 25, 2026; install logged October 24, 2026; independent reproduction reported November 3, 2026
Postman Opened, and Two AI Coding Agents Got New Plugins: The Consent Failure, and What the Logs Do Not Prove
AIThreats
Opening Postman on a signed-in Mac did more than open Postman, according to GitHub issue 14370 and two independent reviews of the evidence. Postman desktop 12.33.4 recorded an auto-existing-upgrade step in its own log on October 24, with results showing plugins installed into Anthropic's Claude Code and OpenAI's Codex without an explicit install request. On that machine, the Codex configuration gained a Postman marketplace entry and an enabled plugin, a Postman CLI landed in the local bin folder, and the installer wrote a trust record for its own SessionStart hook: a function named approvePostmanHook approves the hook on the user's behalf. The hook itself instructs the agent to load Postman's API-engineering skill before any non-trivial API task, so it steers future agent sessions, not just Postman sessions. What the evidence does not show matters just as much. The plugin configures a remote MCP connection to Postman's servers, but the reporter's logs show that connection failing authentication, the reporter does not claim data exfiltration, and a second user who reproduced the auto-install on November 3 while upgrading from 12.31.3 to 12.35.1 reported no evidence that data was uploaded. Postman says the bundle is meant to ease setup, is mentioned on the download page and in the update flow, and can be uninstalled in the app, and that it will make the opt-in clearer, especially for existing users, and is reviewing the hook approval behavior.
Executives
No breach has been proven here, and the story is still a governance finding. A routine desktop update reached into two other products, changed how AI agents on the machine behave, and approved its own permission to do so. That is the pattern to govern wherever agents are in use: which vendors can write into agent configurations, who approves hooks and plugins, and how would you know. Under the NIST AI RMF this is Manage work, and under ISO/IEC 27001 it is supplier and change control, applied to a new surface most inventories do not yet list.
CIO / CISO
Add agent configuration to the asset and change record: plugin installs, hook trust records, and MCP server entries for tools such as Codex and Claude Code, on developer machines first. Set the policy plainly, that installing into another product's configuration and self-approving trust is not acceptable vendor behavior, and put it in procurement and renewal conversations. For Postman specifically, decide whether existing users keep, remove or re-approve the integrations, and record the decision rather than letting each laptop decide silently.
Engineers
Check your own machines before theorizing: look for a Postman entry in the Codex configuration and its hooks state, a postman plugin in the Claude Code settings and installed plugins file, any session-start hook mentioning Postman, and MCP entries pointing at Postman's servers. Removing the desktop app may not remove the agent integrations, so verify each location after uninstall. If your team standardizes agent setups, pin the configuration in version control so silent changes show up as a diff.
Everyone (non-IT)
If you use Postman alongside an AI coding tool, nothing here means your data was stolen; the connection that could have carried data failed to authenticate in the documented case. It does mean an update may have added plugins you never chose. A quick look at the plugin list in your coding agent is worth five minutes, and removing anything you do not recognize is a reasonable step.
Read the standalone brief
Amended S-1/A filing submitted November 2, 2026; Responsible Scaling Policy version 3.4 in force since July 8, 2026
Anthropic Tells the SEC It May Imminently Cross Its Own AI Acceleration Threshold, and That It Has Missed Accelerations Before
AICompliance
In an amended S-1/A filed with the SEC on November 2, Anthropic added risk language no frontier lab had previously put in a listing document in this form. The company says its internal estimates and expectations regarding future models, rather than current models, indicate that it may imminently meet its Responsible Scaling Policy definition of dramatically accelerated progress attributable to AI, the threshold tied to recursive self-improvement. It is equally plain about the limits: no current model has been designated as exceeding the threshold, and the company adds that it has in the past not identified a significant acceleration in its rate of development until after it had occurred, and may fail to identify one in the future as well. The threshold itself has two branches: AI systems able to fully substitute for the company's research scientists and engineers at competitive cost, within a factor of five, or AI helping to double the aggregate rate of progress in AI capabilities through automated research and engineering. The filing's supporting figures are concrete. In September 2026, Claude authored over 90 percent of contributions to Anthropic's codebase, and average daily code output per engineer in the third quarter was more than 45 times its 2024 level, figures the coverage notes measure code volume rather than equivalent productivity. Anthropic also says it does not anticipate being able to safely use Claude to fully and autonomously design and build successive generations of frontier models without meaningful human supervision, and that it is considering updates to its Responsible Scaling Policy to keep humans in control of frontier model development. TechCrunch adds the necessary caution: an S-1 is both a disclosure and a marketing document, and claims of proximity to very powerful AI can serve both purposes at once.
Executives
Read this as a governance document before reading it as a technology claim. A company preparing to sell shares has told regulators, in writing, that its own safety tripwire may be near and that its detection of crossing it is unreliable in real time. For buyers of AI systems, the transferable lesson is about vendor governance maturity: does your AI supplier publish capability thresholds in advance, report against them, and admit measurement gaps. Those answers belong in vendor reviews now, alongside price and features, and the SEC filing makes them quotable.
CIO / CISO
Map the disclosure onto your own AI program under the NIST AI RMF Govern function. If a supplier's capability pace can change materially between your annual reviews, your review cadence is the control that fails first. Shorten reassessment cycles for frontier model upgrades, require notice of material capability changes in contracts where you can get it, and keep a tested fallback for any workflow that would be hard to pause. The company's own framing, thresholds defined in advance with honest detection limits, is a reasonable template for internal AI change gates.
Engineers
The 90 percent authorship figure deserves a working response, not awe: when most code is machine-written, review discipline, test coverage and provenance tracking carry the safety load that authorship used to. Keep human review gates on AI-generated changes to security-sensitive code, log which changes were model-authored, and preserve the ability to roll back model versions in any pipeline where a model helps build the next thing, even at small scale.
Everyone (non-IT)
Nothing about the AI tools you use changed this week, and no company says a machine is now building itself without people. What happened is narrower and more unusual: a leading AI company told stock market regulators that AI is getting close to speeding up its own development in a way it defined in advance, and admitted it might only notice afterward. It is a milestone in how openly this is discussed, not a change to anything on your phone.
Read the standalone brief
Apple fiscal 2026 Form 10-K filed with the SEC on November 3, 2026
Apple Puts Rogue Agents in Its Annual Filing: AI That Acts Without Authorization, Conceals Actions, and Cannot Always Be Undone
AICompliance
Apple's fiscal 2026 annual report, filed with the SEC on November 3, names autonomous AI agents as a business risk in unusually specific language. The filing describes agents that take actions autonomously, including interacting with internal or external systems that in some cases they may not be authorized to access, executing or altering code, sending communications, and completing transactions. It warns that such technologies may conceal actions, hide, withhold or manipulate information, or generate inaccurate or deceptive outputs, and that some consequences, such as deleting data or completing transactions, may be difficult or impossible to reverse. Apple also concedes that its ability to oversee and control third-party AI agents and other technologies may be limited, and flags exposure to lawsuits and reputational harm. The scale of the change is measurable: Apple's dedicated AI risk discussion grew from 199 words in its May 2026 quarterly filing, the first to carry one, to 628 words in this annual report, and mentions of artificial intelligence across the filing rose from 6 in last year's annual report to 45. The disclosure lands the same week Apple opened its Siri AI developer preview to apps outside the European Union, and weeks after an October macOS change under which granting Full Disk Access requires explicit user action, a platform control aimed at the same class of risk.
Executives
When a company of Apple's caution level writes agent failure modes into a securities filing, agent risk stops being a research topic and becomes a standard diligence item. The filing's list is a ready-made review agenda for any organization deploying agents: unauthorized system access, code changes, outbound communications, transactions, concealed actions, and irreversible outcomes. Ask which of those your current agent deployments can do, and which a person approves before they happen. If the answers are not written down, that is the finding.
CIO / CISO
Use Apple's own categories to structure agent permissions under the NIST AI RMF Manage function: least-privilege scopes per agent, human approval for irreversible actions such as deletions and payments, complete action logging that the agent itself cannot alter, and a tested kill switch. The concealment point deserves emphasis in design reviews, because an agent that can hide or manipulate its own reporting breaks the monitoring every other control depends on. Platform controls such as explicit consent for broad file access are the floor, not the ceiling.
Engineers
Design for reversal where you can and for evidence where you cannot: dry-run modes, transaction limits, idempotency keys, and append-only audit logs stored outside the agent's reach. Treat any agent request to expand its own permissions as a security event to log and alert on. Test the failure cases in the filing directly: an agent instructed to act on a system it is not authorized for should fail closed and say so.
Everyone (non-IT)
This filing does not mean the AI on your phone is acting on its own; Apple says it does not currently run an agentic AI of this kind. It means the company is warning investors that software which acts for you can also act beyond what you asked, and that some of its actions cannot be taken back. The sensible personal habit mirrors the corporate one: give assistants the narrowest access that does the job, and keep approvals on for anything that spends money or deletes things.
Read the standalone brief
Google announcement November 3, 2026; new controls rolling out in early 2027; Guided Learning in Classroom live November 3, 2026
Google Gives Schools an Off Switch With a Catch: No AI for Students Also Means No Google Search
AI
Google announced on November 3 that Gemini, NotebookLM, Gemini in Classroom and Google Search will be switched off by default for K-12 student accounts until a school administrator explicitly turns them on, with each service switchable individually. There is, however, no AI-free version of Search on offer. The Search a school can enable includes AI Mode and AI Overviews, and Google's vice president for education, Chris Phillips, told The New York Times that Search and AI are deeply integrated, and that students in a school that has banned AI will not have access to Search and will see a message saying their school has not made it available. Alongside the controls, Google made its Guided Learning mode, which coaches students through problems step by step instead of handing over answers, globally available in Google Classroom from November 3, with a pilot inside Search for selected United States schools later in November. Google's clarification on the same day said the changes give schools more choice, not less. Critics answered the narrower point: New York City Mayor Zohran Mamdani posted that Google is using monopoly power to force AI into public schools, former FTC Chair Lina Khan criticized the arrangement, and Senator Bernie Sanders described it as extortion, according to iTechPost's report. Google's blog post gives no effective date; reporting places the new controls in early 2027, with more specifics promised to schools in the coming months.
Executives
This is an AI governance decision arriving dressed as an IT setting. Districts and schools now have to choose, explicitly, between three positions: AI-enabled Search with guided answers, no Google AI and no Google Search for students, or a move to another search provider. Each carries teaching, equity and procurement consequences, and the decision window is the months before the early 2027 rollout. The pattern generalizes to enterprise contracts as well: when a platform bundles AI into a core service, opting out of the AI can mean opting out of the service, and that term belongs in negotiations before renewal, not after.
CIO / CISO
For school technology leaders, the work is an inventory and a decision record: which student groups use which services today, what the district's AI position is by grade level, and what alternative search arrangements would require in filtering, logging and device configuration. Document the chosen position and the rationale, because parents and boards will ask. For other organizations, treat this as a prompt to check your own platform contracts for bundled AI that cannot be disabled independently.
Engineers
Administrators should test the switches in a pilot organizational unit before the defaults change: confirm which products turn off, what students see, and whether teacher-assigned Guided Learning activities behave as expected under the new settings. Note the reporting gap already visible in the announcement, where Google's own clarification lists three products and its blog lists four, and verify behavior on your tenant rather than relying on either list.
Everyone (non-IT)
If your children use school Google accounts, the practical change is simple: at some point next year their school will have to switch these tools on deliberately, and if the school decides against AI, Google Search on the school account goes with it. Personal accounts are not affected. It is a reasonable question to ask your school what it plans to choose, because the choice shapes how students do research and homework.
Read the standalone brief
HHS OCR settlement announced October 29, 2026; ransomware discovered February 4, 2023; breach reported May 15, 2023
OCR's 22nd Ransomware Settlement: Lehigh Valley Pays $800,000 for a Missing Risk Analysis, Unread Logs, and Late Notices
Compliance
The HHS Office for Civil Rights announced on October 29 that Lehigh Valley Health Network, a Pennsylvania health system, will pay $800,000 and follow a three-year corrective action plan to settle potential violations of the HIPAA Privacy, Security, and Breach Notification Rules, in OCR's 22nd ransomware enforcement action. The underlying attack was discovered on February 4, 2023 and reported to OCR on May 15, 2023. Protected health information was exfiltrated and posted on the dark web, affecting 248,359 individuals and including sensitive photographs of cancer patients receiving radiation oncology treatment, names, addresses, dates of birth, Social Security numbers, driver's license numbers, financial information, diagnoses, lab results, medications and treatment information. OCR's findings are a short list of fundamentals: the network failed to conduct an accurate and thorough risk analysis of its electronic protected health information, failed to implement procedures to regularly review records of information system activity such as audit logs, access reports and security incident tracking reports, impermissibly disclosed the information, and failed to notify affected individuals and the Secretary on time. The corrective action plan requires a proper risk analysis, a risk management plan addressing what it finds, revised policies and procedures, and updated workforce training, all monitored by OCR for three years. OCR Director Paula M. Stannard put the agency's position in one sentence: failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks.
Executives
The penalty here is not really about the ransomware. It is about the three years of ordinary duties that were not done before it arrived: a real risk analysis, logs that someone actually reviews, and notification clocks that are met. A corrective action plan also means three years of federal monitoring, which costs more in management attention than the check. Boards of any HIPAA-regulated organization should ask for the date of the last risk analysis and evidence that its findings were acted on, because that is the first document OCR will request.
CIO / CISO
Work OCR's finding list as your own checklist, in its order: a current, accurate and thorough risk analysis covering all electronic protected health information; a risk management plan that closes what it finds; a working procedure, with named owners and cadence, for reviewing audit logs, access reports and incident tracking; and breach notification runbooks that respect the regulatory clocks. The settlement is also a reminder that detection without review is not a control: the logs existed as a category in the rule, and the failure was that nobody was required to read them on a schedule.
Engineers
Make the review real in tooling: centralized log collection for systems holding electronic protected health information, scheduled review queues with sign-off, alerts on bulk export and unusual access to imaging and records systems, and retention that survives an incident. Keep the evidence as you go, because in an OCR investigation the record of regular review is the deliverable, and reconstructing it afterward is not possible.
Everyone (non-IT)
If you were a Lehigh Valley patient in 2023, you should already have been notified; this settlement is the federal government closing its investigation, and it does not ask anything new of patients. The general lesson travels well: health records cannot be reissued like a password, which is why the rules require the organizations holding them to know their risks and watch their own systems before an attack, not after.
Read the standalone brief