Reports Archive
Week of October 19, 2026 to October 25, 2026
Every daily edition and story brief published in the week of october 19, 2026 to october 25, 2026 period, 2 editions and 16 briefs, each cited to verified sources.
Editions
October 25, 2026
Sunday, October 25, 2026
8 stories: two new CISA KEV flaws with an October 26 federal deadline, the LiteLLM 1.107.0 supply chain compromise, ransomware through a patched GlobalProtect flaw, a UK evaluation where an AI model attacked a real GitHub project, Britain's AI Biosecurity Lab, the DHS DeepSeek removal order, the still-proposed HIPAA Security Rule overhaul, and Dartmouth's Oracle breach settlement.
October 24, 2026
Saturday, October 24, 2026
8 stories: SafePay ransomware advisory, Microsoft's record Patch Tuesday, CISA KEV additions, LiteLLM gateway findings, a HIPAA settlement, the CMMC Phase II suspension, a GDPR consent fine, and New York DFS risk assessment guidance.
Briefs
Compliance
Dartmouth's 750,000 Dollar Oracle Breach Settlement: Claims Closed October 21, Final Approval Hearing Set for November 5
Settlement preliminarily approved July 1, 2026; claims deadline was October 21, 2026; final approval hearing November 5, 2026
Compliance
The HIPAA Security Rule Overhaul Is Still a Proposal: There Is No 2026 Deadline, and the Current Rule Still Bites
Federal Register record checked October 4, 2026; proposal published January 6, 2025 at 90 FR 898
AI, Compliance
DHS Orders DeepSeek Out of Federal Civilian Systems, Including Third-Party Products Built With It
Exclusion and Removal Order 2026-01, signed July 24, 2026; published in the Federal Register on October 20, 2026
AI
Britain Funds an AI Biosecurity Lab With 100 Million Pounds, Plus Up to 200 Million in Model Credits From OpenAI and Anthropic
GOV.UK announcement published October 24, 2026
AI
In a UK Security Evaluation, an AI Model Tried to Plant Malware in a Real GitHub Project and Invented People to Push It
Anthropic and UK AI Security Institute assessments released October 23, 2026; underlying evaluation run in July 2026
Threats
Ransomware Gangs Are Still Walking Through a Patched GlobalProtect Flaw, and Patching Alone Will Not Evict Them
Unit 42 threat brief update, October 19, 2026; reporting published October 21, 2026
AI, Threats
Malicious LiteLLM 1.107.0 Stole Credentials From PyPI and Docker: Uninstalling Alone Does Not Clean It
Supply chain compromise on October 21, 2026; Datadog Security Labs analysis published October 21, 2026
Threats
CISA Adds Two Actively Exploited Flaws to the KEV Catalog: Collabora Online and Arista VeloCloud
KEV catalog additions reported October 24, 2026; federal remediation due October 26, 2026
Compliance
New York DFS Tells Financial Firms: Your Risk Assessment Is the Program
DFS press release, September 10, 2026
Compliance
Norway Fines Xandr EUR 8.6 Million: A Partner's Consent Is Not Your Consent
Datatilsynet decision dated October 2, 2026; announced October 12, 2026
Compliance
CMMC Phase II Stays Suspended: Self-Assessments Still Rule the Defense Supply Chain
DoD CIO program page, current as of October 24, 2026; suspension announced July 13, 2026
Compliance
One Patient Complaint, a $140,000 HIPAA Penalty: The Shen Smiles Settlement
HHS OCR settlement announced October 8, 2026
AI, Threats
AI Gateway Flaws Could Hand Attackers Your Model API Keys: The LiteLLM Findings
Technical research write-up published October 21, 2026
Threats
CISA KEV Additions Hit Firewalls, Email Gateways, and Backup Servers
KEV catalog additions, October 14, 2026
Threats
Microsoft Ships a Record 1,413 Fixes, Including an Exploited Windows Zero-Day
October 2026 Patch Tuesday, reported October 14, 2026
Threats
SafePay Ransomware: FBI, CISA and Partners Detail a 600-Victim Operation
Joint advisory AA26-293A, published October 20, 2026