{ "version": 1, "generated_at": "2026-10-22T03:18:17.918Z", "smell_index": 5, "count": 9, "data": [ { "id": "php2shell", "url": "https://ohshit.app/incidents/php2shell/", "title": "PHP2Shell: two critical PHP core RCEs leak a day before the patch, and nearly every PHP back to 5.4 is in the bowl", "level": 5, "level_name": "shitstorm", "date": "2026-10-21", "date_is_approximate": false, "updated": null, "tags": [ "PHP", "RCE", "leaked early" ], "ecosystems": [ "php" ], "summary": "CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2) give remote code execution in PHP itself. A proof-of-concept video leaked the evening before release, so the patch and the exploit arrived together.", "splash": "PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed: nearly every PHP back to 5.4", "wipe": "Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress only blunts one of the two bugs", "in_the_wild": "disputed", "source_exception": null, "cves": [ { "id": "CVE-2026-109618", "score": 9.2, "name": "Half-built request on out-of-memory" }, { "id": "CVE-2026-109619", "score": 9.2, "name": "Stale request state used after free" } ], "fixed": [ { "product": "PHP 8.5", "branch": "8.5", "version": "8.5.12", "status": "Supported, patched" }, { "product": "PHP 8.4", "branch": "8.4", "version": "8.4.27", "status": "Supported, patched" }, { "product": "PHP 8.3", "branch": "8.3", "version": "8.3.36", "status": "Security fixes only, patched" }, { "product": "PHP 8.2", "branch": "8.2", "version": "8.2.35", "status": "Security fixes only, patched. EOL Dec 31, 2026" }, { "product": "PHP 8.1 and older", "version": "none", "status": "End of life. Distro / LTS vendors and source backports for 7.4–8.1 only" } ], "checklist": [ { "title": "Find every PHP runtime", "hint": "Servers, Docker base images, CI runners, that forgotten WordPress box" }, { "title": "Upgrade to a fixed version", "hint": "8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later. 8.1 and older need a distro or LTS build" }, { "title": "Double-check with OpenAI's php2shell-checker", "hint": "Point it at a URL or run it on the box. UNKNOWN means it couldn't tell, not that you're clean" }, { "title": "Rebuild and redeploy images", "hint": "A patched host does nothing for an old container" }, { "title": "Disable session.upload_progress where you can't patch yet", "hint": "Partial mitigation for CVE-2026-109619 only" }, { "title": "Hunt for web shells", "hint": "New .php files in upload and cache dirs since Oct 20" }, { "title": "Rotate secrets the app could read", "hint": "DB passwords, API keys in .env, session signing keys" } ], "sources": [ { "name": "php.net news", "url": "https://www.php.net/", "primary": true }, { "name": "Patchstack", "url": "https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/", "primary": true }, { "name": "Sophos", "url": "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619", "primary": true }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html", "primary": false }, { "name": "Huntress", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "primary": false }, { "name": "JFrog Security Research", "url": "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "primary": false }, { "name": "OpenAI php2shell-checker", "url": "https://github.com/openai/php2shell-checker", "primary": false } ] }, { "id": "gitlab-regex-rce", "url": "https://ohshit.app/incidents/gitlab-regex-rce/", "title": "GitLab patches its second CVSS 10.0 regex-compiler RCE in nine days, and this one reaches back to GitLab 7.0", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-21", "date_is_approximate": false, "updated": null, "tags": [ "GitLab", "RCE", "self-managed" ], "ecosystems": [ "gitlab", "ruby" ], "summary": "CVE-2026-110264 (CVSS 10.0) is an integer overflow in the Onigmo regex compiler that lets an unauthenticated user run code on self-managed GitLab, from 7.0 onwards. It lands nine days after CVE-2026-97229, a sibling bug that already has a public PoC. Servers patched on Oct 12 are still exposed.", "splash": "Every self-managed GitLab CE/EE from 7.0 up; GitLab.com and Dedicated are already patched", "wipe": "Upgrade to 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13. There is no workaround", "in_the_wild": "no", "source_exception": null, "cves": [ { "id": "CVE-2026-110264", "score": 10, "name": "Integer overflow in regex compilation" }, { "id": "CVE-2026-97229", "score": 10, "name": "Integer overflow in the CI/CD regex compiler" } ], "fixed": [ { "product": "GitLab 19.5", "branch": "19.5", "version": "19.5.1" }, { "product": "GitLab 19.4", "branch": "19.4", "version": "19.4.3", "status": "Includes DB migrations" }, { "product": "GitLab 19.3", "branch": "19.3", "version": "19.3.6", "status": "Includes DB migrations" }, { "product": "GitLab 19.2", "branch": "19.2", "version": "19.2.9", "status": "Backport (critical fix only)" }, { "product": "GitLab 19.1", "branch": "19.1", "version": "19.1.9", "status": "Backport (critical fix only)" }, { "product": "GitLab 19.0", "branch": "19.0", "version": "19.0.10", "status": "Backport (critical fix only)" }, { "product": "GitLab 7.0 – 18.11", "branch": "*", "version": "18.11.13", "status": "Backport. Anything older: upgrade to 18.11.13 or later" } ], "checklist": [ { "title": "Find every self-managed GitLab", "hint": "Including forgotten Omnibus VMs and Docker images" }, { "title": "Upgrade to the fixed version for your line", "hint": "The Oct 12 patch is not enough. Plan downtime for 19.4.3 / 19.3.6 on single-node setups" }, { "title": "Close self-registration if you don't need it", "hint": "Open sign-up turned the Oct 12 bug from \"needs an account\" into \"anyone\"" }, { "title": "Turn on GitLab's two detection rules", "hint": "“Onigmo native worker crash” and “Org mode render error burst”" }, { "title": "Rotate CI/CD variables and runner tokens if you were exposed", "hint": "Code runs as the git user, which can read them" }, { "title": "Update a self-hosted AI Gateway too", "hint": "CVE-2026-90970 needs gateway 19.2.4 / 19.3.2 / 19.4.1" } ], "sources": [ { "name": "GitLab patch release 19.5.1", "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/", "primary": true }, { "name": "GitLab patch release 19.4.2", "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/", "primary": true }, { "name": "Rapid7", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/", "primary": true }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html", "primary": false } ] }, { "id": "nodejs-oct-2026", "url": "https://ohshit.app/incidents/nodejs-oct-2026/", "title": "Node.js October security releases for 22, 24 and 26: ten CVEs, including a Brotli RCE and TLS hostname bypasses", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-21", "date_is_approximate": false, "updated": null, "tags": [ "Node.js", "TLS", "RCE" ], "ecosystems": [ "node" ], "summary": "Four HIGH, three MEDIUM and three LOW. An out-of-bounds write in the Brotli decoder, dns.resolve truncating names at a NUL byte, and IP spellings that sneak past certificate hostname checks. The release also rejects the compromised eMudhra keys.", "splash": "Node.js 22.x, 24.x, 26.x and every end-of-life line", "wipe": "Upgrade to 22.23.4 / 24.22.1 / 26.12.1, rebuild containers, then restart so old TLS sessions drop", "in_the_wild": "n/a", "source_exception": null, "cves": [ { "id": "CVE-2026-111497", "score": null, "name": "Brotli decoder out-of-bounds write" }, { "id": "CVE-2026-105482", "score": null, "name": "dns.resolve truncates at NUL" }, { "id": "CVE-2026-105483", "score": null, "name": "Fullwidth-digit IP hostname bypass" }, { "id": "CVE-2026-106069", "score": null, "name": "Loose IP resolution hostname bypass" }, { "id": "CVE-2026-105481", "score": null, "name": "Premature keep-alive response" }, { "id": "CVE-2026-106072", "score": null, "name": "Non-canonical IPv4 certificate validation" }, { "id": "CVE-2026-106074", "score": null, "name": "Repeated entropy after startup snapshots" }, { "id": "CVE-2026-106070", "score": null, "name": "Invalid ZIP header prefix returned" }, { "id": "CVE-2026-106071", "score": null, "name": "Filesystem wildcard permission over-grant" }, { "id": "CVE-2026-106073", "score": null, "name": "realpathSync permission bypass" } ], "fixed": [ { "product": "Node.js 26", "branch": "26", "version": "26.12.1", "status": "Current" }, { "product": "Node.js 24", "branch": "24", "version": "24.22.1", "status": "Active LTS" }, { "product": "Node.js 22", "branch": "22", "version": "22.23.4", "status": "Maintenance LTS" }, { "product": "Node.js 20 and older", "version": "none", "status": "End of life, affected, no fix" } ], "checklist": [ { "title": "Inventory Node versions", "hint": "Servers, Lambda/Vercel/Cloud Run runtimes, Docker base images, CI" }, { "title": "Upgrade to 22.23.4 / 24.22.1 / 26.12.1", "hint": "Bump .nvmrc, engines and base images too" }, { "title": "Rebuild and redeploy containers", "hint": "node:22-alpine from last week is still vulnerable" }, { "title": "Restart long-running services", "hint": "Resumed TLS sessions are not re-verified against the new CA store" }, { "title": "Get off end-of-life Node", "hint": "Node 20 and older are affected and get no fix" } ], "sources": [ { "name": "Node.js blog", "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "primary": true }, { "name": "Vercel KB", "url": "https://vercel.com/kb/bulletin/node-js-security-advisory", "primary": false } ] }, { "id": "tidb-cloud", "url": "https://ohshit.app/incidents/tidb-cloud/", "title": "PingCAP confirms TiDB Cloud intrusion: a stolen service account roamed internal systems for a month", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-19", "date_is_approximate": false, "updated": null, "tags": [ "cloud database", "credentials", "extortion" ], "ecosystems": [ "tidb", "mysql" ], "summary": "From Sep 9 to Oct 7 an intruder used stolen service-account credentials to copy account metadata, billing info, SQL editor text, encrypted API-key values and source code. Extortion group FulcrumSec claims 10.6 TB; PingCAP has not confirmed that.", "splash": "TiDB Cloud customers' account, billing and SQL-editor data; no evidence customer databases were read", "wipe": "Rotate TiDB Cloud API keys and DB passwords, scrub secrets from SQL editor history, review access logs", "in_the_wild": "n/a", "source_exception": null, "cves": [], "fixed": [], "checklist": [ { "title": "Rotate TiDB Cloud API keys", "hint": "The exported table held encrypted key values; treat them as exposed" }, { "title": "Rotate database users and passwords", "hint": "Especially any that ever appeared in the SQL editor" }, { "title": "Scrub secrets from SQL editor history", "hint": "Queries and error text were copied" }, { "title": "Review org and project access logs", "hint": "Look for logins and API calls you can't explain since Sep 9" }, { "title": "Watch for targeted phishing", "hint": "Contact names, emails and contract details were taken" } ], "sources": [ { "name": "PingCAP security update", "url": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "primary": true }, { "name": "Dark Reading", "url": "https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security", "primary": false }, { "name": "TokenPost", "url": "https://www.tokenpost.com/news/technology/35907", "primary": false } ] }, { "id": "emudhra-ca", "url": "https://ohshit.app/incidents/emudhra-ca/", "title": "eMudhra CA intermediate private keys were so weak that every one was a number below 256", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-17", "date_is_approximate": false, "updated": null, "tags": [ "PKI", "CA", "TLS" ], "ecosystems": [ "go", "python", "node", "browsers" ], "summary": "Eight intermediate certificates (six TLS, two code signing) under emSign ECC Root CA - G3, cross-signed by Sectigo, had P-384 private keys that were integers below 256. Anyone could recover them instantly and mint certificates for any domain.", "splash": "Anything trusting emSign ECC Root CA - G3 or the Sectigo cross-signs: browsers, OSes, Go, Python, Node", "wipe": "Update browsers and OSes, certifi 2026.10.19, Go 1.27.3 / 1.26.10, Node 22.23.4+; block the 8 intermediates in custom trust stores", "in_the_wild": "no", "source_exception": null, "cves": [ { "id": "CVE-2026-111943", "score": null, "name": "Go crypto/x509 trusts the compromised intermediates" }, { "id": "CVE-2026-113470", "score": null, "name": "Firefox trusts the compromised intermediates" } ], "fixed": [ { "product": "Go", "version": "1.27.3 / 1.26.10", "status": "CVE-2026-111943. Go 1.25 and older get no fix" }, { "product": "Python certifi", "version": "2026.10.19" }, { "product": "Node.js", "version": "22.23.4 / 24.22.1 / 26.12.1", "status": "Ships NSS 3.131.1 CA bundle" }, { "product": "Mozilla NSS", "version": "3.131.1", "status": "Root removed Oct 20" }, { "product": "Cloudflare WARP / 1.1.1.1 / cloudflared", "version": "2026.10.2" }, { "product": "Java (cacerts)", "version": "unknown", "status": "Not covered by sources we reviewed. Check your vendor" } ], "checklist": [ { "title": "Update browsers and operating systems", "hint": "Chrome, Firefox, Safari, Edge, Android and Windows have all shipped blocks" }, { "title": "Update language trust stores", "hint": "certifi 2026.10.19, Go 1.27.3 / 1.26.10, Node 22.23.4 / 24.22.1 / 26.12.1" }, { "title": "Patch custom trust stores", "hint": "Java cacerts, internal CA bundles, appliances, distroless images" }, { "title": "Check code-signing trust", "hint": "Two of the eight were code-signing CAs that Microsoft trusted" }, { "title": "Search your CT monitor for emSign-issued certs", "hint": "Anything on your domains you didn't request is a red flag" } ], "sources": [ { "name": "Mozilla Bugzilla 2083449", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083449", "primary": true }, { "name": "eMudhra statement", "url": "https://emudhra.com/en/post/certificate-security-incident", "primary": true }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html", "primary": false }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/", "primary": false } ] }, { "id": "connectwise-cloud-backup", "url": "https://ohshit.app/incidents/connectwise-cloud-backup/", "title": "ConnectWise Cloud Backup's app secret got stolen, and attackers walked into Microsoft 365 tenants through the front door", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-16", "date_is_approximate": false, "updated": null, "tags": [ "SaaS", "OAuth", "Microsoft 365" ], "ecosystems": [ "microsoft-365", "entra-id" ], "summary": "An API secret for ConnectWise's multi-tenant backup app (formerly SkyKick) was stolen. Every Microsoft 365 tenant that had consented to the app was suddenly reachable with the permissions customers had granted it. ConnectWise suspended several cloud services.", "splash": "Microsoft 365 tenants using ConnectWise Cloud Backup or Cloud Management: 173 confirmed, ~1,000 touched", "wipe": "Remove or re-consent the ConnectWise apps, review Entra sign-ins from 144.172.64.x, check for new Global Admins and app secrets", "in_the_wild": "yes", "source_exception": null, "cves": [], "fixed": [], "checklist": [ { "title": "Find the ConnectWise / SkyKick apps in Entra ID", "hint": "Enterprise applications → filter by publisher" }, { "title": "Review sign-in and audit logs since Oct 13", "hint": "IOCs 144.172.64.128, 144.172.64.99, 144.172.64.60" }, { "title": "Check for new Global Admins", "hint": "Role assignments made by service principals are the big tell" }, { "title": "Check every app for new secrets or certificates", "hint": "The attacker added credentials to other apps in the tenant" }, { "title": "Re-consent only after ConnectWise restores service", "hint": "Grant the minimum permissions the backup actually needs" } ], "sources": [ { "name": "ConnectWise Trust Center", "url": "https://www.connectwise.com/company/trust/advisories", "primary": true }, { "name": "Huntress", "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access", "primary": true }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html", "primary": false }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/connectwise-suspends-cloud-services-in-response-to-cyberattack/", "primary": false } ] }, { "id": "ivanti-connect-secure-chain", "url": "https://ohshit.app/incidents/ivanti-connect-secure-chain/", "title": "Ivanti Connect Secure zero-day chain: unauthenticated root on fully patched VPN boxes, again", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-13", "date_is_approximate": false, "updated": null, "tags": [ "zero-day", "VPN", "edge device" ], "ecosystems": [ "ivanti" ], "summary": "Attacker UTA0576 chained an auth bypass, a file write and a privilege escalation to take over VPN appliances running the latest release, then went after AD credentials, LAPS passwords and BitLocker keys. CISA added it to KEV the same day.", "splash": "Internet-facing Ivanti Connect Secure 22.8R2.4, 25.1.1.1, 25.1.2.2 and earlier", "wipe": "Patch to 22.8R2.5 / 25.1.1.2 / 25.1.3.x, run Ivanti's external Integrity Checker, rotate every credential that touched the box", "in_the_wild": "yes", "source_exception": null, "cves": [ { "id": "CVE-2026-104935", "score": 8.6, "name": "Auth bypass + arbitrary file write" } ], "fixed": [ { "product": "Ivanti Connect Secure 22.8", "version": "22.8R2.5" }, { "product": "Ivanti Connect Secure 25.1", "version": "25.1.1.2 / 25.1.3.0 / 25.1.3.1" }, { "product": "Privilege escalation in dsinvoked", "version": "none", "status": "No CVE, no patch at disclosure. Fix promised “in coming weeks”" } ], "checklist": [ { "title": "Patch every Connect Secure appliance", "hint": "22.8R2.5 or 25.1.1.2 / 25.1.3.x" }, { "title": "Run the external Integrity Checker Tool", "hint": "The attacker tampered with logs to fool the internal one" }, { "title": "Reset AD service accounts the VPN uses", "hint": "LDAP bind accounts were a target" }, { "title": "Rotate LAPS passwords and BitLocker recovery keys", "hint": "Both were pulled from AD" }, { "title": "Hunt for Kerberoasting", "hint": "Unusual TGS requests from the VPN's IP since Oct 1" }, { "title": "Plan for the unpatched privesc", "hint": "Restrict management access and watch for Ivanti's follow-up fix" } ], "sources": [ { "name": "Volexity", "url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "primary": true }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html", "primary": false }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/", "primary": false }, { "name": "CyberScoop", "url": "https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/", "primary": false } ] }, { "id": "ghostaction-returns", "url": "https://ohshit.app/incidents/ghostaction-returns/", "title": "GhostAction is back: hijacked maintainer accounts plant “security-audit.yml” workflows that ship your CI secrets out", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-09", "date_is_approximate": false, "updated": null, "tags": [ "supply chain", "GitHub Actions", "secrets" ], "ecosystems": [ "github-actions" ], "summary": "Compromised GitHub accounts pushed workflows dressed up as security jobs that exfiltrate Actions secrets. A new variant scans full git history, so the key you deleted three years ago still counts. GitHub started blocking the workflow on Oct 9.", "splash": "~1,900 accounts and 30,000+ repos targeted (GitGuardian); 3,174 secrets attempted", "wipe": "Search .github/workflows for security-audit.yml and friends, rotate every CI secret and any key ever committed, revoke old PATs", "in_the_wild": "yes", "source_exception": null, "cves": [], "fixed": [], "checklist": [ { "title": "Search for the malicious workflows", "hint": "security-audit.yml, github_actions_security.yml, security-check.yml, including in forks" }, { "title": "Check Actions logs for POSTs to 193.32.204.199", "hint": "Any run of those workflows means assume every secret is gone" }, { "title": "Rotate every Actions and environment secret", "hint": "Cloud keys, npm/PyPI tokens, deploy keys, webhooks" }, { "title": "Rotate anything ever committed to git history", "hint": "The variant runs git log -p --all, so deleted secrets count" }, { "title": "Revoke and re-issue maintainer PATs", "hint": "Prefer fine-grained tokens with expiry; enforce 2FA" } ], "sources": [ { "name": "Socket", "url": "https://www.socket.dev/blog/ghostaction-cloud-credentials", "primary": true }, { "name": "StepSecurity", "url": "https://www.stepsecurity.io/blog/ghostaction-returns", "primary": true }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html", "primary": false }, { "name": "The New Stack", "url": "https://thenewstack.io/hackers-hijacked-1900-github-accounts-then-they-went-after-30000-repos/", "primary": false } ] }, { "id": "oracle-health-20m", "url": "https://ohshit.app/incidents/oracle-health-20m/", "title": "The Oracle Health breach tally quietly climbs to nearly 20 million patients", "level": 4, "level_name": "septic-tank-blew", "date": "2026-10-05", "date_is_approximate": false, "updated": null, "tags": [ "healthcare", "data leak" ], "ecosystems": [ "cerner" ], "summary": "Stolen logins on two legacy Cerner servers in early 2025. The true size only surfaced through a Texas attorney-general filing: 19.9 million people, with SSNs, diagnoses, medications and medical images. Oracle still hasn't published a total.", "splash": "~19.9M patients of legacy Cerner clients in the US, at least 29 hospitals and health systems", "wipe": "Freeze your credit, watch for fake “Oracle Health” notices; providers: enforce MFA and retire legacy servers", "in_the_wild": "yes", "source_exception": "The national total is reported by multiple outlets, but the underlying Texas AG filing is not linked here and remains unverified.", "cves": [], "fixed": [], "checklist": [ { "title": "Freeze your credit", "hint": "Equifax, Experian and TransUnion. It's free in the US" }, { "title": "Watch for medical identity theft", "hint": "Read your Explanation of Benefits for care you never got" }, { "title": "Ignore unsolicited “Oracle Health” notices with links", "hint": "Breach news always brings phishing" }, { "title": "Providers: inventory legacy Cerner servers", "hint": "Retire or isolate anything not migrated" }, { "title": "Providers: enforce MFA everywhere", "hint": "This started with a stolen password" } ], "sources": [ { "name": "HIPAA Journal", "url": "https://www.hipaajournal.com/oracle-health-data-breach/", "primary": false }, { "name": "Becker's Hospital Review", "url": "https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/oracle-health-breach-exposed-data-of-nearly-20-million-people-report/", "primary": false }, { "name": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/oracle-healths-cerner-ehr-breach-figure-soars-to-20-million-a-33033", "primary": false }, { "name": "Yahoo Finance / Bloomberg", "url": "https://finance.yahoo.com/healthcare/articles/oracle-2025-health-breach-compromised-230919298.html", "primary": false } ] } ] }