Massive Healthcare Breaches Expose Millions, as Cisco Warns of Actively Exploited SD-WAN Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-21385, the actively exploited Qualcomm chipset vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. This action mandates that all U.S. federal agencies patch the flaw by a specified deadline, underscoring its critical risk. The vulnerability, a memory corruption issue, is confirmed to be under limited, targeted exploitation and affects a wide range of devices, including Android smartphones, tablets, and various Internet of Things (IoT) products. Successful exploitation could lead to denial of service or arbitrary code execution, broadening the previously reported impact of privilege escalation.

Further analysis of the LexisNexis data breach reveals that the compromised data includes not only 400,000 user profiles but also a broader scope of 3.9 million records. Crucially, the leaked dataset reportedly contains a 'wallet seed phrase,' indicating the exfiltration of highly sensitive cryptographic keys. This new information significantly escalates the potential impact of the breach, highlighting risks beyond typical personal data exposure, especially given LexisNexis's role in critical sectors. The incident underscores the danger of legacy data compromise and the hunt for high-value, unstructured data by attackers.

Iran-backed hacktivist group Handala has claimed responsibility for a major cyberattack on medical technology giant Stryker, causing global operational disruptions to its Microsoft environment. The group alleges a mass data-wiping campaign and exfiltration of sensitive data, including Social Security numbers and health information. Stryker confirmed the incident in an SEC filing, highlighting the campaign's escalating impact on critical sectors and potential patient safety risks. New TTPs observed include the use of vssadmin.exe to delete shadow copies and wevtutil.exe to clear logs, indicating sophisticated destructive intent.

Cisco has issued an urgent advisory confirming that multiple vulnerabilities within its Catalyst SD-WAN platform are being actively exploited. These newly reported flaws allow unauthenticated attackers to not only gain unauthorized access but also escalate privileges to root, providing complete control over critical networking equipment. This represents a significant escalation from previously reported vulnerabilities, which granted administrative access. Gaining root access enables attackers to modify network routing, disable security features, and establish persistent backdoors, posing an even greater threat to enterprise networks. Organizations are urged to apply patches immediately.