Your Chief AI Officer · Sunday, October 25, 2026 · Act today
PHP2Shell website flaw and Quest Diagnostics breach land in the same week
Reported2 sourcesFor patients and employees
Medical Economics and Physicians Practice report a critical flaw in widely used website code, called PHP2Shell, and a breach of a Quest Diagnostics lab portal. Both outlets frame the response as patch, verify and document.
Two cybersecurity incidents reached independent practices in the same week, and Medical Economics and Physicians Practice both frame the response the same way: patch, verify, document.
The first is PHP2Shell, the nickname for two critical flaws in PHP, the programming language behind WordPress, Drupal, Joomla and a large share of websites. Researchers at Wiz, Calif and OpenAI used AI to show the flaws could let an attacker take over a web server without logging in. The PHP project released fixes on Oct. 21, and CISA, the NSA and the FBI urged organizations to update immediately or take vulnerable systems offline until they can, according to Medical Economics. Because few practices run their own web servers, Physicians Practice treats this as vendor management: identify who hosts the website, forms and payment pages, and get written confirmation that they have patched.
The second is a breach of Quest Diagnostics' Quanum Lab Services Manager, the portal some practices use to order tests and pull results. Quest told the SEC it learned of unauthorized access on Oct. 21, believes certain patient records including protected health information were accessed, and is still determining what data was involved and whose. Quest paused the system, routed users to other ordering options and said it will notify affected patients as required by law. Quest also said the incident is not related to the PHP flaws.
The evidence has limits. Neither outlet gives a count of affected organizations or patients, and Quest's investigation was ongoing as of Oct. 23. Physicians Practice notes that neither event requires a practice to report a breach of its own at this point. The same week also brought a breach of a Kentucky Medicaid provider portal run by a state contractor and a federal advisory that the SafePay ransomware group has hit at least 600 organizations, with health care among its targets, per both outlets.
The lesson is that a practice's attack surface now sits largely with its vendors. For security and compliance leaders, the move this week is to confirm with your web host and vendors that PHP2Shell is patched on every patient-facing site, keep lab orders and results flowing through Quest's alternative channels, give the front desk a consistent script for patient calls, and record what was checked, when, with whom and what patients were told as part of your HIPAA security records. That documentation protects the practice and gives patients a clear, calm answer when they ask.
Do this week. Confirm with your web host and vendors that PHP2Shell is patched on every patient-facing site, and document what you told patients about the Quest portal breach.
Run this
The prompt to act on this item, for your own model.
Paste it into Claude, ChatGPT or Copilot and fill the bracketed slots with your own numbers. The output is a draft for your team to check, built only from the sources on this page. Never paste patient data. How these prompts are written.
You are a security and compliance advisor to the executive team of [your organization]. Medical Economics and Physicians Practice report two incidents in the same week. PHP2Shell is the nickname for two critical flaws in PHP, the language behind WordPress, Drupal, Joomla and many websites, which could let an attacker take over a web server without logging in. The PHP project released fixes on Oct. 21, and CISA, the NSA and the FBI urged organizations to update immediately or take vulnerable systems offline. Separately, Quest Diagnostics told the SEC it learned of unauthorized access to its Quanum Lab Services Manager portal on Oct. 21, believes certain patient records including protected health information were accessed, paused the system and routed users to other ordering options. Quest said the incident is not related to the PHP flaws, and its investigation was ongoing as of Oct. 23. Neither outlet gives a count of affected organizations or patients. Physicians Practice advises practices to patch, verify and document, and notes neither event requires a practice to report a breach of its own at this point. Your task is to plan work we can finish this week: confirm with our web host and vendors that PHP2Shell is patched on every patient-facing site, and document what we told patients about the Quest portal breach. Produce a draft workflow for the executive team with steps, an owner for each, a due date this week and a verification check. Include written confirmation requests to vendors, keeping lab orders moving through Quest's alternative channels, a short front desk script for patient calls, and a record of what was checked, when, with whom and what patients were told. Use these details: [your web host and website vendors], [your patient-facing sites, forms and payment pages], [whether you use the Quanum portal], [owner names for security, compliance and front desk]. Use only the facts above and the details I fill in. Cite Medical Economics and Physicians Practice by name. Flag anything uncertain or needing verification. Include no patient data. This is a draft for our team to check, not legal or medical advice.
- The claim.
- Physicians Practice advises practices to patch, verify and document their response to both incidents.
- The evidence.
- Two trade outlets report both incidents; neither summary gives a count of affected organizations or patients.
By seat
For the CISO and security. Run a scan of all public websites, including those managed by marketing agencies, for the PHP2Shell flaw and require written patch confirmation.
For the Compliance, privacy and legal. Record your assessment of whether the Quest portal breach involves your patients and whether any notice obligations follow.
For the Patient experience. Give front desk and contact center staff a short script for patients asking about the Quest breach.
Sources
Drafted by Lumen from the sources above, scored by a second pass on six criteria, then checked by rule against those sources (every figure, two independent outlets or a primary source) and published only when it passes. A person can pull any item, and corrections are published here. Apolitical, always. Nothing here is medical advice. How Your Chief AI Officer is made.
Also in this brief
- Jefferson Health ambient AI users closed charts up to 39% faster
- University Hospitals shuts down some systems after a cybersecurity issue
- Amazon, Google, Meta and two others join the CMS prior authorization pledge
- Becker's counts 35 health systems dropping Medicare Advantage plans in 2026
- Doctors avoid their own EHR over colleague access to mental health records
- Sentara Health deploys AI case management tool co-developed with Regard