PHP2Shell website flaw and Quest Diagnostics breach land in the same week

Two cybersecurity incidents reached independent practices in the same week, and Medical Economics and Physicians Practice both frame the response the same way: patch, verify, document.

The first is PHP2Shell, the nickname for two critical flaws in PHP, the programming language behind WordPress, Drupal, Joomla and a large share of websites. Researchers at Wiz, Calif and OpenAI used AI to show the flaws could let an attacker take over a web server without logging in. The PHP project released fixes on Oct. 21, and CISA, the NSA and the FBI urged organizations to update immediately or take vulnerable systems offline until they can, according to Medical Economics. Because few practices run their own web servers, Physicians Practice treats this as vendor management: identify who hosts the website, forms and payment pages, and get written confirmation that they have patched.

The second is a breach of Quest Diagnostics' Quanum Lab Services Manager, the portal some practices use to order tests and pull results. Quest told the SEC it learned of unauthorized access on Oct. 21, believes certain patient records including protected health information were accessed, and is still determining what data was involved and whose. Quest paused the system, routed users to other ordering options and said it will notify affected patients as required by law. Quest also said the incident is not related to the PHP flaws.

The evidence has limits. Neither outlet gives a count of affected organizations or patients, and Quest's investigation was ongoing as of Oct. 23. Physicians Practice notes that neither event requires a practice to report a breach of its own at this point. The same week also brought a breach of a Kentucky Medicaid provider portal run by a state contractor and a federal advisory that the SafePay ransomware group has hit at least 600 organizations, with health care among its targets, per both outlets.

The lesson is that a practice's attack surface now sits largely with its vendors. For security and compliance leaders, the move this week is to confirm with your web host and vendors that PHP2Shell is patched on every patient-facing site, keep lab orders and results flowing through Quest's alternative channels, give the front desk a consistent script for patient calls, and record what was checked, when, with whom and what patients were told as part of your HIPAA security records. That documentation protects the practice and gives patients a clear, calm answer when they ask.