Two cyber alerts in one week: What physicians need to do about PHP2Shell and the Quest Diagnostics breach

Two cybersecurity stories broke this week, and both reach into the independent physician practice.

The first is PHP2Shell, the nickname for two critical flaws in PHP, the programming language behind WordPress, Drupal, Joomla and a large share of the world's websites. Researchers at Wiz, Calif and OpenAI used artificial intelligence (AI) to show the flaws could let an attacker take over a web server without logging in. The PHP project released fixes Oct. 21, and federal agencies including the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the FBI urged organizations to update immediately or take vulnerable systems offline until they can.

The second is a breach at Quest Diagnostics. The company told the Securities and Exchange Commission (SEC) that on Oct. 21 it learned of unauthorized access to its Quanum Lab Services Manager (LSM) system, which some clients use to order lab tests and look up results. Quest said it believes an unauthorized party accessed certain patient records, including protected health information (PHI), and that it is still determining what data was involved and whose. Quest also said its investigation found the incident is not related to the PHP flaws.

For physicians, the two stories raise different questions. PHP2Shell is about your own exposure: whether your practice website, online forms or patient-facing tools run on vulnerable software and whether your vendors have patched. The Quest incident is about a vendor's breach: how to keep ordering tests, how to get results and what to tell patients who call.

They weren't the only warnings this week. Kentucky disclosed a breach of a Medicaid provider portal run by a state contractor, and the FBI, CISA and the U.S. Secret Service warned that the SafePay ransomware group has hit at least 600 organizations, with health care among its targets.

The following slides explain what is known as of Oct. 23, what remains under investigation and what physicians can do this week.

The U.S. Department of Health and Human Services has free online resources to bolster cybersecurity of physicians' offices, hospitals and health care systems. Learn more here.