What health system leaders should know about PHP2Shell and Quest Diagnostics

Hospital security teams spent this week on two fronts.

The first was PHP2Shell, two critical flaws in PHP, the programming language behind WordPress, Drupal, Joomla and most websites whose server-side code can be identified. Researchers at Wiz, Calif and OpenAI used artificial intelligence (AI) to show the flaws could let an attacker take control of a web server without logging in. After details leaked, the PHP project released fixes Oct. 21. The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the FBI urged organizations to patch immediately or take vulnerable systems offline, and the American Hospital Association (AHA) pushed that guidance to hospital leadership the same day.

The second was a breach at Quest Diagnostics, a lab vendor to many hospitals and health systems. Quest disclosed that on Oct. 21 it learned of unauthorized access to its Quanum Lab Services Manager (LSM) ordering and results portal, and that it believes patient records were accessed. Quest said the incident is not related to the PHP flaws.

For executives, the two events share a theme even though they are unrelated. A health system's exposure includes software it never wrote and systems it doesn't run: open-source code embedded in its web estate and vendor platforms its clinicians use every day. Many hospital security teams moved quickly this week. The questions for leadership are whether the organization can confirm what it patched and when, whether it checked for intrusions that may have preceded the patch, and how it holds vendors to the same standard.

Two more developments sharpen the point: Kentucky disclosed a breach of a Medicaid provider portal run by contractor Gainwell Technologies, and the FBI, CISA and the U.S. Secret Service warned that the SafePay ransomware group has hit at least 600 organizations. The AHA flagged that advisory for hospitals.

The following slides summarize what is known as of Oct. 23 and the questions executives can put to their teams.

The U.S. Department of Health and Human Services has free online resources to bolster cybersecurity of physicians' offices, hospitals and health care systems. Learn more here.