Clinics Told to Patch PHP2Shell After Quest Breach

This week health-care providers received two distinct cyber alerts that affect separate aspects of daily operations. The first alert centers on PHP2Shell, which comprises two critical flaws in the widely deployed PHP scripting language that powers countless web applications used by medical sites.

The second alert concerns a data breach at Quest Diagnostics, where unauthorized actors accessed the company’s online portal that patients use to view laboratory test results.

The vulnerabilities could let an attacker seize a web server without credentials, creating a pathway for further exploitation of internal networks. Patches were released on Oct. 21, providing the necessary code changes to close the security gaps.

Federal agencies including the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Federal Bureau of Investigation jointly advised that all health-care organizations should install the update without delay, or alternatively isolate any servers that remain vulnerable.

Most clinics do not host their own websites, so the responsibility for applying the fix shifts to external vendors. Because the majority of medical practices rely on third-party providers to manage web presence, the task of remediation falls to those service partners.

IT administrators are required to determine which contractor maintains the practice’s website, including any online intake forms and billing interfaces. After identifying the responsible party, they must obtain written confirmation that the security patch has been successfully applied.

Experiencing multiple alerts at once is not unusual; earlier in the year, health-care providers contended with a surge in ransomware attacks while simultaneously rolling out patches for other known vulnerabilities across their networks.

Stakeholders are encouraged to review their incident-response plans, verify vendor compliance, and maintain up-to-date documentation of security measures to meet regulatory expectations and protect sensitive health data.

The patch release on Oct. 21 remains the latest critical update addressing the PHP2Shell vulnerabilities, and its timely deployment is essential for safeguarding health-care web infrastructures.