Midweek update

Generative AI

Midweek update

David Ermer–CDC, CMS, Congress, FDA, Generative AI, Medical / Rx research, Obesity, Patient safety, U.S. Healthcare–

From Washington, DC,

  • Bloomberg Law reports,
    • “Political pressure points set to hit around Nov. 1 could force lawmakers to negotiate an end to the government shutdown.
    • “Funding shortfalls and other deadlines for health care, military pay, and nutrition benefits will collide on or around the first of next month, potentially creating new bipartisan urgency for lawmakers to end the shutdown set to enter its fourth week on Wednesday.” 
  • The American Hospital Association News tells us,
    • The AHA provided a statement for a Senate Special Committee on Aging hearing today on shoppable services that improve health outcomes and lower costs. The AHA asked Congress to take certain steps to address hospital price transparency requirements, including streamlining existing policies that prioritize reducing potential patient confusion and unnecessary regulatory burden on providers; ensuring pre-service estimates are as accurate as possible; continuing to seek input from patients, providers and payers on ways to make more patient-centered federal price transparency policies; and refraining from advancing additional legislation or regulations that could further confuse or complicate providers’ ability to provide meaningful price estimates and add unnecessary costs. In addition, the AHA urged Congress to reject any efforts to expand site-neutral payment cuts.”
  • Per a Senate news release,
    • “On Wednesday, October 29, the Senate Health, Education, Labor, and Pensions (HELP) Committee will hold a hearing on how we can better deliver lifesaving cures to patients and maintain American dominance in medical innovation.”
  • Modern Healthcare informs us,
    • “The Trump administration chose a new leader for a federal health research funding organization that focuses on high-risk, high-reward programs, after firing its previous head in February.
    • “Alicia Jackson, a health technology entrepreneur who used to work for the Defense Department, was appointed director of the Advanced Research Projects Agency for Health, according to the Department of Health and Human Services, confirming an earlier Bloomberg News report.
    • “The agency known as ARPA-H is part of HHS and one of several U.S. government research accelerators that support cutting-edge projects unlikely to attract traditional funding or commercial investment. It has programs in precision cancer therapy, manufacturing personalized genetic medicines, fixing brain damage and enabling joints to heal themselves, according to its website.”
  • The Paragon Health Institute released a paper suggesting ways to improve the CMS Innovation Center.
    • “The CMS Innovation Center has largely failed to produce models with savings or quality improvements. Despite savings projections in the tens of billions, the center’s models have generated more than $5 billion in costs in its first decade.
    • “The voluntary nature of demonstrations, flawed benchmarks, and an inadequate focus on savings have produced poor results.
    • “The Innovation Center’s new strategy seeks to rectify past issues with a renewed focus on evidence-based prevention, patient empowerment, choice and competition, and savings.
    • “Congress and CMS can reform the Innovation Center by prioritizing limited and true demonstrations that are primarily mandatory and based in markets with a focus on definitive savings.
    • “If these reforms are not adopted or are not successful, the Innovation Center should be terminated.”

From the Food and Drug Administration front,

  • Beckers Hospital Review points out,
    • “The FDA is requiring updated labeling for tranexamic acid injection to emphasize the risk of serious harm, including death, if administered incorrectly via spinal injection.
    • “Tranexamic acid injection is indicated for short-term use — two to eight days — in patients with hemophilia to reduce or prevent hemorrhage during and after tooth extraction. It is supplied in single-dose ampules and vials containing 1,000 milligrams in 10 milliliters, and in sodium chloride injection bags with 1,000 milligrams in 100 milliliters.
    • “The agency is mandating a boxed warning, a contraindication for neuraxial (spinal and epidural) use, and revised dosage instructions specifying that the drug must be administered intravenously, according to an Oct. 21 news release. The FDA took action after reviewing cases in which tranexamic acid was mistakenly administered intrathecally or epidurally instead of local anesthetics such as bupivacaine or lidocaine. These errors resulted in prolonged hospitalizations and deaths.”

From the public health and medical / Rx research front,

  • The University of Minnesota’s CIDRAP reportshttps://www.cidrap.umn.edu/measles/us-measles-cases-top-1600-south-carolina-outbreak-grows,
    • “The Centers for Disease Control and Prevention (CDC) said today the country has seen 1,618 confirmed measles cases so far in 2025, 22 more than last week. And in South Carolina, a measles outbreak linked to two schools with low student vaccination rates has grown by 4 cases. 
    • “The total represents the most US infections since 1992, when the CDC reported 2,237 measles cases.
  • The New York Times adds
    • Just as one large measles outbreak peters out in the United States, another outbreak of the virus has taken off along the border of Utah and Arizona.
    • The new outbreak began in August and has sickened more than 100 people, making it the second-largest cluster of cases in the country this year. A majority of the cases are in unvaccinated people. * * *
    • “There are several parallels between the current situation at the Utah-Arizona border and the outbreak that exploded from the Western edge of Texas in January: Both started in rural towns with a sizable population of children who had not been immunized against measles, mumps and rubella. And in both outbreaks, the virus traveled to a neighboring state and took root in similarly vulnerable pockets.” * * *
    • “In the current outbreak, cases have been clustered in Colorado City, Ariz., and Hildale, Utah — adjoining cities with historical ties to the Fundamentalist Church of Jesus Christ of Latter-day Saints, a polygamist offshoot of the Mormon Church. However, local public health officials said the virus had spread beyond members of that religious group into the broader community, where vaccination rates have dropped steeply since the pandemic.
    • “In Mohave County, Ariz. — which now has the second-highest case count of 2025, only after the Texas county at the center of the Southwest outbreak — roughly 90 percent of kindergartners were fully vaccinated against measles in the 2019-20 school year.
    • “But by the 2024-25 school year, the vaccination rate had dropped to 78 percent. (About 95 percent of a community needs to be vaccinated to stem the spread of measles, which is one of the most contagious known viruses.)
    • “Data from Southwest Utah tell a similar story: Vaccination rates dropped nearly eight percentage points over the course of the pandemic to about 78 percent.”
  • The New York Times also relates,
    • “Bird flu is back. After a quiet summer, the virus has hit dozens of poultry flocks, resulting in the deaths of nearly seven million farmed birds in the United States since the beginning of September. Among them: about 1.3 million turkeys, putting pressure on the nation’s turkey supply in the run-up to Thanksgiving.
    • “Reports of infected wild birds have also surged this fall, and three states — Idaho, Nebraska and Texas — have identified outbreaks in dairy cows.
    • “The virus often flares up in the fall as wild birds begin migrating south; this year, the uptick is occurring during a government shutdown, as federal agencies that are typically involved in the response are working with skeletal staff.”
  • Per MedPage Today,
    • “A large study suggested that older women who took at least 4,000 steps 1-2 days per week had lower risks of death and heart disease.
    • “Participants who reached that threshold 3 or more days per week had a 40% lower mortality risk.
    • “Researchers said the key factor was the total number of steps per day — not how many days per week a certain number was reached.”
  • and
    • “With new research shedding light on how our food affects respiratory function and the progression of disease, interest in the role of diet in lung health is increasing. The reasoning behind it is based on the possible anti-inflammatory qualities of some diets and the fact that some lung conditions, such as asthma and chronic obstructive pulmonary disease (COPD), are inflammatory diseases, Maria Sfika, MD, pulmonary resident at Attikon University Hospital in Athens, Greece, told Medscape Medical News.
    • “However, at the European Respiratory Society (ERS) 2025 International Congress, in Amsterdam, researchers presented a nuanced picture. While a healthy diet generally supports better lung function and can improve control of certain conditions, its benefits may be mediated through weight control.”
  • and
    • “Glovadalen (UCB), an investigational brain-penetrant D1 receptor positive allosteric modulator (D1 PAM), is both safe and effective for patients with advanced Parkinson’s disease (PD), new research showed.
    • “Results from the phase 2 ATLANTIS trial, which included more than 200 patients with PD and significant daily motor fluctuations, showed that those who received oral glovadalen plus standard care for 10 weeks had a greater reduction in number of OFF hours per day than those who received matching placebo, meeting the primary endpoint.
    • “Additionally, significantly more participants receiving active treatment reported feeling better on the Patient Global Impression of Change (PGI-C) of PD symptoms scale than those receiving placebo.”
  • Per Genetic Engineering and Biotechnology News,
    • “By the time patients start seeking care for multiple sclerosis (MS), the disease has already been damaging their brain for years. But until recently, scientists didn’t understand which brain cells were being targeted or when the injury began.
    • ‘Now, by analyzing thousands of proteins found in the blood, scientists at the University of California, San Francisco (UCSF), have created what they view as the clearest picture yet of when the disease attacks the myelin sheath that covers the nerve fibers. It shows that the immune system begins attacking the brain even earlier than previously had been thought.
    • “The study “Myelin injury precedes axonal injury and symptomatic onset in multiple sclerosis,” published in Nature Medicine, measured debris from these attacks in a person’s blood, along with the signals that coordinate the immune system to go on the attack. It lays out, for the first time, the sequence of events that eventually lead to the disease.
    • “The discovery could lead to new ways to diagnose multiple sclerosis—and possibly one day prevent it, noted the scientists.” 
  • The New York Times reports,
    • “A new large-scale analysis found that the short-term cardiovascular and metabolic side effects of antidepressants vary widely by drug, but the ones most commonly prescribed in the United States are linked to relatively mild issues.
    • “Tens of millions of U.S. adults take antidepressants for mental health conditions such as depression and anxiety. Like any medication, antidepressants have well-established side effects for some people. Researchers at institutions including King’s College London and the University of Oxford wanted to better understand just how much those side effects differed from drug to drug.
    • “The new study, published Tuesday in The Lancet, is among the largest meta-analyses to compare some of the short-term side effects of antidepressants. The findings may help millions of doctors work with their patients to determine the right choice for them in a sea of options.”
  • Per STAT News,
    • “Moderna said Wednesday afternoon that its experimental vaccine for cytomegalovirus, a cause of disability in newborns, failed in a Phase 3 trial, a significant setback for a company already facing pressure from Wall Street and the federal government.
    • “The CMV vaccine had been the company’s lead program prior to the Covid-19 pandemic. Leadership had repeatedly said it could bring in between $2 billion and $5 billion in peak annual sales. Analysts polled by Visible Alpha forecast peak sales of $1.6 billion for the product.

From the HLTH 2025 Conference

  • Healthcare Dive reports,
    • “A top aide for HHS Secretary Robert F. Kennedy, Jr. made waves at the HLTH conference when he accused players across the healthcare industry of capitalizing off of chronic illnesses and turning a blind eye to potential root causes of the conditions, like diet.
    • “The problem is that most people in this room are just predominantly making money off more sick patients. And that’s just an economic fact,” Calley Means, an influential advisor to Kennedy, said.
    • “Means spoke on a panel Tuesday about the Make America Healthy Again movement, which centers around reducing chronic disease by reforming food, health and science systems. A groundswell of public support for MAHA helped usher President Donald Trump into office, and the president created a MAHA Commission through an executive order in February.”
  • and
    • “American Nurse Association President Jennifer Mensik Kennedy says industry pressures are coalescing to worsen nursing shortages.
    • “Studies estimate the U.S. will need 1.2 million new registered nurses by 2030 to meet care demands. The ANA, American Hospital Association and health systems have doggedly called for solutions to the growing labor crisis for years, with some health systems opting to acquire their own nursing schools to ensure sufficient pipelines of talent.
    • “Still, Kennedy says barriers remain to educating, recruiting and retaining quality nurses. Some problems are old hat — for example, it’s difficult to entice nurses to take a pay cut to become a nurse educator. However, new challenges are of the cultural and political moment, according to Kennedy, including developing strategies to retain nurses burnt out by patients peddling misinformation.”
    • The article also features a Healthcare Dive interview with the ANA President.
  • and
    • “The window for digital health initial public offerings has opened after a long period of stagnation, but the outlook isn’t entirely smooth for firms looking to make the leap to the public markets, experts said at the HLTH conference this week.
    • “Few digital health companies have entered the public markets in recent years, in sharp contrast to a surge of health technology IPOs in 2021. However, many firms that went public during the pandemic-era funding boom struggled in the spotlight — and some collapsed altogether. 
    • “There’s plenty of uncertainty in healthcare right now, making it more challenging for companies to decide to make a move, Robbert Vorhoff, managing director and global head of healthcare at private equity firm General Atlantic, said during a panel discussion at HLTH.”
  • Modern Healthcare adds,
    • “Virta Health Chief Commercial Officer Laura Walmsley said in a panel on Monday at HLTH that some employers are looking for GLP-1 alternatives that can be as effective as weight loss drugs. She said Virta Health, a virtual diabetes care company, has sold nutrition-only therapy solutions to employers looking to forgo covering GLP-1s for weight loss.
    • “Most employers are not covering GLP-1s for weight loss,” Walmsley said. “Greater than 50% are not covering them.”
  • and
    • “Cleveland Clinic is using AI to identify patients who may need surgery. The health system hopes to reduce costs and limit care complications by treating patients before conditions worsen.
    • “Predictive modeling can sift through claims data to flag a patient who may need spinal surgery, a heart procedure, bariatric surgery or other treatment. The technology has increased referrals to Cleveland Clinic and bolstered partnerships with employers and insurers, said Meghan Cassidy, senior director of sales and product development at Cleveland Clinic, in an interview at HLTH on Tuesday.”

From the U.S. healthcare business front,

  • The Wall Street Journal reports,
    • “The cost of health insurance rose steeply for a third year in a row in 2025, reaching just under $27,000 for a family plan, according to an annual survey from the nonprofit KFF, which provides the broadest picture of U.S. employer health coverage. 
    • “That is a 6% increase from the year before and builds on two prior years of 7% gains. The cost is rising faster than inflation, and economists and business leaders said it could bite into employment and wage growth. 
    • “If healthcare costs go up faster than the economy in general, that means there’s less money left over to go to wages,” said Gary Claxton, a senior vice president at KFF. 
    • “J.H. Berra Paving Co., in St. Louis, is struggling with this trade-off. The company is facing a 15% health-insurance rate increase this year, on top of last year’s increase, said John O’Connor, a risk manager for the company. That extra cost is likely to put a lid on wage increases for the company’s workers, O’Connor said.
    • “The KFF survey, which includes more than 1,860 employers and was completed earlier this year, offers a detailed snapshot of workplace insurance. Nearly half the U.S. population gets health coverage through a job.”
  • Modern Healthcare relates,
    • “MultiCare Health System and Samaritan Health Services look to combine the two nonprofit health systems, they announced Wednesday.
    • “The boards of the organizations approved a membership-substitution agreement that would make Tacoma, Washington-based MultiCare the parent company of Corvallis, Oregon-based Samaritan. MultiCare operates 13 hospitals and more than 300 primary, urgent, pediatric and specialty care facilities, while Samaritan operates five hospitals, more than 80 clinics and multiple health plans. 
    • ‘The systems plan to sign a definitive agreement in the coming weeks and close the proposed deal in mid-2026, pending customary regulatory approvals, according to a news release. A MultiCare spokesperson said the organizations in July signed a nonbinding letter of intent but did not disclose financial details.”
  • Per STAT News,
    • “As pharma companies and President Trump tout initiatives to sell branded medications directly to cash-paying consumers, some entrepreneurs have seized on a potential business opportunity — pitching a new model for employers to help their workers pay for medications without using insurance. 
    • “Take the blockbuster obesity treatments Wegovy and Zepbound, for example. Many employers don’t cover them, since they find them too expensive to add to their health plans. But now that the drug manufacturers Eli Lilly and Novo Nordisk have started selling the products directly to patients at about $500 a month, employers are being incentivized by startups to subsidize part of the cash price for their workers.
    • “Their pitch is this: Employers can pay less than they would if they covered the drugs through insurance and, with a subsidy, employees can get the treatments at a lower cost than if they paid the full cash price on their own. 
    • “One company, RxSaveCard, is charging employers a set fee to help them set up this model. CEO Chris Crawford said in an interview that the company has seen interest take off as more pharma companies launch direct-to-consumer sales and that hundreds of employers have either already signed up for RxSaveCard or will be adopting the model next year.
    • “Another new company, Andel, announced this week that it will launch a platform that will adopt a similar model for GLP-1 treatments and eventually for other branded drugs as well.”
  • Per Reuters,
    • Walmart (WMT.N) will become the first U.S. retailer to sell Abbott Laboratories’ (ABT.N), over-the-counter continuous glucose monitor Lingo in physical stores, an Abbott spokesperson said on Tuesday.
    • Abbott’s device, which was previously available only at HelloLingo.com and Amazon, will now be sold in Walmart’s 3,500 stores across the U.S.
    • Continuous glucose monitor makers such as Abbott, Dexcom (DXCM.O) and Medtronic (MDT.N) are riding a surge in demand as diabetes awareness rises, insurance coverage expands and patients embrace finger-prick-free technology.
  • Per BioPharma Dive,
    • “Brain drug developer Alkermes could spend billions of dollars in a new deal that, if completed, would give the company a marketed medication to build out its burgeoning sleep business.
    • “Alkermes on Wednesday said it has agreed to purchase Ireland-based Avadel Pharmaceuticals for $18.50 per share, reflecting a 3.5% premium to the latter company’s closing share price the day prior. Avadel’s main asset, Lumryz, is similar to the sleep drug Xyrem, which at its peak generated close to $2 billion in annual sales. Lumryz is already approved to treat excessive daytime sleepiness or cataplexy, a symptom of one form of narcolepsy that’s characterized by a sudden loss of muscle strength.”
  • and
    • Takeda [a Japanese pharmaceutical manufacturer] is turning to China to fuel its oncology pipeline, announcing Wednesday a wide-ranging collaboration with Innovent Biologics that could be worth more than $11 billion.
    • Through the alliance, Takeda is gaining rights outside of Greater China to two experimental cancer therapies in late-stage testing. It also acquired an option to a third in earlier development. Innovent, which is based in Suzhou, China, will receive $1.2 billion up front as well as a $100 million equity investment at a 20% premium to its current trading price on the Stock Exchange of Hong Kong. 
    • Takeda could add another $10.2 billion to the deal, if all three molecules hit a variety of development milestones.
  • Per MedTech Dive,
    • “The number of procedures performed with Intuitive Surgical’s flagship da Vinci system picked up pace in the third quarter, lifting the robot maker’s sales and earnings above Wall Street forecasts.
    • “Total procedures increased year over year by 20% worldwide, compared to 17% in the second quarter, which was the rate for all of 2024. Meanwhile, revenue rose 23% year over year to $2.51 billion, surpassing the average analyst forecast by $10 million, according to Citi Research.
    • “Procedure demand has been healthy,” Intuitive CEO Dave Rosa said on Tuesday’s earnings call.”

Tuesday report

David Ermer–Congress, FDA, Generative AI, Medical / Rx research, OPM, Patient safety, U.S. Healthcare–

From Washington, DC,

  • Federal News Network reports,
    • As Congress still appears far from reaching a spending agreement to end the partial government shutdown, hundreds of thousands of federal employees are expecting to miss their first full paychecks this Friday.
    • “Many excepted and furloughed federal employees received partial paychecks around Oct. 10, for the pay period that ended Oct. 4 — although they were only paid for workdays through Sept. 30.
    • “But while the shutdown drags on, some members of Congress are looking at other options to try to secure pay and benefits for certain employees impacted by the funding lapse.
    • “One Republican-led bill aims to provide immediate and regular compensation to excepted employees, who are continuing to work throughout the shutdown without pay. Sen. Ron Johnson (R-Wis.), who introduced the Shutdown Fairness Act [(S. 3012)] last week, said while the shutdown remains ongoing, Congress should “at least agree to pay all the federal employees that are forced to continue working.”
    • “The 2025 Shutdown Fairness Act is a permanent fix that will ensure excepted workers and our troops are paid during a shutdown,” Johnson said.
    • “Despite the Republican bill being teed up for consideration in the Senate this week, some Democrats, including House Minority Leader Hakeem Jeffries, have already indicated they would not support the legislation, since it provides pay for only a portion of the federal workforce.” 
    • FEHBlog note — As long as Speaker Johnson can hold his majority in the House, the Democrats
  • The American Hospital Association News tells us,
    • “The Centers for Medicare & Medicaid Services Oct. 21 announced that it has instructed all Medicare Administrative Contractors to lift a hold and begin processing claims dated Oct. 1 and later for those paid under the Medicare Physician Fee Schedule, ground ambulance transport claims and federally qualified health center claims. This also includes lifting holds on telehealth claims that CMS can confirm are for behavioral health services. CMS directed all MACs to continue temporary claims hold that began Oct. 1 for other telehealth services and acute Hospital Care at Home claims, as the shutdown approaches the start of a fourth week.”
  • Federal News Network tells us,
    • “The Office of Personnel Management is eyeing July 4, 2027, to fully launch a new governmentwide human resources system.
    • “In a new request for proposals released Friday, OPM details a much more specific plan of action to modernize and centralize 119 distinct core federal human resources systems across the government.
    • “The ideal ‘to be’ state is a single, pan-government core human capital management (HCM) system that gives the federal government full, real-time visibility into its workforce and drives effective workforce management on behalf of the American taxpayer,” wrote OPM Director Scott Kupor in a blog post on Monday. “Key to this ideal is our hypothesis that one system at governmentwide scale will drive significant per-user cost savings over the current siloed, duplicative, ad-hoc landscape.”
    • “Kupor said these 119 systems and the 44,000 people required to use them cost about $5.5 billion a year to manage, and are costly, error-prone and leads to unnecessary delays in enabling a seamless transition to retirement.”

From the Food and Drug Administration front,

  • Cardiovascular Business reports,
    • “The U.S. Food and Drug Administration (FDA) has confirmed that a safety concern it was investigating with Johnson & Johnson MedTech’s Automated Impella Controllers (AICs) has resulted in a Class I recall. The agency reserves Class I recalls for issues that could potentially lead to a serious injury or death.
    • “This latest issue with the Johnson & Johnson MedTech AICs revolves around “purge retainer failures,” including cracks, that customers have experienced during purge disc insertion or removal.”
  • Reuters informs us,
    • “The U.S. Food and Drug Administration has approved a new eye therapy from Glaukos Corp (GKOS.N), giving patients a less painful option to treat a progressive condition that can severely affect vision, the company said on Monday. * * *
    • “The approval makes the therapy, called Epioxa, the first FDA-cleared treatment that does not require removal of the eye’s outer protective layer, known as the corneal epithelium.
    • “Epioxa was approved to treat keratoconus, a condition in which the cornea thins and changes shape over time, making vision blurry and increasing the risk of blindness.
    • “Glaukos said it expects Epioxa to be commercially available in the first quarter of 2026.”

From the public health and medical / Rx research front,

  • The New York Times reports,
    • “Food allergies in children dropped sharply in the years after new guidelines encouraged parents to introduce infants to peanuts, a study has found.
    • “For decades, as food allergy rates climbed, experts recommended that parents avoid exposing their infants to common allergens. But a landmark trial in 2015 found that feeding peanuts to babies could cut their chances of developing an allergy by over 80 percent. In 2017, the National Institute of Allergy and Infectious Diseases formally recommended the early-introduction approach and issued national guidelines.
    • “The new study, published Monday in the journal Pediatrics, found that food allergy rates in children under 3 fell after those guidelines were put into place — dropping to 0.93 percent between 2017 and 2020, from 1.46 percent between 2012 and 2015. That’s a 36 percent reduction in all food allergies, driven largely by a 43 percent drop in peanut allergies.
    • “The study also found that eggs overtook peanuts as the No. 1 food allergen in young children.”
  • The American Journal of Managed Care points out,
    • “Body size and metabolic factors—including body mass index (BMI), basal metabolic rate (BMR), body surface area (BSA), and weight—significantly influence psoriasis severity and response to treatment, a study has found.1 Patients with higher measurements were less likely to achieve strong improvement with biologic therapies, suggesting a critical role for personalized dosing in clinical management, particularly for fixed-dose biologics like ustekinumab.
    • “This multicenter, prospective study is published in Journal of Translational Medicine.
    • “Our findings provide important insights into the interplay between body size, metabolic parameters, and psoriasis,” wrote the researchers of the study. “The observation that higher values of BMI, BSA, BMR, and body weight were more common in individuals with higher educational attainment, males, and those reporting smoking or alcohol use may reflect lifestyle- and nutrition-related influences on metabolic status.”
  • Per Cardiovascular Business,
    • “Back in 2023, the American Heart Association (AHA) coined a new term to describe the close relationships between cardiovascular disease (CVD), kidney disease, type 2 diabetes and obesity: cardiovascular-kidney-metabolic (CKM) syndrome.
    • “CKM syndrome involves nearly every major organ in the body, the AHA explained. Patients with CVD often face a heightened risk of developing kidney disease, type 2 diabetes or obesity. Also, patients with any of those three conditions may face a heightened risk of CVD. 
    • ‘More than two years later, the AHA’s message has yet to make a significant impact on the general public. However, new survey data suggests there is a reason to be hopeful.
    • “According to an August 2025 survey, just 12% of U.S. adults have heard of CKM syndrome. The good news, though, is that 79% of respondents said it is important to know more about the way these different health conditions interact with one another. And 72% indicated they were interested in learning more.”
  • Per MedPage Today,
    • “Maternal respiratory syncytial virus (RSV) vaccination during pregnancy and infant RSV immunization — either alone or combined — appeared to be safe and effective at boosting neutralizing RSV antibodies, according to interim results from a randomized, open-label phase IV clinical trial.”
  • and
    • “Giving oseltamivir (Tamiflu) to children hospitalized with influenza cut their risk of ICU admission by nearly one-third and significantly shortened their lengths of stay (LOS), according to a retrospective cohort study.”
  • and
    • “Patients with metastatic hormone-sensitive prostate cancer (mHSPC) lived significantly longer without disease progression with the addition of radioligand therapy to hormonal treatment, a large, randomized trial showed.”
  • and
    • “Adding another twist to the ongoing debate about the effects of weight-loss drugs on vision, a retrospective cohort study linked GLP-1 receptor agonists to a lower risk of legal blindness in patients with type 2 diabetes and risk for cardiovascular disease.”
  • The Wall Street Journal takes us “Inside Priscilla Chan’s Multibillion-Dollar Wager to Outsmart Disease.” As the initiative she co-founded celebrates its 10-year anniversary, Chan is pursuing a wildly ambitious goal: unlocking the hidden causes of disease.

From the HLTH 2025 Conference

  • Modern Healthcare reports,
    • “Risant Health has reduced care variation by using hospitals’ electronic health records to guide treatment, a model it hopes to expand to other hospitals as the Kaiser Permanente-backed nonprofit venture grows, Geisinger Health, Kaiser and Risant executives said during a Tuesday panel at HLTH.
    • “Risant, which was formed in April 2024 when Kaiser acquired Geisinger and folded it into Risant, has integrated what executives describe as value-based care guides into EHRs. A clinician can select a list of the most common conditions for certain specialties and order evidence-based tests and follow-ups via the EHR.
    • “The guides have helped standardize care across Geisinger hospitals, said Dr. Benjamin Hohmuth, chief medical informatics officer at the Danville, Pennsylvania-based health system.
    • “Whether you live in California, are a Geisinger patient in Pennsylvania or a Cone Health patient in North Carolina, you should be receiving the same care and the bias should lean toward more comprehensive primary care,” he said. “It leads to faster resolution for patient concerns, lower cost sharing for patients and frees up specialty access.”
    • “The new protocols have helped reduce the number of primary care visits associated with specialty referrals by about 7% over the last year at Geisinger, freeing up capacity for about 10,000 annual specialty care appointments, and increased virtual and primary care utilization, Hohmuth said.”
  • and
    • “UnitedHealth Group Inc. is testing a new system to streamline how medical claims are processed, an early example of what the company says is the potential for artificial intelligence to smooth out friction in billing.
    • “The system, dubbed Optum Real, aims to distill health plans’ complex rules around what is covered into information that doctors, and billing staff can use in real time to tell whether a claim is likely to be paid. 
    • “It’s been in place at Allina Health, a 12-hospital system based in Minneapolis, since March, where two departments have used it to connect to UnitedHealthcare, the health conglomerate’s insurance division. It’s already reduced claims denials meaningfully across more than 5,000 visits in Allina’s outpatient cardiology and radiology departments, said Dave Ingham, chief digital and information officer for the hospital group.” * * *
    • “Optum Real is speeding up prior authorization requests and helping some patients get care faster, Allina Health’s Ingham said. It’s also reducing headaches for billing and coding staff by flagging claims that need more documentation, for example, before they’re denied. That lets Allina fix the problem without a lengthy back-and-forth with the insurer.
  • Healthcare Dive notes,
    • “Medical billing tech firm Cedar launched a tool Monday that aims to help patients enroll in and maintain Medicaid coverage as the healthcare sector braces for major cuts to the safety-net insurance program.
    • “The product, called Cedar Cover, identifies patients who may be eligible for Medicaid, reminds beneficiaries of upcoming eligibility checks, helps them manage care denials and connects them to medication co-pay assistance, the company announced at the HLTH 2025 conference in Las Vegas. 
    • “The tool comes months after President Donald Trump signed a massive tax and policy law that includes historic cuts to Medicaid. “This bill is going to directly drive increases in uninsured patient care,” Seth Cohen, president of Cedar, said at HLTH.”
  • and
    • “Generation X and Millennials are more interested in utilizing artificial intelligence tools in healthcare as the two generations are increasingly squeezed by caregiving responsibilities for children and aging parents, according to a survey by PwC. 
    • “More than 70% of Gen X and Millennials are currently using or interested in AI-assisted diagnosis products leveraged and reviewed by doctors, compared with 56% of the total population, according to the report released at the HLTH conference Monday.
    • Additionally, 73% of the two generations are using or interested in AI-backed care navigation tools, compared with 53% of the overall population. “They just have a lack of time,” said Thom Bales, principal and health services advisory leader at PwC. “And so, I think that when you see their openness, it is a call to simplifying their life.”
  • Per Fierce Healthcare,
    • “Oscar Health has unveiled its slate of plans available for the 2026 open enrollment window, including a new product launch designed for members who are navigating menopause.
    • “The plan, called HelloMeno, was built in partnership with Elektra Health, a virtual menopause care provider, and offers $0 primary care, gynecologist and behavioral health visits. Members who enroll in this plan option will also receive no-cost labs, hormone therapy, insomnia medications and bone density scans, per an announcement.
    • “Through Elektra, members can connect to its network of experts at any time and are estimated to save $900 per year on their healthcare costs. The plan also allows for low-cost treatment options for autoimmune conditions like rheumatoid arthritis or Crohn’s disease.”

From the U.S. healthcare business front,

  • Healthcare Dive reports,
    • “Elevance posted revenue and profit growth in the third quarter as the Indianapolis-based insurer brought in higher premiums and kept medical costs for its members in check.
    • “Elevance raked in net income of $1.2 billion on revenue of $50.1 billion in the quarter, up 17% and 12% year over year, respectively. Elevance’s stock ticked up in premarket trade after the results were released Tuesday morning — but it dropped again after executives implied that profit growth could shrink in 2026 during a call with investors later in the morning.
    • “Elevance said it expects a decline in Medicaid margins as state payment rates continue to not cover members’ medical costs — a bad sign for other managed care companies with a large presence in the safety-net insurance program, like Centene and Molina. Elevance also plans to invest “several” hundred million dollars in its health services division Carelon, artificial intelligence capabilities and Medicare Advantage star ratings, which could stifle earnings growth next year.”
  • Per MedTech Dive,
    • “Hologic said Tuesday that it has agreed to be acquired by funds managed by Blackstone and TPG in a take-private deal valuing the company at up to $18.3 billion.
    • “Hologic, which makes diagnostic tools including mammography machines and cervical cancer screening tests, would be delisted from Nasdaq upon completion of the transaction. The company would keep its brand and current headquarters in Marlborough, Massachusetts.
    • “The acquisition is expected to close in the first half of 2026, subject to shareholder and regulatory approval. Hologic’s board unanimously approved the deal.”
  • Beckers Hospital Review shares a non-exhaustive list of “72 health systems with strong operational metrics and solid financial positions, according to reports from credit rating agencies Fitch Ratings and Moody’s Investors Service released in 2025,” and offers a look at Microsoft’s healthcare moves.
  • The International Foundation of Employee Benefit Plans offers it medical stop loss premium survey while Brown and Brown posts its 2025 PBM industry and market update.
  • Healthcare IT News lets us know that the American Medical Association has created a new Center for Digital Health and AI.  “The AMA says the new initiative is designed to ensure physicians are involved in the development and deployment of artificial intelligence technologies and to help shape AI policy conversations.”

Monday report

David Ermer–Congress, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Mental health care, Obesity, OPM, U.S. Healthcare–

From Washington, DC,

  • Govexec reports,
    • “As the Senate continues to take failed votes to reopen the government, the chamber will soon shift to a new approach that would ensure on-time for feds working during the shutdown. 
    • “In its 20th day, Senate Democrats were expected to reject for the 11th time a short-term spending measure to fund agencies through Nov. 21. Senate Republicans are looking to ramp up pressure on Democrats by allowing normal paychecks for employees required to continue reporting to their jobs without immediate compensation during the shutdown. 
    • “Senate Majority Leader John Thune, R-S.D., told reporters he would on Monday evening take the first procedural step to bring the measure up for consideration, with a vote taking place either Wednesday or Thursday. 
    • “They’re all going to get paid eventually, but I think people who are working right now and not getting paid ought to be,” Thune said.” 
  • Before Congress overrides it, here’s a link to OPM’s 89-page long Guidance on Shutdown Furloughs, which the FEHBlog ran across today.
  • Kevin Moss, writing in Govexec, discusses “what FEHB changes mean for your 2026 health coverage. Premiums are shifting, and the government contribution varies. Here’s what to know to avoid surprises and save where you can.”

From the Food and Drug Administration front,

  • Cardiovascular Business relates,
    • “The U.S. Food and Drug Administration (FDA) has approved Rybelsus, Novo Nordisk’s oral semaglutide formulation, for reducing the risk of major adverse cardiovascular events in high-risk patients with type 2 diabetes. Rybelsus is officially the first oral GLP-1 drug approved for this indication.
    • “The FDA’s decision was largely based on data from the SOUL trial, which included data from more than 9,000 patients who were randomized to oral semaglutide or a placebo.[1] All patients had type 2 diabetes in addition to known atherosclerotic cardiovascular disease, chronic kidney disease or both. Overall, the study’s primary outcome—a composite of cardiovascular death, nonfatal heart attack or nonfatal stroke—was seen in 12% of oral semaglutide patients and 13.8% of placebo patients. This represents a 14% overall reduction, similar to the results associated with injectable semaglutide.
    • “The FDA originally approved Rybelsus in 2019 to improve glycemic control in adults with type 2 diabetes. At the time, it was the celebrated as the first GLP-1 drug available in pill form—and it still is six years later.”
  • Fierce Pharma adds,
    • “With the lupus treatment landscape poised for a shake-up, Roche is hitting the scene in the U.S. with a new green light for its long-approved blood cancer medicine Gazyva.
    • “Early Monday, Roche’s Genentech announced that the FDA cleared Gazyva (obinutuzumab) to treat adults with active lupus nephritis who are taking standard therapy.
    • “The drug will be given as four initial infusions during the first year of treatment, after which it can be administered twice yearly.” 
  • Per MedTech Dive,
    • “Ōura is pursuing Food and Drug Administration clearance of a blood pressure feature for its smart rings.
    • “Having engaged with the FDA, Ōura has received approval to study the feature in a population of users who are signed up to try experimental features of its devices, the company said Monday. 
    • “Participants will answer health questions. By combining the answers with data from the user’s ring, Ōura will assess the likelihood of the patient having high blood pressure.”

From the public health and medical / Rx research front,

  • The Washington Post reports on “four surprising things that may reduce your risk of Parkinson’s. Research on Parkinson’s is revealing several risk factors related to our lifestyles and environment, and you can act on some of them.”
    • “Parkinson’s disease, once considered relatively rare, is now one of the most common neurological disorders in the world, and the second most common after Alzheimer’s disease. The number of people living with Parkinson’s has more than doubled in the past 25 years to 8.5 million and is predicted to hit 25.2 million by 2050.”
    • “The hallmark symptoms of Parkinson’s — such as tremors, stiffness, and difficulty with balance and coordination — result from the deterioration of neurons in the basal ganglia, an area of the brain that controls movement. While 10 to 15 percent of cases are linked to inherited genetic mutations, the rest are considered “sporadic,” with no known cause.
    • “Although treatments are available that can manage symptoms, there is no cure or therapy that can slow disease progression. But ongoing research on Parkinson’s is revealing several risk factors related to our lifestyles and environment, some of which are actionable.
    • “For example, moderate to vigorous exercise may reduce one’s risk, according to a 2018 meta-analysis, and some studies have shown that healthy diets focused on whole, unprocessed foods might help. Last year, a study found that higher levels of exposure to air pollution were associated with an increased risk of Parkinson’s.”
    • The article offers more tips.
  • The New York Times points out,
    • For the first time, researchers restored some vision to people with a common type of eye disease by using a prosthetic retinal implant. If approved for broader use in the future, the treatment could improve the lives of an estimated one million, mostly older, people in the United States who lose their vision to the condition.
    • The patients’ blindness occurs when cells in the center of the retina start to die, what is known as geographic atrophy resulting from age-related macular degeneration. Without these cells, patients see a big black spot in the center of their vision, with a thin border of sight around it. Although their peripheral vision is preserved, people with this form of advanced macular degeneration cannot read, have difficulty recognizing faces or forms and may have trouble navigating their surroundings.
    • In a study published Monday in The New England Journal of Medicine, vision in 27 out of 32 participants improved so much that they could read with their artificial retinas.
  • The American Medical Association lets us know what doctors wish their patients knew about menopause.
  • Healio tells us,
    • “Exposure to elevated blood pressure through young adulthood was linked to cognitive decline by midlife.
    • “The trend was consistent across race and sex subgroups.”
  • NBC News reports,
    • “With age comes a natural decline in cognitive function, even among otherwise healthy adults without dementia. A new study finds that a cognitive training program may boost production of a brain chemical that plays a role in memory and attention.
    • “Participants who completed game-like activities through BrainHQ, an online subscription program, showed increased production of acetylcholine, sometimes called the “pay attention” chemical. The process that produces acetylcholine in the brain is called the cholinergic system.”
  • Per MedPage Today,
    • “Having shingles boosted the risk of major adverse cardiovascular events (MACE) such as vascular dementia, heart attack, stroke, and death by roughly a quarter — but people who received the recombinant shingles vaccine before developing shingles saw their risks of those outcomes drop by up to half, according to a large retrospective study.
    • “Among more than 174,000 people, ages 50 or older, those who developed a herpes zoster infection were approximately 20% more likely to have a heart attack, 27% more likely to have a stroke, and up to 30% more likely to die than people who didn’t develop shingles, reported Ali Dehghani, DO, of Case Western Reserve University in Cleveland.
  • and
    • “Visceral and liver fat were tied to carotid atherosclerosis in two cohort studies using MRI and ultrasound imaging.
    • “Associations persisted even after accounting for traditional cardiovascular risk factors like cholesterol and blood pressure.
    • “Study authors encourage a healthy diet as a way reduce visceral fat and therefore manage the risk of cardiovascular disease.”
  • Per Genetic Engineering and Biotechnology News,
    • “In a new study published in Cancer Cell titled, “Tumor-infiltrating bacteria disrupt cancer epithelial cell interactions and induce cell-cycle arrest,” researchers from the University of Texas MD Anderson Cancer Center have discovered a previously unknown mechanism that explains how bacteria can drive treatment resistance in patients with oral and colorectal cancer. 
    • “While tumor-infiltrating bacteria have been known to impact cancer progression and treatment, the mechanism has been unclear. Results demonstrate how the bacteria, Fusobacterium nucleatum (Fn), can induce a reversible state, known as quiescence, in cancer epithelial cells to allow tumors to evade the immune system and resist chemotherapy. 
    • “These bacteria-tumor interactions have been hiding in plain sight, and with new technologies we can now see how microbes directly affect cancer cells, shape tumor behavior and blunt the effects of treatment,” said Susan Bullman, PhD, associate professor of Immunology and associate member of MD Anderson’s James P. Allison Institute and corresponding author of the study. “It’s a whole layer of tumor biology we’ve been missing and one we can now start to target. We hope these findings help open the door to designing smarter, microbe-aware therapies that could make even the toughest cancers more treatable.” 

From the HLTH Conference,

  • Modern Healthcare tells us,
  • Healthcare Dive informs us,
    • “Online pharmacy Cost Plus Drugs will be participating in President Donald Trump’s drug price transparency tool, TrumpRx, according to Cost Plus’ founder Mark Cuban.
    • “Cuban shared the news during his keynote at the HLTH conference on Sunday, during which the billionaire entrepreneur and pharmacy disruptor also excoriated the pharmacy benefit manager industry for driving up the cost of U.S. medications.”
  • Per Fierce Healthcare,
    • “At the 2025 HLTH conference in Las Vegas, GE HealthCare unveiled health system partnerships and the latest research projects that are part of its AI Innovation Lab. 
    • “The company is working with the Queen’s Health Systems in Honolulu and Duke Health in Durham to advance the development of its new AI-driven hospital operations software, which will become part of CareIntellect.
    • “CareIntellect, a generative AI platform, is a hub for various GE HealthCare applications and was first announced at HLTH last year. The idea is to enable health systems to easily deploy new applications without a product-by-product integration approach. 
    • “Now you can really have a common data layer, that’s all the data is structured in a way that you can analyze and plug into. You can bring more applications, whether that’s on the operations side, on the care delivery side,” Taha Kass-Hout, GE HealthCare’s global chief science and tech officer, told Fierce Healthcare.”
  • and
    • WeightWatchers is joining forces with Amazon Pharmacy to make it easier for members to access weight management medications.
    • The company announced Monday that through the partnership its members will be able to access information on real-time medication availability, automated coupon savings and home delivery for key medications they use to manage their weight.
    • Amazon Pharmacy will automatically apply coupons for members at the point of checkout, according to an announcement, without the need to submit codes manually. Amazon Prime members have access to two-day home delivery, and in certain locations same-day delivery is available as an option.
    • Scott Honken, chief commercial officer for WeightWatchers, told Fierce Healthcare that the team has had a longstanding relationship with Amazon, but tapping into its pharmacy unit made sense as it looked to improve access and ease for members.
  • and
    • “Artificial intelligence startup OpenEvidence banked $200 million in series C funding, just three months after it raised $210 million in a series B.
    • “The three-year-old company’s valuation hit $6 billion post-series C raise, Daniel Nadler, Ph.D., one of OpenEvidence’s founders confirmed to Fierce Healthcare on Monday. OpenEvidence developed an AI-powered medical search engine and generative AI chatbot exclusively for doctors that summarizes and simplifies evidence-based medical information. 
    • “The New York Times first reported the series C funding Monday morning.
    • “OpenEvidence has raised nearly $500 million since its founding in 2022. Google Ventures led the round. Existing investors Sequoia, Kleiner Perkins, Thrive and Coatue backed the series C. New investors BOND (Mary Meeker), Blackstone and Craft also joined the round.
    • “The company offers its chatbot to physicians for free, and the product has grown organically through word of mouth between doctors, Nadler said.
    • “OpenEvidence plans to use the fresh funding to continue building out its AI technology.”
  • and
    • “Highmark is teaming up with Noom to roll out its weight management solution to members.
    • “Eligible members can enroll in the program and will receive Noom’s services at no cost. Their care journeys can be personalized to meet their individual needs and generally follow three tracks: weight loss and management, diabetes prevention and management.
    • “Maria Baker, vice president for health strategy and delivery at Highmark, told Fierce Healthcare that the partnership with Noom reflects the insurer’s broader commitment to whole-person health, as a holistic weight management program is a logical place to start filling in key gaps in members’ experiences.
    • “The healthcare industry can forever try to make people come to us and think about our language, or we can meet people where they are,” she said. “And one of the best ways to do that is to meet people in a language they understand, and through a door that people are always talking about.
    • “So the weight journey was the most logical place to start,” Baker said.”
  • and
    • “Knownwell picked up $25 million in fresh funding, riding the wave of investment in obesity care.
    • “CVS Health Ventures led the round with participation from MassMutual Catalyst Fund and Intermountain Ventures.
    • “Existing investors a16z Bio + Health and Flare Capital Partners also backed the oversubscribed financing round. The company has raised a total of $50 million to date, with a $20 million round in late 2023.
    • “The startup offers in-person and virtual services as a weight-inclusive primary care and metabolic health company. Knownwell offers broader services beyond just weight management or GLP-1 prescriptions to include nutrition counseling and behavioral health services both online and in person.”

From the U.S. healthcare business front,

  • Beckers Oncology notes,
    • “Philadelphia-based Penn Medicine and Penn Medicine Princeton (N.J.) Health will break ground on a $401 million cancer center Oct. 20 at the Princeton Medical Center in Plainsboro, N.J.
    • “The Penn Medicine Princeton Cancer Center is expected to open in May 2028, according to a Penn Medicine news release.
    • “The center will house more than 40 exam rooms, 30 infusion chairs, two linear accelerators for radiation therapy and a breast imaging center.
    • “Care teams at the cancer center will work with experts from the Penn Medicine Abramson Cancer Center. Patients will also have access to clinical trials and services such as proton therapy and personalized cell therapies through other Penn Medicine care sites, the release said.”
  • Per Fierce Pharma,
    • “Merck has kicked off construction of a new $3 billion facility at its sprawling manufacturing campus in Elkton, Virginia. The investment is part of the New Jersey company’s plan to spend more than $70 billion on manufacturing, R&D and capital projects in the U.S., it announced Monday.
    • “The planned 400,000-square-foot facility will add to Merck’s presence at the massive site at the base of the Blue Ridge Mountains in Virginia’s Shenandoah Valley. The complex already covers 1.2 million square feet and employs more than 1,000.
    • “With the investment spanning active pharmaceutical ingredient and drug product functions, the new plant will support small-molecule production and testing, Merck said. The facility, dubbed as its Center of Excellence for small-molecule manufacturing, could create more than 500 full-time jobs, according to the company.”
  • Modern Healthcare relates,
    • “Hartford HealthCare said Monday it won a bid to purchase two Connecticut hospitals from bankrupt Prospect Medical Holdings. The deal, which is subject to court approval, involves Manchester Memorial Hospital and Rockville General Hospital.” 
  • and
    • “Humata Health will provide its prior authorization automation tool through Microsoft’s generative artificial intelligence assistant, Dragon Copilot.
    • “Microsoft launched Dragon Copilot in March to assist clinicians with documentation, revenue cycle management, patient engagement and decision support. 
    • “The integration will enable clinicians to automate and complete prior authorizations within their workflows, a Humata spokesperson said Monday. Microsoft will determine when the tool will be available through Dragon Copilot, and Humata is discussing the capability with customers, the spokesperson said.”
  • BioPharma Dive lets us know,
    • “The share price of Alto Neuroscience more than doubled at one point Monday, after the psychiatry drug specialist announced plans to hasten the development of a potential depression medicine.
    • “This medicine, code-named ALTO-207, combines a drug already used to treat Parkinson’s disease with the active ingredient in the nausea medication Zofran. Alto got ahold of ALTO-207 this spring, when, for less than $2 million, it bought a slate of experimental, dopamine-boosting drugs from Chase Therapeutics. In unveiling that deal, Alto said it intends to start, by the middle of next year, a mid-stage clinical trial that could serve as the foundation for ALTO-207 getting approved in treatment-resistant depression.
    • “Now, encouraged by a recent meeting with the Food and Drug Administration, the company also wants to initiate a late-stage study by early 2027.”
  • Per Fierce Healthcare,
    • “Humana and Providence on Monday unveiled a new data exchange partnership the major payer and provider said could become a blueprint for the broader industry.
    • “The data sharing ecosystem is slated to go live later this month in an initial rollout focused on automating member attribution for Humana Medicare Advantage members, which the companies said will help the 51-hospital system’s providers understand which patients are considered by Humana to be under their care.
    • “Additional capabilities on the data exchange collaboration’s road map will focus on reducing administrative burden and bolstering clinical decision-making, they said.
    • “The healthcare industry is overwhelmed by fragmented, inconsistent data formats that make care coordination costly and slow,” Michael Westover, vice president of population health informatics at Providence, said in the announcement. “Because we want to be successful in value-based care contracts, Humana and Providence are building a shared foundation of administrative, financial and clinical data using national standards and modern technology.”
    • “More specifically, the pair said they’re using HL7 Fast Healthcare Interoperability Resources (FHIR), Da Vinci Project Implementation Guides and other “modern” application programming interfaces (APIs) to build out their infrastructure.
    • “That framework “will be easily replicable, serving as a scalable model that can transform care across the healthcare industry,” they said.”
  • Per an Institute of Clinical and Economic Review news release,
    • “Today released a Draft Evidence Report assessing the comparative clinical effectiveness and value of cytisinicline (Achieve Life Sciences, Inc.) for smoking cessation.
    • “This preliminary draft marks the midpoint of ICER’s eight-month process of assessing this treatment, and the findings within this document should not be interpreted to be ICER’s final conclusions. * * *
    • “The Draft Evidence Report and Draft Voting Questions are now open to public comment. All stakeholders are invited to submit formal comments by email to publiccomments@icer.org, which must be received by 5 PM ET on November 17, 2025.” 

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • The White House issued a proclamation yesterday about October being Cybersecurity Awareness Month so let’s go.
  • Per Cyberscoop,
    • “European law enforcement dismantled and seized an expansive cybercrime operation used to facilitate phishing attacks via mobile networks for fraud, including account intrusions, credential and financial data theft, Europol said Friday [October 17].
    • “Investigators from Austria, Estonia and Latvia linked the cybercrime networks to more than 3,200 fraud cases, which also involved investment scams and fake emergencies for financial gain. Financial losses amounted to about $5.3 million in Austria and $490,000 in Latvia, authorities said.
    • “The operation dubbed “SIMCARTEL” netted seven arrests and the seizure of 1,200 SIM box devices, which contained 40,000 active SIM cards that were used to conduct various cybercrimes over telecom networks. Officials described the infrastructure as highly sophisticated, adding that the online service it supported provided telephone numbers for criminal activities to people in more than 80 countries.”
  • and
    • “A Massachusetts man who previously pleaded guilty to a cyberattack on PowerSchool, exposing data on tens of millions of students and teachers, was sentenced to four years in prison Tuesday — half the amount federal prosecutors sought in sentencing recommendations submitted to the court.
    • “Matthew Lane, 20, stole data from PowerSchool belonging to nearly 70 million students and teachers, extorted the California-based company for a ransom, which it paid, causing the education software vendor more than $14 million in financial losses, according to prosecutors.
    • “U.S. District Judge Margaret Guzman sentenced Lane to four years in prison, followed by three years of supervised release. Lane was also ordered to pay almost $14.1 million in restitution and a $25,000 fine for crimes involving the attack on PowerSchool and an undisclosed U.S. telecommunications company.”

From the cybersecurity vulnerabilities and breaches front,

  • Cyberscoop reports,
    • “Federal cyber authorities issued an emergency directive Wednesday [October 15] requiring federal agencies to identify and apply security updates to F5 devices after the cybersecurity vendor said a nation-state attacker had long-term, persistent access to its systems.
    • The order, which mandates federal civilian executive branch agencies take action by Oct. 22, marked the second emergency directive issued by the Cybersecurity and Infrastructure Security Agency in three weeks. CISA issued both of the emergency directives months after impacted vendors were first made aware of attacks on their internal systems or products.
    • F5 said it first learned of unauthorized access to its systems Aug. 9, resulting in data theft including segments of BIG-IP source code and details on vulnerabilities the company was addressing internally at the time. CISA declined to say when F5 first alerted the agency to the intrusion.
    • CISA officials said they’re not currently aware of any federal agencies that have been compromised, but similar to the emergency directive issued following an attack spree involving zero-day vulnerabilities affecting Cisco firewalls, they expect the response and mitigation efforts to provide a better understanding of the scope of any potential compromise in federal networks.
  • and
    • “F5, a company that specializes in application security and delivery technology, disclosed Wednesday that it had been the target of what it’s calling a “highly sophisticated” cyberattack, which it attributes to a nation-state actor. The announcement follows authorization from the U.S. Department of Justice, which allowed F5 to delay public disclosure of the breach under Item 1.05(c) of Form 8-K due to ongoing law enforcement considerations.
    • “According to an 8-K form filed with the Securities and Exchange Commission, the company first became aware of unauthorized access Aug. 9 and initiated standard incident response measures, including enlisting external cybersecurity consultants. In September, the Department of Justice permitted F5 to withhold public disclosure of the breach, which the government allows if a breach is determined to be a “a substantial risk to national security or public safety.”  
    • “Investigators discovered that the threat actor maintained prolonged access to parts of F5’s infrastructure. Systems affected included the BIG-IP product development environment and the company’s engineering knowledge management platform. The unauthorized access resulted in the exfiltration of files, some of which contained segments of BIG-IP source code and details regarding vulnerabilities that the company was actively addressing at the time. It also said the files taken were “configuration or implementation information for a small percentage of customers.”
  • Cybersecurity Dive adds,
    • “More than 600,000 F5 network security devices running the company’s flagship BIG-IP software are sitting unpatched on the internet one day after the company revealed that nation-state hackers had accessed its networks and source code.
    • “The figure, which Palo Alto Networks provided on Thursday [October 16], highlights how many organizations could be vulnerable to cyberattacks exploiting vulnerabilities that the unidentified hackers discovered while roaming through F5’s production environment and developer resources.” * * *
    • “F5, which said on Thursday that it believed it had kicked the hackers out of its networks, is working with government and private-sector cyber experts to further investigate the compromise. CISA ordered federal agencies to promptly patch their affected F5 products and disconnect the devices’ management interfaces from the internet.
    • “The potential impact of this compromise is unique due to the theft of confidential information regarding previously undisclosed vulnerabilities that F5 was actively in the process of patching,” Palo Alto Networks researchers wrote in their blog post. “This data potentially grants threat actors the capacity to exploit vulnerabilities for which no public patch currently exists, which could accelerate the creation of exploits.”
    • “F5 said there was no evidence that the hackers had compromised its source code or software production processes, despite having access to those systems and data.”
  • CISA added six known exploited vulnerabilities to its catalog this week.
    • October 14, 2025
      • CVE-2016-7836 SKYSEA Client View Improper Authentication Vulnerability
      • CVE-2025-6264 Rapid7 Velociraptor Incorrect Default Permissions Vulnerability
      • CVE-2025-24990 Microsoft Windows Untrusted Pointer Dereference Vulnerability
      • CVE-2025-47827 IGEL OS Use of a Key Past its Expiration Date Vulnerability
      • CVE-2025-59230 Microsoft Windows Improper Access Control Vulnerability
        • Security Affairs Discusses these KVEs here.
    • October 15, 2025
      • CVE-2025-54253 Adobe Experience Manager Forms Code Execution Vulnerability
        • Security Week discusses this KVE here.
  • Per Cyberscoop,
    • “North Korean operatives that dupe job seekers into installing malicious code on their devices have been spotted using new malware strains and techniques, resulting in the theft of credentials or cryptocurrency and ransomware deployment, according to researchers from Cisco Talos and Google Threat Intelligence Group.
    • “Cisco Talos said it observed an attack linked to Famous Chollima that involved the use of BeaverTail and OtterCookie — separate but complementary malware strains frequently used by the North Korea-aligned threat group. Researchers said their analysis determined the extent to which BeaverTail and OtterCookie have merged and displayed new functionality in recent campaigns. 
    • “GTIG said it observed UNC5342 using EtherHiding, malicious code in the form of JavaScript payloads that turn a public blockchain into a decentralized command and control server. Researchers said UNC5342 incorporated EtherHiding into a North Korea-aligned social engineering campaign previously dubbed Contagious Interview by Palo Alto Networks. 
    • “Cisco and Google both said North Korean threat groups’ use of more specialized and evasive malware underscores the efforts the nation-state attackers are taking to achieve multiple goals while avoiding more common forms of detection.”
  • Per Dark Reading,
    • “Major password managers are being impersonated in a spate of recent phishing attacks, including LastPass, Bitwarden, and 1Password, and enterprise users should be on notice. In a three-week span, all of them have been dealing with impersonation attacks by threat actors trying to con users into handing over their master password — and with it, troves of sensitive credentials.
    • “Password management vendors have long been among hackers’ favorite brands to impersonate, for good reason. Users need to have complete trust in their password managers — after all, nobody would store all of their credentials for all of their accounts in an app they didn’t have total confidence in. Phishers try to exploit that trust.
    • “Because password managers are protected by a single master password, a password reset scam — “Your password has been compromised, click here to reset it” — might engender more fear and urgency in this context than in others with lower stakes (that is, unless the user understands the basic mechanics of how their manager works — namely, that their master password would never be stored online to begin with). And of course, if attackers can get their hands on just that one master password, they can access all of a user’s online accounts, plus all of the huge corporate systems they might afford access to.
    • “Either by coincidence or reflecting a growing trend, password manager phishing attacks have been popping up even more than usual this October, cyber researchers are warning.”
  • Per Bleeping Computer,
    • “Threat actors exploited a recently patched remote code execution vulnerability (CVE-2025-20352) in Cisco networking devices to deploy a rootkit and target unprotected Linux systems.
    • “The security issue leveraged in the attacks affects the Simple Network Management Protocol (SNMP) in Cisco IOS and IOS XE and leads to RCE if the attacker has root privileges.
    • “According to cybersecurity company Trend Micro, the attacks exploited the flaw in Cisco 9400, 9300, and legacy 3750G series devices and deployed rootkits on “older Linux systems that do not have endpoint detection response solutions.”
  • and
    • “Earlier this week, Microsoft patched a vulnerability that was flagged with the “highest ever” severity rating received by an ASP.NET Core security flaw.
    • “This HTTP request smuggling bug (CVE-2025-55315) was found in the Kestrel ASP.NET Core web server, and it enables authenticated attackers to smuggle another HTTP request to hijack other users’ credentials or bypass front-end security controls.
    • “An attacker who successfully exploited this vulnerability could view sensitive information such as other user’s credentials (Confidentiality) and make changes to file contents on the target server (Integrity), and they might be able to force a crash within the server (Availability),” Microsoft said in a Tuesday advisory.”
  • Per InfoSecurity Magazine,
    • “The phishing platform “Whisper 2FA” has rapidly become one of the most active tools used in large-scale credential theft campaigns, according to new research from Barracuda.
    • “Since July 2025, the platform has been responsible for nearly one million phishing attacks targeting accounts across multiple industries, placing it just behind Tycoon and EvilProxy in the global phishing-as-a-service (PhaaS) landscape.
    • “What makes Whisper 2FA stand out is its use of AJAX, a web technology that allows real-time communication between browser and server without page reloads. This enables the phishing kit to repeatedly capture credentials and multi-factor authentication (MFA) codes until it obtains a valid token. 
    • “Unlike typical phishing kits that stop after stealing a password, Whisper 2FA continuously loops through attempts, effectively bypassing MFA protections.
    • “Attackers have been using a range of lures to deliver Whisper 2FA, mimicking brands such as DocuSign, Adobe and Microsoft 365. These phishing emails often use urgent pretexts, such as invoices or voicemail notifications, to prompt users to log in and unknowingly submit their details to attackers.”

From the ransomware front,

  • Microsoft tells us,
    • “In 80% of the cyber incidents Microsoft’s security teams investigated last year, attackers sought to steal data—a trend driven more by financial gain than intelligence gathering. According to the latest Microsoft Digital Defense Report, written with our Chief Information Security Officer Igor Tsyganskiy, over half of cyberattacks with known motives were driven by extortion or ransomware. That’s at least 52% of incidents fueled by financial gain, while attacks focused solely on espionage made up just 4%. Nation-state threats remain a serious and persistent threat, but most of the immediate attacks organizations face today come from opportunistic criminals looking to make a profit.
    • “Every day, Microsoft processes more than 100 trillion signals, blocks approximately 4.5 million new malware attempts, analyzes 38 million identity risk detections, and screens 5 billion emails for malware and phishing. Advances in automation and readily available off-the-shelf tools have enabled cybercriminals—even those with limited technical expertise—to expand their operations significantly. The use of AI has further added to this trend with cybercriminals accelerating malware development and creating more realistic synthetic content, enhancing the efficiency of activities such as phishing and ransomware attacks. As a result, opportunistic malicious actors now target everyone—big or small—making cybercrime a universal, ever-present threat that spills into our daily lives.
    • “In this environment, organizational leaders must treat cybersecurity as a core strategic priority—not just an IT issue—and build resilience into their technology and operations from the ground up. In our sixth annual Microsoft Digital Defense Report, which covers trends from July 2024 through June 2025, we highlight that legacy security measures are no longer enough; we need modern defenses leveraging AI and strong collaboration across industries and governments to keep pace with the threat. For individuals, simple steps like using strong security tools—especially phishing-resistant multifactor authentication (MFA)—makes a big difference, as MFA can block over 99% of identity-based attacks.”
  • HIPAA Journal reports,
    • “Kettering Health has provided an update on its May 20, 2025, ransomware attack. The investigation confirmed that the Interlock ransomware group first gained access to its network on April 9, 2025, and retained access until May 20, 2025, when the attack was detected and the unauthorized access was blocked. During that time, the ransomware group accessed or copied files containing patient information.
    • “Kettering Health has been providing regular updates on its progress recovering from the attack and has now completed its file review. The review confirmed that current and former patients had the following information compromised in the attack: first and last name, contact information, date of birth, Social Security number, patient identification number, medical record number, medical information, treatment information, diagnosis information, health insurance information, driver’s license/state identification number, financial account information, and/or education records.
    • “Kettering Health said it has reviewed its policies, procedures, and processes related to data security and has taken steps to prevent similar incidents in the future. Kettering Health said it is unaware of any misuse of the exposed information and has provided patients with information on how they can protect themselves against identity theft and fraud. Complimentary credit monitoring and identity theft protection services do not appear to have been offered.”
  • The Record adds,
    • “Michigan City, Indiana, has confirmed that a damaging cyber incident three weeks ago that impacted government systems was a ransomware attack.  
    • “The Indiana city located on the south shore of Lake Michigan was forced to take many systems offline on September 23 and initially called it a “network disruption.” 
    • “On Saturday [October 11], the city acknowledged it was hit with a ransomware attack “that affected a portion of the City’s data and impacted municipal employees’ online and telephone access.” * * *
    • “On Monday, the Obscura ransomware gang took credit for the attack and said they stole 450 gigabytes of data. The group claimed that the time on their ransom had expired and  that they posted all of the data that was taken during the cyberattack. Obscura emerged last month and has since named more than 15 victims.”  
  • Dark Reading points out,
    • “Harvard University confirmed that it fell victim to an attack exploiting the recently disclosed zero-day vulnerability in Oracle’s E-Business Suite (EBS) system.
    • “The critical vulnerability, tracked as CVE-2025-61882, allows an attacker without authentication to remotely access EBS instances. The flaw has been exploited by the notorious Clop ransomware gang in attacks on Oracle customers.   
    • “Harvard is aware of reports that data associated with the University has been obtained as a result of a zero-day vulnerability in the Oracle E-Business Suite system,” the University told Dark Reading. “This issue has impacted many Oracle E-Business Suite customers and is not specific to Harvard. While the investigation is ongoing, we believe that this incident impacts a limited number of parties associated with a small administrative unit.”
  • and
    • “Microsoft disrupted a Rhysida ransomware campaign that used fake Teams binaries signed with digital certificates, including many from Microsoft’s own service. 
    • “In a social media post on X, Microsoft Threat Intelligence on Wednesday said it revoked more than 200 code-signing certificates issued by Azure’s Trusted Signing service. These certificates are sometimes abused by threat actors to make malware appear as if it is legitimate, trusted software.
    • “According to the post, a cybercriminal group tracked by Microsoft as Vanilla Tempest crafted the fake Teams files to drop a backdoor known as “Oyster,” which allowed attackers to eventually deliver Rhysida ransomware in victims’ networks.
    • “Vanilla Tempest, also known as Vice Society, has a track record of targeting healthcare organizations and public schools, though it’s unclear what organizations the group was targeting with its latest campaign.”
       
  • Wiz notes,
    • “Cloud ransomware targets data and systems in cloud environments by exploiting cloud-native features and APIs rather than just encrypting local files
    • “Attackers have evolved beyond simple encryption to use sophisticated tactics like data exfiltration, deletion, and manipulation of cloud services
    • “Common attack vectors include compromised credentials, misconfigured storage, overly permissive identities, and supply chain compromises
    • “Defending against cloud ransomware requires cloud-native detection and prevention strategies with deep visibility across your entire environment.”

From the cybersecurity defenses front,

  • Cybersecurity Dive reports,
    • “Fortune 500 companies have seen the structure of their security operations teams evolve in recent years, with four of every 10 companies assigning a dedicated, deputy chief information security officer or an equivalent leadership role, according to a report released Thursday from IANS Research and Artico Search. 
    • “A deputy CISO steps in when the CISO is unavailable and is seen as the eventual successor to the CISO in the company’s risk management hierarchy, according to researchers. 
    • “In practical terms, the deputy CISO often either holds a dual role as a functional department head who takes on additional executive leadership responsibility or operates as a chief of staff who also takes on CISO-like responsibilities that the CISO needs to delegate,” Nick Kakolowski, senior research director at IANS Research told Cybersecurity Dive via email.”
  • Beckers Hospital Review calls attention to six notes about health system efforts to sharpen their cybersecurity and margins narrow.
  • Dark Reading relates,
    • “Agentic AI deployments are becoming an imperative for organizations of all sizes looking to boost productivity and streamline processes, especially as major platforms like Microsoft and Salesforce build agents into their offerings. In the rush to deploy and use these helpers, it’s important that businesses understand that there’s a shared security responsibility between vendor and customer that will be critical to the success of any agentic AI project.
    • “The stakes in ignoring security are potentially high: last month for instance, AI security vendor Noma detailed how it discovered “ForcedLeak,” a critical severity vulnerability chain in Salesforce’s agentic AI offering Agentforce, which could have allowed a threat actor to exfiltrate sensitive CRM data from a customer with improper security controls through an indirect prompt injection attack. Although Salesforce addressed the issue through updates and access control recommendations, ForcedLeak is but one example of the potential for agents to leak sensitive data, either through improper access controls, ingested secrets, or a prompt injection attack.
    • “It’s not an easy task to add agentic AI security to the mix; it’s already challenging enough to determine where responsibility and culpability lie with traditional software and cloud deployments. With something like AI, where the technology can be hastily rolled out (by both vendor and customer alike) and is constantly evolving, establishing those barriers can prove even more complex.” 
       
  • TechRadar explains “how to plan a smooth Windows 10 to Windows 11 migration – even if you missed the October 14th [support] deadline.”
  • Here is a link to Dark Reading’s CISO Corner.

Thursday Report

David Ermer–CDC, CMS, Congress, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, Patient safety, U.S. Healthcare–

From Washington, DC,

  • The Wall Street Journal reports,
    • “Republicans and Democrats both see a likely path to ending the government shutdown, involving extending enhanced Affordable Care Act healthcare subsidies for a year or longer. But there are a series of reasons why no deal has emerged, even with costs set to surge for more than 20 million Americans.
    • “The shutdown is now entering its third full week, with no serious talks under way. The House passed its short-term bill to fund the government through Nov. 21 and has been out of town since. Democrats have repeatedly blocked the measure in the Senate, where Republicans have a 53-47 majority, but 60 votes are required to advance the legislation.”
  • Per a Senate news release,
    • “Today, U.S. Senators Bill Cassidy, M.D. (R-LA), chair of the Senate Health, Education, Labor, and Pensions (HELP) Committee, and John Hickenlooper (D-CO) introduced the 21st Century Dyslexia Act, legislation that incorporates the modern, scientific understanding of dyslexia into federal statute and prevents the harm unidentified dyslexia can inflict on young students.
    • “Despite dyslexia impacting one in five Americans, students are rarely tested,” said Dr. Cassidy. “This legislation brings a common-sense approach to dyslexia, ensuring students have the resources they need to reach their full potential.”
    • “Better early screening, more awareness, and modern tools will help make sure kids with dyslexia are diagnosed early. These resources are inexpensive and immensely valuable. I know – I lived it,” said Senator Hickenlooper.
    • “U.S. Representatives Erin Houchin (R-IN), Julia Brownley (D-CA), and Bruce Westerman (R-IN) introduced the companion legislation in the U.S. House of Representatives.” * * *
    • “Read the full bill text here.”
  • Tammy Flanagan, writing in Govexec, explains “what to know when your child ages out of federal health coverage. Children can stay on a parent’s FEHB or PSHB plan until 26, but understanding the 31-day extension, conversion options and Temporary Continuation of Coverage is key to avoiding gaps.” The FEHBlog’s advice is to move your adult child to their employer sponsored health plan which should be a snap.
  • FedWeek tells us,
    • “An inspector general report has cited some positives for USPS finances but also notes that its financial picture in recent years has benefitted from several special infusions of funding from Congress that it called “unique events.” * * *
    • “First Class mail volume “is not expected to return to levels previously seen in the early part of the 20th century,” it said, and “ultimately, future retirement obligations will need to be funded.”
    • “Eliminating the prefunding requirement temporarily alleviated the Postal Service’s financial burden but did not change the fact that once the [Postal Service Retiree Health Benefits Fund] runs out of funds, the Postal Service is responsible for funding its share of the healthcare premium costs for its retirees as the costs are incurred,” it said.”
  • Per a Labor Department news release,
    • “U.S. Secretary of Labor Lori Chavez-DeRemer today joined President Trump at the White House as the President announced the third most-favored-nation agreement, which will result in significant cost savings on fertility treatments. On the heels of the President’s announcement, the U.S. Department of Labor, joined by the Departments of Health and Human Services and Treasury, issued guidance designed to cut burdensome red tape, helping employers understand how to structure health benefits to expand access to fertility treatments like In Vitro Fertilization or IVF.” * * *
    • “Following the President’s announcement today, the Departments of Labor, Health and Human Services, and Treasury issued new guidance in line with the President’s Executive Order 14216, “Expanding Access to In Vitro Fertilization.” The guidance clarifies existing categories of excepted benefits that employers can use to offer fertility benefits, including fertility treatment through a specified disease or illness policy, or offering reimbursement for those services through an excepted benefits health reimbursement arrangement.
    • “The departments also intend to propose rulemaking aimed at providing additional ways that certain fertility benefits may be offered as a limited excepted benefit. The departments are also considering whether to modify the standards under which supplemental health insurance coverage provided by a group health plan, including a supplemental benefit for fertility coverage, will be considered to satisfy the conditions for being an excepted benefit.”
  • According to a Paragon Health Institute report,
    • “The Inflation Reduction Act caused Medicare Part D stand-alone prescription drug plan premiums to increase nearly 600 percent from 2023 to 2026.
    • “To disguise this premium spike, the Biden administration abused Medicare’s “demonstration” authority. Despite the Biden administration’s $5 billion bailout of the Inflation Reduction Act’s failed policies, the number of plans declined by over half from 2021 to 2025.
    • “The Trump administration has sensibly mitigated this abuse, phased down the bailout, and reduced distortions in the Medicare Part D program.”
  • The Postal Service Health Benefits Program relies heavily on stand-alone Medicare Part D prescription drug plan for benefit cost savings.

From the Food and Drug Administration front,

  • Per an HHS press release,
    • “The U.S. Food and Drug Administration today announced nine voucher recipients under the new Commissioner’s National Priority Voucher (CNPV) pilot program. Each recipient has a product with significant potential to address a major national priority, such as meeting a large unmet medical need, reducing downstream health care utilization, addressing a public health crisis, boosting domestic manufacturing, or increasing medication affordability with Most Favored Nation pricing.
    • “Voucher recipients will receive a decision within 1-2 months following filing of a complete application for a drug or biologic. In addition, sponsors will receive enhanced communications with review staff throughout the development process prior to their final submission and during the review period. If necessary, FDA scientists reserve the right to extend the review time if an application is incomplete, there are manufacturing violations, or as they otherwise deem appropriate.” * * *
    • “The following products were selected:
      • “Pergoveris for infertility
      • “Teplizumab for Type I diabetes
      • “Cytisinicline for nicotine vaping addiction
      • “DB-OTO for deafness
      • “Cenegermin-bkbj for blindness
      • “RMC-6236 for pancreatic cancer
      • “Bitopertin for porphyria
      • “Ketamine for domestic manufacturing of a critical drug for general anesthesia
      • “Augmentin XR for domestic manufacturing of a common antibiotic.”
  • Per MedPage Today,
    • “The FDA is warning about the potential for serious injuries with radiofrequency (RF) microneedling for skin procedures following reports of burns, scarring, disfigurement, and nerve damage.
    • “The agency said it is working with manufacturers of the class II medical devices with the hopes of identifying mitigation strategies. “While the FDA’s evaluation is ongoing, we are asking patients, caregivers, and healthcare providers to report any complications to the use of these devices for dermatologic or aesthetic skin procedures.”

From the public health and medical / Rx research front,

  • The University of Minnesota’s CIDRAP informs us,
    • “The first US case of locally acquired clade 1 mpox has been reported in Long Beach, California, according to city and state health authorities.
    • “The clade 1 case is the nation’s first in a person with no recent travel history and the seventh clade 1 case in the country. The patient required hospitalization and is now isolating and recovering at home, the City of Long Beach news release said.
    • “Public health officials are reviewing the patient’s potential source of exposure and conducting contact tracing. No other cases have been identified.
    • “While the overall risk of mpox clade I exposure to the public remains low, we are taking this very seriously and ensuring our community and health care partners remain vigilant so we can prevent any more cases,” Long Beach Mayor Rex Richardson said in the release. “This underscores the importance of continued surveillance, early response, and vaccination.”
  • The New York Times reports,
    • “A study, published in the journal JAMA Ophthalmology, analyzed the number of eye injuries that brought pickleball players to hospital emergency rooms from 2005 to 2024. Dr. Tsui and his colleagues extrapolated from a database of injuries that relies on a nationally representative sample of hospitals.” * * *
    • “While there were just over 3,100 pickleball-related eye injuries that brought players to emergency rooms between 2014 and 2024, over one-third of them — some 1,262 injuries — occurred in 2024 alone.
    • “Players 50 and older, who were more likely to sustain ocular injuries than younger players, accounted for 70 percent of all eye injuries. Age-related decreases in muscle mass, bone density and balance may have made them more vulnerable, the authors said.” * * *
    • “Eye protection is not required for professional or casual play, the authors of the study noted. USA Pickleball, the sport’s governing body in the United States, last year disapproved of a rule change that would require players to wear eye protection in its tournaments, saying it would be difficult to enforce.
    • “Pickleball clubs and courts also do not require eye protection. But the American Academy of Ophthalmology last year recommended players wear eyewear that meets the American Society for Testing and Materials F3164 guidelines, which are the standard for most racket sports.”
  • United Healthcare, writing in LinkedIn, ponders whether GLP-1 drugs are real-life wonder drugs.
    • “GLP-1 drug sales are up 500% since 2018, with growth accelerating as new uses emerge.
    • “Beyond diabetes and obesity, they show promise for Alzheimer’s, cancer and more.
    • ‘GLP-1 users also saw a 44% drop in hospitalizations from stroke, heart attack and heart failure.”
  • The Genetic Engineering and Biotechnology News relates,
    • “Although it well known that the human gut contains a large and diverse array of bacteriophages, a functional understanding of the phage–host interactions is limited. This is, in part, due to a lack of cultured isolates available. Now, a new study uncovers hundreds of new phages within our gut, information that could eventually reshape the gut microbiome, potentially influencing gut health and the progression of various disease states.
    • “Published in Nature in the paper, “Isolation, engineering and ecology of temperate phages from the human gut,” the study is the first of its kind and uses a large-scale, culture-based approach to isolate and study temperate bacteriophages in the human gut.
    • “This is a foundational study that changes how we think about and study the viruses within the human gut,” said Jeremy Barr, PhD, professor at the Monash University’s School of Biological Sciences. “We found that compounds produced in human gut cells can wake up dormant viruses inside gut bacteria. This could have major implications for gut diseases like inflammatory bowel disease (IBD), where inflammation and cell death are common.”
  • Per MedPage Today,
    • “There were 176.6 major congenital malformations (MCMs) per 10,000 infants exposed to first-trimester COVID-19 mRNA vaccines, compared with 179.4 per 10,000 infants not exposed to the vaccines.
    • “There were no associations between mRNA vaccine exposure and MCMs by organ system.
    • “There was no difference in the rate of stillbirths between pregnant women who received mRNA vaccines and those who didn’t (both 0.4%).”
  • Per BioPharma Dive,
    • “A regimen pairing Johnson & Johnson’s dual-pronged multiple myeloma drug Tecvayli with an older medication, Darzalex, staved off disease progression and death better than Darzalex and a standard drug combination in a Phase 3 trial, the company said Thursday.
    • “According to J&J, a panel of independent trial monitors recommended halting the study early after the Tecvayli regimen met its objectives at an early data check. Researchers have been following trial volunteers for an average of about three years.
    • “The trial assessed the Tecvayli combination in people whose multiple myeloma had progressed after one to three prior treatment lines. Tecvayli is currently available to patients who’ve previously received at least four lines of care. That clearance, awarded in 2022, was an “accelerated” approval, which requires confirmation from a trial that demonstrates a survival benefit.”
  • and
    • “Final results from a years-long study show that Novartis’ Fabhalta medicine can significantly slow the decline of kidney function in patients with IgA nephropathy, the Swiss drugmaker said Thursday.
    • “The trial, known as Applause-IgAN, compared twice-daily doses of Fabhalta with a placebo in patients with the rare kidney disease. After two years of treatment, researchers found that the patients on Fabhalta had significantly better results on a scale that measures how well kidneys filter waste from the blood.
    • “Fabhalta had already won accelerated approval from the Food and Drug Administration in 2024 based on initial data showing the drug could reduce protein in the urine of patients with the condition. With the final study results in hand, Novartis now plans to seek a full, traditional approval of the medicine for IgAN patients next year.”
  • and
    • “In March 2023, investors could buy a share of Praxis Precision Medicines for about the same price as a dollar-menu item at a fast-food restaurant. The Boston-based biotechnology company had just suffered a major setback with one of its experimental medicines, which failed a key study testing it as a treatment for a neurological disease that causes involuntary shaking.
    • “Praxis, as drug companies often do, found enough silver linings in the data to push its medicine forward. The company consulted with the Food and Drug Administration that summer and began enrolling two late-stage trials that fall. By February 2025, a group of independent experts were telling Praxis the first of those trials looked unlikely to succeed. It decided to continue anyway.
    • “That confidence appears to have paid off, as Praxis on Thursday disclosed that both of its studies met their main goals. The company now plans to submit an approval application to the FDA by early 2026. Its share value, which got buffed in late 2023 from a 1:15 stock split, more than tripled on the announcement, peaking at $200 Thursday afternoon.”

From the U.S. healthcare business front,

  • Beckers Hospital Review reports,
    • ‘New York City-based Montefiore Health System and Garnet Health have signed a letter of intent for Garnet to join the academic health system through a strategic affiliation. 
    • “Garnet Health, a three-hospital system headquartered in Middletown, N.Y., serves more than 500,000 residents across New York’s mid-Hudson and Catskills regions.
    • “The proposed transaction would expand Montefiore’s presence in the Hudson Valley and strengthen Garnet Health’s clinical services, specialty care offerings and long-term sustainability.
    • “Montefiore, which operates 10 hospitals and more than 200 outpatient sites, described the deal as a natural fit.”
  • and
    •  “Already-strained emergency departments are not only projected to experience more volume in the near future, but also more clinical cases requiring immediate attention, according to a Vizient Sg2 report published Oct. 15.
    • “Vizient, which works with hundreds of U.S. hospitals and other healthcare providers, estimates a 5% increase in ED visits between 2025 and 2035. Urgent visits are projected to remain stagnant while emergent cases — those requiring immediate action — are expected to rise 8% over the decade. 
    • “Over the past year, emergent visits increased 6% while urgent visits stabilized. Sixty-five percent of ED visits between the third quarter of 2024 and the second quarter of 2025 were emergent. 
    • “While urgent visits have stabilized, continued efforts to redirect low-acuity patients to alternative care sites remain essential to improving ED throughput and preserving capacity for higher-acuity cases,” the report said.”
  • and
    • “Physician compensation rose more in 2025 than in any year over the past decade, largely due to clinician supply and demand imbalances, according to a survey from SullivanCotter. 
    • “Published Oct. 15, the survey is based on data from more than 500 healthcare organizations representing approximately 231,300 physicians across 232 specialties. It found that median physician total cash compensation — base salary plus incentives — grew year over year across all major specialty categories.
    • “Among those, adult medical specialties saw the largest year-over-year increase at 7.5%, as physician workforce expectations continue to evolve.”
  • Modern Healthcare discusses why private equity wants in on outpatient cardiology.
    • “Private equity investors are training their attention on cardiology — a fast-growing specialty rife with financial opportunity. 
    • “Investor interest in outpatient cardiology practices has grown in recent years, driven by a fragmented market landscape facing financial pressures and an aging population of patients and providers. The Centers for Medicare and Medicaid Services also is reimbursing more cardiac procedures in ambulatory settings, which has been an impetus for private equity firms to make investments.
    • “The growing number of transactions and operational changes hasn’t quieted skepticism about whether the investments are a win for patients. There is limited post-acquisition data on quality, patient volumes and costs of care at individual cardiology practices. The data on private equity’s overall impact on the industry paints a bleak picture.
    • “Private equity is here in cardiology. It’s not going to go away,” said Dr. Samuel Jones, director of inpatient electrophysiology at the Chattanooga Heart Institute and member of the American College of Cardiology’s Board of Trustees.”
  • Healthcare Dive points out,
    • “Prospect Medical Holdings has tentative deals to sell two of its shuttered hospitals in Pennsylvania — Chester Medical Center and Springfield Hospital — for a combined $13 million, according to documents filed to bankruptcy court last week. 
    • “Chariot Allaire Partners has offered $10 million for Crozer-Chester Medical Center, while Restorative Health Foundation and Syan Investments together have offered $3 million for Springfield Hospital.
    • “Closing the deals would allow Prospect to finally rid its hands of failed Crozer Health, following years of conflict with state regulators over its management practices and failed sales attempts. Crozer fully shuttered this spring.”

From the artificial intelligence front,

  • Healthcare Dive lets us know,
    • “Google Cloud revealed several artificial intelligence partnerships with healthcare organizations on Thursday, including for projects that summarize clinical notes and automate prior authorizations. 
    • “The partnerships come as more healthcare and life science firms are deploying AI agents, or advanced tools that can more autonomously plan and perform tasks, according to a Google Cloud survey of 605 leaders released Thursday. Forty-four percent of executives said their organizations were actively using agents, with 34% reporting they use 10 or more agents.
    • “For example, Hackensack Meridian Health built multiple AI agents using Google’s generative AI technology, including a tool that can recap patients’ medical records for doctors.
    • “The health system’s note summarization agent has helped more than 1,200 clinicians generate more than 17,000 summaries since it went live in June, according to a press release.”
  • and
    • “Microsoft is expanding its artificial intelligence-backed clinical assistant to include functionality geared towards nurses, the technology giant said Thursday. 
    • “Dragon Copilot, Microsoft’s upgraded AI assistant tool launched this spring, will be able to record nurses’ interactions with patients and help document their care, as well as access medical content or health system protocols, the company said.
    • “Microsoft collaborated with multiple health systems to build the update focused on nurses’ documentation workflow. “Physicians document very differently,” said Mary Varghese Presti, corporate vice president and chief operating officer at Microsoft Health and Life Sciences. “What we built here for nurses is not a rinse and repeat of that.” 

Midweek report

David Ermer–CDC, CMS, Congress, FDA, Generative AI, Medical / Rx research, Rx coverage, U.S. Healthcare–

From Washington, DC

  • SHOCKER — STAT News reports,
    • “The Centers for Medicare and Medicaid Services [CMS)] is pausing Medicare payments to doctors, as negotiations tied to the government shutdown drag on. 
    • “CMS announced the pause in a notice on its website but didn’t say when it would end. It’s happening because Congress needs to reauthorize certain Medicare payment programs related to telehealth and rural providers, and that reauthorization has gotten wrapped up in the overall deal to reopen the government.
    • It’s not clear why all physician payments have been cut off rather than just the programs that need to be renewed. CMS did not immediately respond to a request for comment.
    • “An extended payment pause could eventually cause cash flow concerns for doctors, several groups representing providers told STAT — and there are fears that, in some cases, claims could be left unpaid, should the renewal of programs that have lapsed not be made retroactive. Payments for ground ambulance transport services and Federally Qualified Health Centers are also in limbo.
    • “The paused payments include those going back to Oct. 1, when the government shutdown started and several health care programs lapsed.” 
  • WHIPLASH (again from STAT News) — The Centers for Medicare and Medicaid Services said late last night that it was not pausing all Medicare payments to doctors, after a statement hours earlier had asserted that it would. Instead, the agency will only wait to process claims that are related to programs that have expired, such as some telehealth or rural services. 
  • Per the Senate press gallery,
    • “2:55 p.m. October 15 — By a vote of 51-44, the Senate did not invoke cloture on the motion to proceed to H.R. 5371, [the House passed continuing resolution] upon reconsideration.
    • “Democrats voting in favor: Cortez Masto and Fetterman.
    • “Independent voting in favor: King.
    • “Republican voting against: Paul.
    • “Senators not voting: Blackburn, Duckworth, Hagerty, Marshall and Tillis.”
  • Beckers Hospital Review offers four notes on the extension of the government shutdown into a third week.
  • Govexec adds,
    • “More than 150 lawmakers, led by Sens. Tim Kaine, D-Va., Chris Van Hollen, D-Md., and Lisa Murkowski, R-Alaska, on Wednesday demanded that the Trump administration guarantee that furloughed federal employees are granted backpay at the conclusion of the ongoing federal government shutdown, which has entered its third week.
    • “Last week, the Office of Management and Budget floated a theory that the 2019 Government Employees Fair Treatment Act, which automatically provides backpay to furloughed federal workers following appropriations lapses and was signed by President Trump during the 2018-2019 partial government shutdown, merely authorizes Congress to provide backpay after a shutdown. OMB revised its shutdown FAQ document to remove reference to the law’s guarantee, and the Internal Revenue Service revoked shutdown guidance to employees, issued just days prior, that made reference to backpay.” * * *
    • In their letter to [OMB Director Russell] Vought, the lawmakers insinuated that OMB’s stance may be more motivated by politics than a good-faith legal analysis and urged the White House to reaffirm furloughed workers’ right to backpay.
  • OPM has released a description of Federal Benefits Open Season Highlights 2026 Plan Year, which identifies the plans and plan options withdrawing from the FEHBP, the PSHBP and FEDVIP for the 2026 plan year. The as yet unreleased OPM benefit administration letter on program changes also identifies the plans with service area changes, for example.
  • The American Hospital Association News tells us,
    • “Medicare open enrollment for 2026 began Oct. 15 and runs through Dec. 7. During the annual enrollment period, Medicare-eligible individuals can check their status, choose plans or change plans during the open enrollment period, including switching from Medicare Advantage and prescription drug plans to Traditional Medicare. The Centers for Medicare & Medicaid Services projects the average monthly premium for MA plans will fall by $2.40 in 2026 to $14.00, while the average standalone monthly total premium for a Medicare Part D prescription drug plan will fall by $3.81 to $34.50. Among other changes this year, out-of-pocket costs for prescription drugs will be capped at $2,100.”
  • CMS reminds us,
    • “Medicare’s Open Enrollment Period is here! Visit Medicare.gov/plan-compare now through December 7 to compare all your coverage options. 
    • “Even if you’re happy with your current plan, it’s important to check for any changes next year. You can also check the star ratings to compare the quality of different health and drug plans.”
  • The Wall Street Journal alerts us that “Big changes Are coming for 2026 Medicare Plans. What You Need to Know. Skinnier benefits, higher premiums and fewer options mean more than a million seniors should shop for new coverage during open enrollment.”
  • Healthcare Dive reports,
    • “CMS Administrator Dr. Mehmet Oz highlighted areas where Medicare Advantage could improve — while reaffirming his support for the privatized Medicare program — during an event organized by the top MA lobby on Wednesday.
    • “Oz’s comments reflect the difficult tightrope regulators in the Trump administration walk as they pursue MA reform, especially in the areas of improper overpayments and prior authorizations, without offending the powerful insurance industry.
    • “I came both to celebrate what you’re trying to do, but also be honest about some of the issues that we’re seeing at CMS,” Oz said during the Better Medicare Alliance’s forum in Washington, D.C. “The opportunities we have if we do this correctly are massive. I see Medicare Advantage as this essential lever arm, this tool that we can use for good — and sometimes not — but if we use it correctly and nimbly, we can do all kinds of things to refine and improve the system.”
  • Medscape notes,
    • “Enrollment in Medicare Advantage was associated with an increased likelihood of receiving an Annual Wellness Visit, especially among racial and ethnic minorities, those with dual eligibility, and those with Alzheimer’s disease and related dementias.”
  • Per Fierce Healthcare,
    • “Fifteen governors unveiled Wednesday a new coalition to coordinate public health efforts in the latest sign of distrust in federal health agencies.
    • “The so-called Governors Public Health Alliance is now the largest alternative public health authority run by states, with leaders representing 129 million Americans, and follows the three-state West Coast Health Alliance and the 10-state Northeast Public Health Collaborative. The new effort is described as complementary to the states’ existing public health mechanisms and in line with the two existing coalitions.
    • “Announcements from several of the governors describe the effort as nonpartisan, though all the current participating leaders are Democrats. The alliance itself is supported by GovAct, a nonprofit and nonpartisan platform for gubernatorial collaborations.
    • “Similar to other states’ efforts, the governors said their new alliance will share best practices and expertise, coordinate on disease surveillance, co-draft public health guidelines and purchase supplies such as vaccines. It will also keep an open dialogue with the global health community while “elevating national considerations for vaccine procurement, policy solutions and more,” according to announcements.”

From the judicial front,

  • The Wall Street Journal relates,
    • “A federal judge temporarily blocked the Trump administration from moving ahead with mass firings of federal employees while the government is shut down. 
    • “Judge Susan Illston issued the temporary restraining order in a ruling from the bench on Wednesday, stopping the government from cutting federal workers at multiple agencies. 
    • “The court record suggested that the Trump administration has “taken advantage of the lapse in government spending and government functioning to assume that all bets are off, that the laws don’t apply to them anymore and that they can impose the structures that they like on the government situation that they don’t like,” said Illston, a Bill Clinton appointee. 
    • “The Trump administration moved ahead on threats last week to lay off federal workers, sending reductions in force notices, otherwise known as RIFs, to about 4,000 employees at more than a half-dozen federal agencies, including the departments of Treasury, Health and Human Services, Education and Commerce.”
  • Healthcare Dive informs us,
    • “A federal judge has thrown out a last-ditch effort from Humana to get the government to recalculate its Medicare Advantage star ratings for 2025.
    • “On Tuesday, Judge Reed O’Connor of the Texas Northern District Court ruled that the CMS acted legally in downgrading Humana’s stars based on unsuccessful customer service calls.
    • “O’Connor dismissed the case with prejudice, meaning it can’t be refiled but could still be appealed. A spokesperson for Humana said the company is “disappointed” with the ruling and is considering “all available legal options.”
  • Sequoia explains how to navigate the legal landscape of gender-affirming care in employer health plans.

From the public health and medical / Rx research front,

  • The University of Minnesota’s CIDRAP points out,
    • “A new update from the South Carolina Department of Health (SCDH) says the state’s measles outbreak has grown by 5 cases, to 16 infections since July, including 12 cases that are part of an Upstate outbreak that has seen two schools send hundreds of unvaccinated kids home after exposure to the highly contagious virus.
    • “The cases come as the US total climbs to 1,596 confirmed infections.”
  • Medscape discusses a new COVID variant known as Frankenstein.
    • “According to the World Health Organization (WHO), this rise is associated with the emergence of a new SARS-CoV-2 variant, XFG, also referred to as “Frankenstein,” because it is a recombinant of two other variants, LF.7 and LP.8.1.2.
    • “XFG has been classified by the WHO as a variant under monitoring since 25 June 2025 and is growing globally. Current evidence suggests that the additional public health risk is low worldwide, and approved COVID vaccines are expected to remain effective against this variant to prevent symptomatic and severe disease.”
  • The Washington Post lets us know,
    • “Health officials in New York state confirmed the first locally acquired case of chikungunya in the United States in six years. The virus is rarely fatal, and most patients recover in a week, but in some cases, it can cause prolonged and debilitating joint pain.
    • “It is also the first locally acquired case of chikungunya in New York, the state’s health department said. A resident of Nassau County, who was not named, had not reported any foreign travel before experiencing symptoms in early August, the county’s health department said. County officials said on Tuesday they had not found chikungunya in local mosquitoes, adding: “There is no evidence of ongoing transmission of the virus and the risk to the general public remains low.”
  • Per Healio,
    • “Alcohol-induced deaths increased by 89% from 1999 to 2024, peaking in 2021.
    • “These deaths rose by 255% among women aged 25 to 34 years and by 188% among men aged 25 to 34 years.”
  • and
    • “Mean BMI increased for premenopausal women and postmenopausal women in the U.S. from 1999 to 2018.
    • “The 50th percentile BMI for premenopausal and postmenopausal women peaked at about age 60 years.”
  • Per Medscape,
    • “Egg- and non-egg-based influenza vaccines showed equivalent protection against laboratory-confirmed influenza‑like illness and related hospitalizations among healthy adults in the military health system. However, recombinant influenza vaccine achieved higher seroconversion rates across all influenza subtypes.”
  • and
    • “Penicillin V was as effective as amoxicillin for treating pneumonia in primary care, with similar rates of hospitalization for lower respiratory tract infection or all-cause mortality within 28 days of starting antibiotic therapy, making it a viable alternative in primary care settings with similar resistance patterns.”
  • Per Fierce Pharma,
    • “GSK’s ViiV Healthcare and its bimonthly pre-exposure prophylaxis (PrEP) medicine Apretude had to make room for another long-acting PrEP option this summer, when rival Gilead Sciences rolled out Yeztugo to much fanfare.
    • “But despite Yeztugo’s twice-yearly convenience factor, unprecedented efficacy performance in trials and award-winning pedigree, GSK has long maintained that one aspect of the rival drug’s clinical profile would block it from snatching the entire long-acting PrEP market.
    • “Now, armed with a new open-label crossover study, the company can back up its theory that the injection-site reactions from Gilead’s drug may give some potential users pause.
  • Per BioPharma Dive,
    • “Eli Lilly released the results of two new Phase 3 trials of an experimental GLP-1 pill that the company says could become a “foundational treatment” for type 2 diabetes.
    • “The medicine, orforglipron, succeeded on all primary and key secondary endpoints in the studies of diabetes patients, Lilly said Wednesday. One trial, Achieve-2, compared orforglipron with dapagliflozin, sold by AstraZeneca as Farxiga. The other, Achieve-5, tested orforglipron against a placebo in patients also taking insulin.
    • “The Indianapolis-based drugmaker plans to submit global regulatory applications for orforglipron in the treatment of type 2 diabetes next year. The company said it will seek approval of the drug as an obesity medication by the end of 2025.”
  • Beckers Hospital Review identifies “six new drug shortages and discontinuations, according to drug supply databases from the FDA and American Society of Health-System Pharmacists.”

From the U.S. healthcare business front,

  • Modern Healthcare reports,
    • “CommonSpirit Health and the University of Pittsburgh Medical Center have signed a non-binding letter of intent to integrate Steubenville, Ohio-based Trinity Health System into UPMC. 
    • “CommonSpirit and Trinity Health leaders began a search earlier this year to find a regional health system that would add to Trinity’s offerings, according to a Wednesday news release.
    • “The health systems will work toward a definitive agreement over the next several months.” 
       
  • Healthcare Dive informs us,
    • “CVS has completed a deal to buy 63 Rite Aid and Bartell Drugs stores in Idaho, Oregon and Washington. As part of the deal, which comes five months after Rite Aid filed for bankruptcy, CVS will also acquire the customer prescription files of 626 locations across 15 states.
    • “The agreement was first announced in May, though CVS at that time planned to acquire 64 locations and 625 prescription files. The transfer of assets was approved by a bankruptcy judge later that month.
    • “CVS is also bringing on more than 3,500 employees from the defunct chain and has made “targeted investments” in existing CVS locations to meet the needs of new shoppers. That includes adding more support and improving training programs for associates.”
  • The New York Times reports,
    • “For years, Democrats and Republicans have sounded the alarm about America’s dependence on China for medicines. An analysispublished on Wednesday shows just how deep that reliance is at the earliest stage of the drug manufacturing process: Nearly 700 U.S. medicines use at least one chemical solely sourced from China.
    • “As tensions between Washington and Beijing have escalated in recent years, experts fear that this reliance could leave American patients vulnerable, especially if a trade war or future pandemic prompts China to curtail exports. Supply shortages for some generic medicines have already grown common.
    • “The new data, from U.S. Pharmacopeia, a nonprofit that tracks the drug supply, identified the origins of chemicals used to make medicines. The analysis found that China was the sole supplier of at least one chemical in widely used antibiotics, like amoxicillin, and generic drugs for heart problems, seizures, cancer and H.I.V.
    • “One example is the allergy-relief medicine best known by the brand name Benadryl. (Kenvue, the company that sells Benadryl, did not return a request for comment.)
    • “There is almost no production of these chemicals in the United States because making them is dirty and labor and other costs make manufacturing them unprofitable. Chinese factories, by contrast, don’t face the same environmental restrictions and can make these raw materials inexpensively.”
  • Fierce Healthcare notes,
    • “Blue Cross Blue Shield Global Solutions is teaming with Carrot to offer family planning and fertility services to expatriate members across the world.
    • “BCBS Global Solutions, jointly owned by 15 Blue Cross plans and Bupa Global, will connect members globally with Carrot’s array of hormonal and family planning care, ranging from fertility, pregnancy, postpartum, surrogacy, adoption, menopause and low testosterone management. The organization shared the announcement exclusively with Fierce Healthcare.
    • “Through Carrot’s platform, members can access a network of more than 17,000 vetted providers worldwide, plus services that are available in more than 25 languages or through live translation across 300 languages.
    • “Following our recent rebrand, this partnership with Carrot marks another step forward in our commitment to deliver innovative global healthcare solutions,” said Simon Jackson, Chief Growth Officer of BCBS Global Solutions, in the announcement.”
  • Per Fierce Pharma,
    • “With sales of potential blockbuster Lokelma scaling up, AstraZeneca is bolstering its production of the hyperkalemia treatment with a $445 million injection of funds.
    • “The investment will increase the capabilities of AZ’s manufacturing facility in Coppell, Texas, which is the company’s lone site in the world that produces Lokelma.
    • ‘AZ will build a new 9,000-square-foot building at the complex and add two production lines, doubling its capacity to manufacture the treatment. The investment also will support upgrades for drug substance production and lab testing, as well as additional warehouse and administrative space, the company said in an Oct. 15 release.”

From the artificial intelligence front,

  • Fierce Healthcare offers a look inside Elevance Health’s AI strategy.
    • “The pace of digital innovation in healthcare is rapidly accelerating, and, for the team at Elevance Health, a simple mantra remains at the heart of its efforts: Keep the member at the center.
    • “Ratnakar Lavu, executive vice president and chief digital information officer at Elevance, told Fierce Healthcare in an interview that the perspective is born from his experience in consumer industries like retail, where many patients form their expectations for digital experiences.
    • “Digital platforms can make things simpler and more personalized for members, he said, but there’s also a risk of deploying new tech just for the sake of it.
    • “My obsession always has been, let’s focus on the consumer, the member, and in our case, the patient, and keep them at the center of how we think about overall transformation,” he said. “Because it’s not technology for the sake of technology, it is really trying to focus on the experiences that we want to bring to life.”
  • STAT News reports,
    • “Lyra launches ‘clinical grade’ chatbot amid growing concern about mental health and AI
    • The company is the largest to launch a generative AI product as a part of ongoing therapy treatment.”
  • and
    • “As more nurses deliver primary care, an AI startup wants to guide their decisions and training> Altitude has raised $5.4 million to develop its platform and expand customer base.
  • MedTech Dive shares “five AI takeaways from AdvaMed’s conference. Medical device firms discussed privacy, regulations and prioritizing projects as AI becomes more prevalent in the industry.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front.

  • Cyberscoop tells us,
    • “A top Senate Democrat introduced legislation Thursday to extend and rename an expired information-sharing law, and make it retroactive to cover the lapse that began Oct. 1.
    • “Michigan Sen. Gary Peters, the ranking member of the Homeland Security and Governmental Affairs Committee, introduced the Protecting America from Cyber Threats (PACT) Act, to replace the expired Cybersecurity and Information Sharing Act of 2015 (CISA 2015) that has provided liability protections for organizations that share cyber threat data with each other and the federal government. Industry groups and cyber professionals have called those protections vital, sometimes describing the 2015 law as the most successful cyber legislation ever passed.
    • “The 2015 law shares an acronym with the Cybersecurity and Infrastructure Security Agency, which some Republicans — including the chairman of Peters’ panel, Rand Paul of Kentucky — have accused of engaging in social media censorship. As CISA 2015 has lapsed and Peters has tried to renew it, “some people think that’s a reauthorization of the agency,” Peters told reporters Thursday in explaining the new bill name.” * * *
    • “Michael Daniel, leader of the Cyber Threat Alliance made up of cybersecurity companies, told CyberScoop that his organization hasn’t been affected by the lapse yet, but that’s partially because it’s an organization that was set up with the long term in mind, with a formalized structure that included information-sharing requirements for members.
    • “The lapse might also not immediately affect other organizations, he said, comparing it to the risks of the government shutdown underway.
    • “An hour-long lapse doesn’t really do very much, but the longer it goes on, the more you have time for organizations to say, ‘Well, maybe we need to reconsider what we’re doing, maybe we need to think about it differently,’” Daniel said. “The longer it goes on, you start having questions about, ‘Maybe this thing won’t get reauthorized down the road.’ And once you start questioning the long-term prospects, that’s when people start making changes in their behavior.”
  • The American Hospital Association News (“AHA”) informs us,
    • “The Health Sector Coordinating Council Oct. 7 released its Sector Mapping and Risk Toolkit, created to help health care providers and other organizations visualize key services that support essential health care workflows and determine which of them present critical risk of cyberattack disruption capable of impacting care delivery, operations and liquidity. The toolkit consists of 17 health care workflow maps and usage guidelines and encourages organizations to prioritize their risks, mitigate them where possible and develop recovery and continuity plans that cannot be controlled or mitigated.
    • “The SMART initiative was created in April 2024 as a response to the cyberattack on Change Healthcare two months earlier. The AHA contributed the development of this project, which has helped identify these systemically important, mission-critical services for health care.”
  • AHA President and CEO Rick Pollack writes in the AHA News about his thoughts on this Cybersecurity Awareness Month.
    • “This week, the FBI issued an urgent warning to all users — including hospitals — of a critical security soft spot within Oracle’s E-Business Suite, stating “This is ‘stop-what-you’re-doing and patch immediately vulnerability.’”
    • “The vulnerability has allowed cyber bad actors to carry out data theft ransomware attacks. Oracle is offering a patch to address the security problem.
    • “This latest threat reminds us that cybercrime is ever-present, and health care has been the No. 1 target for years. Hospitals and health systems are committed to taking every possible precaution to protect system operability and patients’ personal data, and the good news is their defenses block most attacks.
    • “But no individual hospital can defend against all of these very sophisticated criminal and nation-state sponsored attacks. That’s why we need a whole-of-government approach to preventing and mitigating cyberattacks, including the federal government going after the bad guys as it has effectively done in counterterrorism.
    • “As we observe Cybersecurity Awareness Month this October, we must remain aware that the scope, frequency and sophistication of cyber incursions into health care have increased steadily. The evolving tactics used by bad actors to steal information, encrypt systems, delay and disrupt patient care, and shut down vital systems continue to put patient care and safety at risk.”
  • Dark Reading adds,
    • “Last night [October 9, 2025], the FBI, in coordination with law enforcement in France, seized the latest version of the BreachForums’ underground forum domain, which was converted earlier this month into an extortion site used by Scattered Lapsus$ Hunters, the gang behind the recent high-profile spate of Salesforce data heists.
    • “Scattered Lapsus$ Hunters is an apparent combination of the Scattered Spider, Lapsus$, and ShinyHunters cybercriminal groups that first emerged this past summer. It has been busy compromising Salesforce data and claims that Salesforce victims have up until midnight Eastern Time today, Oct. 10, to meet its ransom demands before it will start publishing the stolen records. 
    • “Despite the BreachForums site being taken down, the group’s Tor Dark Web site is still accessible, and will be used to leak the data, the threat actors claimed.
    • “Aside from Salesforce data, Scattered Lapsus$ Hunters claims to have 1 billion records and 39 victim organizations listed on the site with sample data, such as Chanel, Disney and Hulu, Marriot, Google, Toyota, FedEx, and many more.
    • “For its part, Salesforce has issued its own statement, acknowledging the extortion attempts and reiterating that there is no indication that the Salesforce platform itself had been compromised.”

From the cybersecurity vulnerabilities and breaches front,

  • Cyberscoop reports,
    • “A brute-force attack exposed firewall configuration files of every SonicWall customer who used the company’s cloud backup service, the besieged vendor said Wednesday.
    • “An investigation aided by Mandiant confirmed the totality of compromise that occurred when unidentified attackers hit a customer-facing system of SonicWall controls. The company previously said less than 5% of its firewall install base stored backup firewall configuration files in the cloud-based service.
    • “SonicWall did not answer questions about the extent to which the investigation revealed a more widespread impact for its customers, or if its assessment of that 5% figure remained accurate. The company initially revised its disclosure to clarify the scope of exposure was less than 5% of firewalls as of Sept. 17 but has since removed that detail from the blog post. 
    • “The investigation confirmed that an unauthorized party accessed firewall configuration backup files for all customers who have used SonicWall’s cloud backup service,” the company said in a statement.” * * *
    • “Fourteen defects affecting the vendor’s products have been added to the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities (KEV) catalog since late 2021. Nine of those defects are known to be used in ransomware campaigns, according to CISA, including a wave of about 40 Akira ransomware attacks between mid-July and early August.
    • “While those attacks were linked to exploited vulnerabilities in SonicWall devices, the latest attack marked a direct hit on SonicWall’s internal infrastructure and practices.”
  • Security Week tells us,
    • Law firm Williams & Connolly said state-sponsored hackers breached some of its systems and gained access to attorney email accounts.
    • “The prominent Washington, DC-based law firm is known for representing political figures and government officials, including Barack Obama and the Clintons, as well as major companies such as Intel, Samsung, Google, Disney, and Bank of America. 
    • “According to a statement issued by the company, an investigation conducted with the assistance of CrowdStrike showed that the hackers exploited an unspecified zero-day vulnerability to gain access to a “small number” of attorneys’ email accounts. 
    • “The probe showed that the attack was likely the work of a state-sponsored hacker group known to have recently targeted law firms and other companies. 
    • “Williams & Connolly said there was no evidence that confidential client data was stolen or that other parts of its IT system had been compromised. 
    • “While the company’s statement does not mention China, The New York Times learned that Chinese hackers targeted Williams & Connolly, along with other law firms.”
  • The Cybersecurity and Infrastructure Security Agency (CISA) added nine known exploited vulnerabilities to its catalog this week.
  • Per Bleeping Computer,
    • “Threat actors are exploiting a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and Triofox products, which allows a local attacker to access system files without authentication.
    • “At least three companies have been targeted so far. Although a patch is not yet available, customers can apply mitigations.
    • “CentreStack and Triofox are Gladinet’s business solutions for file sharing and remote access that allow using a company’s own storage as a cloud. According to the vendor, CentreStack “is used by thousands of businesses from over 49 countries.”
  • Cardiovascular Business relates,
    • “The U.S. Food and Drug Administration (FDA) has announced another new recall for Johnson & Johnson MedTech’s Automated Impella Controller (AIC) due to a significant cybersecurity risk. 
    • “If the identified cybersecurity vulnerabilities are exploited, it may affect the essential performance of the AIC,” according to the FDA’s advisory.
    • “At this time, no cyberattacks have been tied to this specific issue. This is the fourth time in three months the FDA has shared serious safety concerns related to these devices, which serve as the primary user control interface for Impella catheters.” 
  • Per Cybersecurity Dive,
    • “AI isn’t yet transforming how hackers launch phishing attacks, although it is helping them clean up their lures, the security firm Intel 471 said in a report published on Wednesday.
    • “Several factors have combined to keep AI in an evolutionary rather than revolutionary role, the report found.
    • “Still, business and government leaders need to pay attention to several increasingly common AI-assisted attack strategies.”

From the ransomware front,

  • Sophos shares its 2025 report on the state of ransomware in healthcare.
    • “Sophos’ latest annual study explores the real-world ransomware experiences of 292 healthcare providers hit by ransomware in the past year. The report examines how the causes and consequences of these attacks have evolved over time. This year’s edition also sheds new light on previously unexplored areas, including the organizational factors that left providers exposed and the human toll ransomware takes on retail IT and cybersecurity teams.”
  • TRM Labs point out “Nine Emerging Groups Shaping the Ransomware Landscape.”
    • “Artificial intelligence (AI) has lowered the barrier to entry for cybercriminals, allowing ransomware threat actors to automate coding, generate polymorphic malware — which alters its code with each infection to evade detection — and create more convincing social engineering lures. As a result, new groups are emerging rapidly, and established groups are scaling their operations. 
    • “In this post, we take a closer look at nine emerging ransomware groups and examine how their off-chain and on-chain tactics are reshaping the ecosystem.”
  • The Hacker News relates,
    • “Three prominent ransomware groups DragonForce, LockBit, and Qilin have announced a new strategic ransomware alliance, once underscoring continued shifts in the cyber threat landscape.
    • “The coalition is seen as an attempt on the part of the financially motivated threat actors to conduct more effective ransomware attacks, ReliaQuest said in a report shared with The Hacker News.
    • “Announced shortly after LockBit’s return, the collaboration is expected to facilitate the sharing of techniques, resources, and infrastructure, strengthening each group’s operational capabilities,” the company noted in its ransomware report for Q3 2025.
    • “This alliance could help restore LockBit’s reputation among affiliates following last year’s takedown, potentially triggering a surge in attacks on critical infrastructure and expanding the threat to sectors previously considered low risk.”
  • Per Cyberscoop,
    • “Microsoft Threat Intelligence said a cybercriminal group it tracks as Storm-1175 has exploited a maximum-severity vulnerability in GoAnywhere MFT to initiate multi-stage attacks including ransomware. Researchers observed the malicious activity Sept. 11, Microsoft said in a blog post Monday.
    • “Microsoft’s research adds another substantive chunk of evidence to a growing collection of intelligence confirming the defect in Fortra’s file-transfer service was exploited as a zero-day before the company disclosed and patched CVE-2025-10035 on Sept. 18.
    • ‘Despite this mounting pile of evidence, Fortra has yet to confirm the vulnerability is under active exploitation. The company has not answered questions or provided additional information since it updated its security advisory Sept. 18 to include indicators of compromise. 
    • “Storm-1175, a financially motivated cybercrime group known for exploiting public vulnerabilities to gain access and deploy Medusa ransomware, exploited CVE-2025-10035 to achieve remote code execution, according to Microsoft.”
  • Per Dark Reading,
    • “A China-based threat group known as Storm-2603 has added a new weapon to its hacking arsenal.
    • “Cisco Talos researchers observed Storm-2603 abusing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, in a recent ransomware attack. The open-source project, which was acquired by Rapid7 in 2021, was designed by security researcher Michael Cohen to assist incident response teams with endpoint monitoring and investigations. However, it seems attackers have turned the tables on defenders and are now leveraging Velociraptor to conceal their malicious activity.”
    • “Storm-2603 initially burst on to the threat landscape in July as one of several threat groups exploiting a set of SharePoint vulnerabilities in an attack chain known as “ToolShell.” There, the threat actors gained access to SharePoint servers, moved laterally in the victims’ networks, and deployed Warlock ransomware. In a blog post published Thursday, Cisco Talos researchers said they responded to a different incident in August, in which threat actors dropped three different types of ransomware on the victim’s VMware ESXi servers — Warlock, LockBit, and Babuk — and caused severe disruption to the organization.
    • “In addition to the ransomware trio, Cisco Talos found Storm-2603 actors had also deployed Velociraptor to aid their attack. It was a shift in strategy; the researchers noted that the tool had not been definitively tied to ransomware attacks prior to August.”
  • and
    • “Chaos ransomware has gotten a significant facelift with an “aggressive” new variant that adds destructive tactics and clipboard hijacking for cryptocurrency theft, as well as other capabilities to bolster its operations for speed and effectiveness.
    • “Researchers from FortiGuard Labs have identified a new version of Chaos ransomware written in C++, the first not written in .NET, they revealed in a report published Wednesday. This evolution also introduces a host of new features that make the ransomware harder to disrupt once it’s in execution, as well as more destructive than previous versions.
    • “This evolution underscores Chaos’s shift toward more aggressive methods, amplifying both its operational impact and the financial risk it poses to victims,” FortiGuard researcher Yen-Ting Lee wrote in the report.”

From the cybersecurity defenses front,

  • Cybersecurity Dive reports,
    • “Managing cyber risk has become a point of emphasis in the insurance and asset management sector, with companies boosting annual expenditures and increasing oversight at the board level, according to a report released Wednesday by Moody’s.
    • “Almost seven of every 10 companies have a chief information security officer overseeing corporate cyber risk, while another 10% of companies have a chief information officer overseeing cybersecurity. 
    • “More than 95% of organizations have their CISOs provide briefings directly to the chief executive officer at least on a semiannual basis. This compared with 88% using that practice in 2023.
    • “In addition, seven of 10 companies have their CISO brief the corporate board of directors, at least on a semiannual basis. This compares with 54% in 2023. Four of every 10 companies link CEO compensation to the company’s cybersecurity performance, a sharp increase from just 24% in 2023.” 
  • The Wall Street Journal adds,
    • “Security chiefs are emerging as sought-after advisers as companies plunge headlong into artificial intelligence.
    • “Although the rising threat of cyberattacks has elevated the role of chief information security officers in recent years, some say they are appearing more frequently before their boards and senior executives to help unpack the risks associated with AI.
    • “Often jokingly referred to as the “Department of No” inside companies, security staff are now being actively consulted on AI implementations. This includes explaining risks to management and collaborating with other parts of the business that haven’t typically worked closely with cybersecurity.
    • “Security was always thought of as the boat anchor; what I want is to be the boat motor,” said Pablo De La Rosa, vice president of information security at electric vehicle infrastructure specialist Vontier.”
  • Dark Reading discusses the cyber-risks associated with AI note takers. “Transcription applications are joining your online meetings. Here’s how to create policies for ensuring compliance and security of your information.”
  • Security Week notes,
    • “Google has several projects focusing on the use of AI for the discovery of vulnerabilities in software. The tech giant recently reported that its Big Sleep agent discovered a critical SQLite vulnerability and thwarted efforts to exploit it in the wild.
    • “Its latest product is CodeMender, an AI agent that not only finds security holes but also patches them. The company argues that such tools are needed because as AI gets better at discovering flaws, it will be difficult for humans to keep up with patching.” 
  • Here is a link to Dark Reading’s CISO Corner.

Tuesday report

David Ermer–CDC, CMS, COVID-19 vaccine, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, No Surprises Act, Obesity, OPM, Telehealth, U.S. Healthcare–

From Washington, DC,

  • Federal News Network tells us,
    • “The guarantee of back pay for furloughed federal employees is now in limbo, as the White House weighs a different interpretation of the 2019 law that ensures federal employees get compensated following a government shutdown.
    • “A new draft legal opinion from the Office of Management and Budget, as first reported by Axios, argues that whatever funding legislation Congress ultimately passes to end the current shutdown must explicitly include appropriations to provide back pay for furloughed federal employees. And if it’s not expressly written in the spending legislation, the OMB memo argues that furloughed workers cannot receive any retroactive compensation.
    • “A copy of the OMB document, which a senior White House official shared with Federal News Network, appears to contradict OMB’s previous interpretation of the Government Employee Fair Treatment Act, or GEFTA, which President Donald Trump signed into law in 2019 during the last government shutdown. Both OMB and the Office of Personnel Management previously affirmed that under GEFTA, excepted and furloughed employees would be given back pay as soon as possible, once any current or future shutdown ends.”
  • In the FEHBlog’s opinion, this draft OMB opinion is a lead balloon.
  • Healthcare Dive shares six takeaways from CMS Administrator Mehmet Oz’s appearance on Monday before a Washington D.C. think tank audience.
  • Modern Healthcare reports,
    • “Federal regulators say they have made inroads into speeding up the process to resolve out-of-network billing disputes. It’s not enough for frustrated providers and health insurance companies.
    • “The No Surprises Act’s Independent Dispute Resolution, or IDR, process has been a punching bag for both camps since it launched in 2022, and a backlog of cases had piled up by the beginning of this year.
    • “But the share of IDR cases unsettled after 30 business days fell from 69% in January to 34% in July, the most recent month for which data are available, according to the Health and Human Services, Labor and Treasury departments. Likewise, 96.5% of disputes submitted since 2022 are either resolved or are less than 30 business days old, the departments wrote in a notice published Sept. 19.
    • “The departments’ efforts have delivered remarkable improvements in the throughput of cases compared to prior years,” the notice says. “IDR entities are now resolving disputes faster than they are submitted.”
  • STAT News informs us,
    • “The agreement between Pfizer and the Trump administration to lower drug prices has sent other companies scrambling to make a deal.
    • “Several major pharmaceutical firms that received letters from President Trump demanding lower prices have been hustling to show progress, with some hoping to announce a deal with the White House as soon as this week, according to five Washington representatives and lobbyists for the companies, granted anonymity to speak about private deliberations.”
    • “They have to now,” said one lobbyist of their clients’ thinking, noting the “anger”with Pfizer for effectively adding to their pressure to come to an agreement with the administration.
    • “The people cautioned that negotiations remain unfinished and several variables, including the government shutdown, could delay any announcements.
    • “The growing chatter around potential announcements signals the Trump administration’s pressure campaign may be paying off. But whether the deals will actually accomplish the administration’s objective — lowering prescription drug prices — remains unknown.”
  • Fierce Healthcare points out,
    • “The current state of the Medicare Part D market is a mixed bag, with premiums declining but many payers scaling back options, according to a new analysis from KFF.
    • “The report noted that the Centers for Medicare & Medicaid Services put an emphasis on “stability” in Part D when it announced premium estimates in late September, but KFF found that the total number of stand-alone Part D plans available will decrease in 2026, marking the third straight year of shrinking plan options.
    • “Some payers are trimming down their offerings, per the report. For example, Centene is ending three drug plans offered through WellCare and Health Care Service Corporation is discontinuing one of Cigna’s three Part D plans and pulling back from certain regions.
    • “Other insurers, such as Elevance Health, are exiting the stand-alone Part D plan market entirely.
    • “For 2026, beneficiaries in each state will be able to select from between eight and 12 stand-alone Part D plans, in addition to Medicare Advantage prescription drug coverage. Across the 34 Part D plan markets, a total of 360 plans will be made available by 17 parent organizations—a decrease of 22% from 2025.”
  • “As many major insurers scale back on Medicare Advantage,” Beckers Payer Issues takes a “look at the insurers that are fully backing out.”
  • NextGov/FCW explains how OPM Director Scott Kupor plans “to attract tech talent [to federal government employment] after months of workforce cuts.”
  • Per HR Dive,
    • “The U.S. Senate confirmed Brittany Panuccio, an assistant U.S. attorney for the Justice Department in Florida, as a commissioner for the U.S. Equal Employment Opportunity Commission in a 51-47 vote Tuesday. Panuccio’s confirmation was part of an en bloc vote on several nominations.
    • “Panuccio fills the seat vacated in December by Keith Sonderling, who was named deputy labor secretary in March, and gives Republicans a majority. Her term expires July 1, 2029. 
    • “Panuccio’s confirmation restores a quorum to EEOC, which has operated with only two commissioners since January, when President Donald Trump fired Democratic commissioners Charlotte Burrows and Jocelyn Samuels before the expiration of their terms.”

From the Food and Drug Administration front,

  • Healio adds,
    • “The FDA approved Zoryve cream 0.05% for the treatment of children aged 2 to 5 years with mild to moderate atopic dermatitis, according to a press release. 
    • “Currently, there are approximately 1.8 million children aged 2 to 5 years being treated with a topical therapy for AD. Zoryve (roflumilast, Arcutis) cream 0.05% is a once-daily, next-generation phosphodiesterase-4 inhibitor that offers a nonsteroidal option for children and their caregivers.
    • “It is essential to have safe and effective treatments for children, who are often diagnosed with atopic dermatitis at a young age and can live with the condition across their lifetime,” Lawrence F. Eichenfield, MD, chief of pediatric and adolescent dermatology at Rady Children’s Hospital-San Diego and vice chair of the department of dermatology at University of California San Diego, said in the release. “Young children often experience widespread disease, affecting large portions of their skin. Although topical steroids have been the standard treatment for years, they are not appropriate for long-term use.”

From the public health and medical / Rx research front,

  • The Wall Street Journal reassuringly explains how to get a Covid booster vaccination under the CDC’s newly approved guidelines.
  • MedPage Today reports
    • “To prevent measles outbreaks, public health systems and clinicians should look below the 35,000-foot view of state- and county-level vaccination rates against measles, mumps, and rubella (MMR) and instead aim their focus on at-risk school districts and schools, according to a statewide analysis of Texas counties.”
  • and
    • “The pre-cooked pasta Listeria recall broadened to include pasta salads and prepared dishes at Kroger, Trader Joe’s, and more grocery stores.
    • “Some Hello Fresh meals may contain Listeria-tainted spinach, USDA’s Food Safety and Inspection Service warned.
    • “Chicken corn dog products from Foster Poultry Farms also were recalled after wood was found in the batter causing at least five injuries. (NBC News)”
  • Per Healio,
    • “Changing trajectories of heart health markers during young adulthood were associated with potentially increased risk for cardiovascular disease later in life, researchers reported.
    • “In addition, individuals who maintained higher levels of CV health through young adulthood had lower risk for incident CVD vs. those whose CV health was maintained at lower levels or declined, according to data published in JAMA Network Open.”
  • and
    • “Acupuncture needling greatly improved pain-related disability in older adults with low chronic back pain compared with usual care, a randomized controlled trial demonstrated.
    • “Acupuncture may be an effective and safe pain management tool for many older adult patients,” Lynn L. DeBar, PhD, MPH, a researcher at Kaiser Permanente Center for Health Research, told Healio. “While it is unlikely to take away all the pain, this study suggests that it can decrease pain-related disability substantively.”
  • The New York Times considers that “He was expected to get Alzheimer’s 25 years ago. Why hasn’t he? Scientists are searching for the secret in [76-year-old] Doug Whitney’s biology that has protected him from dementia, hoping it could lead to ways to treat or prevent Alzheimer’s for many other people.”
  • Per Health Day,
    • “Preschoolers who regularly overeat are likely swallowing their emotions as well, a new study says.
    • “Girls who overeat as preschoolers are more likely to develop anxiety, impulsivity and hyperactivity when they grow into teenagers, researchers reported in the journal BMC Pediatrics.
    • “The results indicate that children’s eating patterns could be early signs of mental health challenges, researchers said.
    • “Occasional overeating is normal, but if a child frequently overeats, it can be a sign of emotional struggles,” senior researcher Linda Booij, a professor of psychiatry at McGill University in Quebec, Canada, said in a news release.”
  • Per Genetic Engineering and Biotechnology News,
    • “A research team co-led by scientists at Institute for Bioengineering of Catalonia (IBEC) and West China Hospital Sichuan University (WCHSU), working with partners in the U.K., has developed a nanoparticle technology that studies showed can reverse Alzheimer’s disease (AD) in mice. Unlike other types of nanomedicine that rely on nanoparticles as carriers for therapeutic molecules, this approach employs nanoparticles that are bioactive in their own right, and which the team refers to as “supramolecular drugs.”
    • “Instead of targeting neurons directly, the therapy restores proper function of the blood-brain barrier (BBB), the vascular gatekeeper that regulates the brain’s environment. The BBB is a cellular and physiological barrier that separates the brain from the blood flow to protect it from external dangers such as pathogens or toxins. Through their newly reported research the investigators demonstrated that targeting a specific mechanism enables undesirable “waste proteins” produced in the brain to pass through this barrier and be eliminated in the circulation. In Alzheimer’s disease, the main waste protein is amyloid-β (Aβ), the accumulation of which impairs normal neuronal function.
    • “By repairing this critical interface, the researchers observed a significant reduction in brain amyloid-β (Aβ) levels and a reversal of Alzheimer’s pathology in the animal models, with cognitive benefits lasting up to six months following treatment.
    • “Study lead Giuseppe Battaglia, PhD, ICREA research professor at IBEC, principal investigator of the Molecular Bionics Group, and colleagues reported on their findings in Signal Transduction and Targeted Therapy, in a paper titled “Rapid amyloid-β clearance and cognitive recovery through multivalent modulation of blood–brain barrier transport,” in which they stated, “This innovative therapeutic paradigm offers a promising pathway for developing effective clinical interventions, addressing vascular contributions to AD, and ultimately enhancing patient outcomes…The therapeutic trilogy achieved—amyloid clearance, barrier restoration, and sustained cognitive recovery—establishes a blueprint for precision neurovascular medicine.”

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “It was a repeat performance for all 10 children’s hospitals named as the nation’s best in this year’s iteration of U.S. News & World Report’s ranking.
    • “The highly watched list, now in its 19th year, reviewed outcomes, practices and surveyed opinions for 198 children’s hospitals.
    • “Of these, 86 hospitals were named in some respect, whether that be a top-10 ranking for 10 different pediatric specialties and/or as one of 50 unranked facilities named as a high performer on pediatric and adolescent behavioral health.
    • “Among these, 10 children’s hospitals were named to the list’s honor roll for scoring well across multiple specialties. That unranked collection is identical to last year’s honorees.
      • “Boston Children’s Hospital
      • “Children’s Hospital Colorado, Aurora
      • “Children’s Hospital Los Angeles
      • “Children’s Hospital of Philadelphia
      • “Children’s National Hospital, Washington, D.C.
      • “Cincinnati Children’s
      • “Nationwide Children’s Hospital, Columbus, Ohio
      • “Rady Children’s Hospital, San Diego
      • “Seattle Children’s Hospital
      • “Texas Children’s Hospital, Houston”
  • and
    • “Providers are betting on artificial intelligence to ease the pain point of prior authorization, a new survey shows.
    • “Cohere Health, which provides clinical intelligence to insurers and risk-bearing providers, polled 200 clinicians and office administrators and found that 99% of clinicians report confidence in using AI to back prior authorization. Most (96%) office administrators said the same.
    • “Two-thirds of those surveyed said a completely digital prior authorization process would significantly improve their workflows. Across the board, the respondents said the process should have real-time tracking baked into the experience, allowing them to track the status of key requests.
    • “Providers are speaking loud and clear: they want and deserve a prior authorization process that is smarter, simpler and more transparent,” said Brian Covino, M.D., chief medical officer of Cohere Health, in an announcement.”
  • Healthcare Dive relates,
    • “Saint Peter’s Healthcare System and Atlantic Health abandoned plans to merge on Monday, citing impacts of the “rapidly evolving healthcare landscape nationally.”
    • “The New Jersey-based health systems first announced plans to combine in January last year and signed a definitive agreement to merge in June 2024. 
    • “The systems shared scant details about why the deal fell apart. However, in a joint statement issued Monday both Atlantic President and CEO Saad Ehtisham and Saint Peter’s President and CEO Leslie Hirsch called the deal’s end disappointing.”
  • STAT News informs us,
    • “Just a decade ago, a doctor with multiple medical licenses was an anomaly. Sometimes physicians would apply for credentials from a few states if they lived near a border and wanted the flexibility to practice on either side, since a doctor needs to be licensed where their patient is physically located. In-demand specialists might get a few more if they wanted to see patients virtually. But in the years since Covid began driving patients online, the number of physicians seeking multi-state licensure has ballooned to support the growing field of telehealth.
    • “Within that group, a STAT analysis of physician licenses shows that a small but powerful cohort of physicians is accumulating licenses in all 50 states, plus the nation’s capital and its territories. These physicians don’t max out on licenses just to practice across state lines. Often, they own the medical groups that are affiliated with nationwide telehealth companies. A doctor’s full roster of medical licenses can be leveraged for online businesses that provide specialty care, build patient funnels for pharma companies seeking to sell drugs directly to consumers, prescribe compounded meds — or sometimes, all of the above. 
    • “In 2016, just nine physicians in the U.S. held active licenses in all 50 states, according to data from the Federation of State Medical Boards. By 2024, 172 doctors had filled out their bingo card, and another 356 doctors had acquired at least 45 licenses — significantly outpacing the profession’s overall growth.”
  • As we approach Open Season, the American Diabetes Association offers “Health Insurance Aid for Diabetes. Access to medical care is key to managing your diabetes. Get more information on resources available to people living with diabetes.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI, Uncategorized–

From the cybersecurity policy front,

  • Federal News Network reports,
    • “The Cybersecurity and Infrastructure Security Agency typically marks October’s awareness month with a range of public engagements and outreach campaigns. But under the ongoing government shutdown, CISA has furloughed nearly two-thirds of its staff and curtailed most public communication.
    • “CISA is not actively managing its website under the shutdown. But the agency did establish a landing webpage for cybersecurity awareness month prior to the shutdown, detailing the campaign’s theme and linking to a toolkit.
    • “CISA Director of Public Affairs Marci McCarthy said, “CISA remains fully committed to safeguarding the nation’s critical infrastructure,” as part of a statement.” * * *
    • “Chris Cummiskey, a former state chief information officer and former chief management officer at DHS, said CISA typically retains enough employees to staff the agency’s watch floor, maintain technology that monitors federal networks for cyber threats, and collaborate with cyber defenders at other federal organizations, like U.S. Cyber Command.
    • “But if a major cyber incident were to occur, CISA may not have enough staff immediately on hand to manage the event.
    • “A key concern is, do you need to start recalling people?” Cummiskey said. “You probably wouldn’t have the onsite capacity to cover a major exploit without the additional help.”
    • “In addition to the shutdown, key privacy and liability protections under the Cybersecurity Information Sharing Act of 2015 expired on Sept. 30. Those protections had been pivotal to encouraging the private companies to share cyber threat data with each other and with government agencies, including CISA.
    • “Cyber experts say companies may be more hesitant to share information about new cyber threats and vulnerabilities without the statute’s protections.”
  • Cybersecurity Dive adds,
    • “Michael Daniel, president of the Cyber Threat Alliance, an information-sharing group, predicted that some companies will “suspend some sharing activities with the government,” but he added that a lot will depend on “each company’s risk tolerance.”
    • “I think some collaboration will continue,” he said, “but likely at reduced levels and requiring more human oversight.”
    • “Ari Schwartz, managing director of cybersecurity services at the law firm Venable, said, “There will just be many more lawyers involved, and it will all go slower, particularly new sharing agreements.” Venable has advised clients on what to consider when establishing such agreements.
    • “As for companies sharing information with each other, that likely will continue for now because of a lack of near-term concern about antitrust investigations, Daniel said. But companies’ attitudes could change if the program isn’t reauthorized.”
  • The National Institute of Standards announced on September 29, 2025,
    • “As part of ongoing efforts to strengthen the protections for securing controlled unclassified information (CUI) in nonfederal systems [which includes FEHB and PSHB claims data], NIST has released the following drafts for comment:
    • “SP 800-172r3 (Revision 3) fpd (final public draft), Enhanced Security Requirements for Protecting Controlled Unclassified Information, provides new enhanced security requirements that support cyber resiliency objectives, focus on protecting CUI, and are consistent with the source controls in SP 800-53r5.
    • “SP 800-172Ar3 ipd (initial public draft), Assessing Enhanced Security Requirements for Controlled Unclassified Information, provides a set of assessment procedures for the enhanced security requirements. These procedures are based on the source assessment procedures in SP 800-53Ar5.” * * *
    • “A public comment period will be open from September 29 through November 14, 2025. Reviewers should submit comments on all or parts of the drafts to 800-171comments@list.nist.gov.”
  • Cybersecurity Dive tells us,
    • “Barely any U.S. defense contractors say they’re fully prepared to comply with the Department of Defense’s new cybersecurity assessment program.
    • “Only 1% of companies say they’re completely ready to be assessed through the Cybersecurity Maturity Model Certification (CMMC) program, which takes effect on Nov. 10, according to a report that the managed security provider CyberSheath published on Wednesday.
    • “The percentage of respondents expressing confidence in their readiness has dropped over the past two years.”

From the cybersecurity vulnerabilities and breaches front,

  • NextGov/FCW reports on September 29, 2025,
    • “A “widespread cybersecurity incident” at the Federal Emergency Management Agency allowed hackers to make off with employee data from both the disaster management office and U.S. Customs and Border Protection, according to a screenshot of an incident overview presentation obtained by Nextgov/FCW.
    • “The hack is also suspected to have later triggered the dismissal of two dozen Federal Emergency Management Agency technology employees announced late last month, according to internal meeting notes and a person familiar with the matter.
    • “The initial compromise began June 22, when hackers accessed Citrix virtual desktop infrastructure inside FEMA using compromised login credentials. Data was exfiltrated from Region 6 servers, the image says. That FEMA region services Arkansas, Louisiana, New Mexico, Oklahoma and Texas, as well as nearly 70 tribal nations.” * * *
    • “DHS security operations staff were notified of the breach on July 7, the screenshot adds. On July 14, the unnamed threat actor used an account with high-level access and attempted to install virtual networking software that could allow them to extract information. Initial remediation steps were taken on July 16. 
    • “On Sept. 5, additional remediation actions were taken, including changing FEMA Zscaler policies and blocking certain websites, the screenshot says. Those actions were previously reported by Nextgov/FCW.”
  • Following up on last Saturday’s post about the Cisco KVEs, Cybersecurity Dive lets us know,
    • “Nearly 50,000 Cisco firewall devices with recently disclosed vulnerabilities are connected to the internet, according to new data.
    • “Statistics from the Shadowserver Foundation illustrate the extent of the world’s exposure to the three flaws in Cisco’s Adaptive Security Appliance devices and Firepower Threat Defense devices, which earned a rare emergency patching directive from the Cybersecurity and Infrastructure Security Agency (CISA) after the Sept. 25 disclosure.
    • “The United States has by far the most devices that have not been patched to block exploitation of the flaws, with Shadowserver tallying more than 19,000 vulnerable U.S. devices. The U.K. ranks second, with more than 2,700 vulnerable devices, followed by Japan, Germany and Russia. Other European countries have fewer than 1,000 vulnerable devices each.
    • “Shadowserver’s records will reveal how quickly different countries are reducing their exposure as the organization continues collecting data in the coming days and weeks.
    • “A sophisticated threat actor has been using two of the new Cisco flaws, CVE-2025-20362 and CVE-2025-20333, in a stealthy cyberattack campaign that has breached multiple federal agencies and other organizations worldwide. Both vulnerabilities involve improper validation of HTTPS requests, which could allow Cisco firewalls to accept malicious requests that bypass authentication. CVE-2025-20362 could allow hackers to access restricted VPN-related URLs, while CVE-2025-20333 could let intruders run arbitrary code as root.”
  • Cyberscoop points out,
    • “Red Hat on Thursday [October, 2, 2025] confirmed an attacker gained access to and stole data from a GitLab instance used by its consulting team, exposing some customer data. The open-source software company, a subsidiary of IBM, said the breach is contained and an investigation into the attack is underway. 
    • “Upon detection, we promptly launched a thorough investigation, removed the unauthorized party’s access, isolated the instance, and contacted the appropriate authorities,” Red Hat said in a security update. “Our investigation, which is ongoing, found that an unauthorized third party had accessed and copied some data from this instance.”
    • “Red Hat said the compromised GitLab instance contained work related to consulting engagements with some customers, including project specifications, example code snippets and internal communications about the consulting services. 
    • “This GitLab instance typically does not house sensitive personal data,” Red Hat said. “While our analysis remains ongoing, we have not identified sensitive personal data within the impacted data at this time.”
  • Dark Reading informs us,
    • “The month-long outage for luxury car maker Jaguar Land Rover appears to be at an end, with the company working through a “controlled, phased restart” of its manufacturing operations this week, following a massive cyberattack that forced the company to shut down its systems.
    • “JLR said on Sept. 2 that it had “proactively” shut down operations following a cyber incident, initially stating that customer data did not seem to be stolen, but revising that statement a week later. JLR, a subsidiary of Tata Motors, likely suffered $50 million to $70 million in lost revenue per week, with the total cost of the incident estimated at a staggering $1.7 billion to $2.4 billion.
    • “The attack, and its vast impact, should be a warning for companies, says Chris Gibson, executive director of the Forum of Incident Response and Security Teams (FIRST).
    • “The outage “highlights that even large corporations with substantial resources can be completely disrupted and that critical industries may be more vulnerable than previously thought,” he says. “This was far beyond data theft; it was a complete operational outage.”
  • Security Week adds,
    • “Japanese brewing giant Asahi Group Holdings on Monday [September 29, 2025] announced that its operations in the country have been disrupted by a cyberattack.
    • “The incident, the company said, resulted in system failures that affected orders and shipments at all its subsidiaries in the country, as well as call center operations, customer service desks included.
    • “Reuters reported that production at some of Asahi’s 30 domestic factories has been suspended due to the cyberattack.
    • “At this time, there has been no confirmed leakage of personal information or customer data to external parties,” the company said in a Monday notice.
    • “Asahi said it is investigating the attack and working on restoring the affected systems but could not provide an estimated timeline for recovery.
    • “The system failure is limited to our operations within Japan,” it said.
    • “The company has not disclosed the nature of the cyberattack it fell victim to, but the system-wide outage could indicate that file-encrypting ransomware might have been used.”

From the ransomware front,

  • Cybersecurity Dive reports,
    • “Corporate executives are being targeted in an email-based extortion campaign by a threat actor claiming affiliation with the notorious Clop ransomware gang, according to security researchers from Google Threat Intelligence Group and Kroll. 
    • “The hacker claims to have data stolen from breached Oracle E-Business Suite applications and has been demanding payment from various corporate executives, according to a LinkedIn post from Austin Larsen, principal threat analyst at GTIG.
    • “While researchers have not been able to substantiate the claims of a data breach, they have confirmed important links to a financially motivated threat group tracked under the name FIN11, which has prior associations with Clop.” 
  • Cyberscoop provides us with “the email Clop attackers sent to Oracle customers. The emails, which are littered with broken English, aim to instill fear, apply pressure, threaten public exposure and seek negotiation for a ransom payment.”
  • Dark Reading adds,
    • After announcing its farewell last month, the cyber extortion group known as Scattered Lapsus$ Hunters returned on Friday with a website featuring stolen Salesforce data and a list of dozens of alleged victims.
    • Scattered Lapsus$ Hunters is an apparent combination of the Scattered Spider, Lapsus$, and ShinyHunters cybercriminal groups, which first emerged over the summer in a public Telegram channel. However, just a few weeks later, the collective published a goodbye letter on Telegram and the Dark Web marketplace BreachForums, saying the three groups, as well as other threat actors, had “decided to go dark.”
    • “But Scattered Lapsus$ Hunters burst back into the limelight this week with a Dark Web leak site devoted to the recent spate of Salesforce data thefts; one of the two distinct campaigns targeting Salesforce environments recently has been attributed to a threat group tracked by Google as UNC6040, which has claimed to be ShinyHunters in its extortion attempts.
    • “According to Google, UNC6040 actors used vishing calls to convince IT support personnel at targeted organizations to grant them access to or credentials for the organizations’ Salesforce environments. Mandiant researchers this week said the threat actors have impersonated third-party vendors in the vishing calls and had also targeted users in victim organizations with elevated access to other SaaS applications.’
  • The American Hospital Association points out,
    • “A Health-ISAC (Information Sharing and Analysis Center) bulletin released Oct. 1 warns of a recently released LockBit 5.0 ransomware variant that poses a threat to health care and other sectors. LockBit 5.0 is the latest version of the ransomware-as-a-service group that has previously attacked hospitals and other organizations in the U.S. and abroad. The notice said the new variant directly targets virtual environments and has improved and enhanced technical capabilities, evasion techniques and affiliate engagement. The variant is known to target Windows, Linux and VMware ESXi software. Health-ISAC said the new variant’s technical capabilities make it faster, more flexible for affiliates and harder for security to detect and analyze. LockBit was disrupted by authorities last year before resurfacing last month.
    • “This is a very technical bulletin, but it’s important to note that it addresses a new version of a well-known ransomware,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “Hospitals should ensure that they have defensive measures in place and that those measures are tuned and working properly.”
  • HackRead reports on September 29,
    • “The Medusa ransomware group is claiming responsibility for a ransomware attack on Comcast Corporation, a global media and technology company best known for its broadband, television, and film businesses.
    • “According to the group’s dark web leak site, they exfiltrated 834.4 gigabytes of data and are demanding $1.2 million for interested buyers to download it. The same sum has been set as ransom for Comcast if the company wants the data deleted rather than leaked or sold.
    • “To back its claims, Medusa has posted around 20 screenshots allegedly showing internal Comcast files. The group also shared a massive file listing of 167,121 entries, suggesting access to actuarial reports, product management data, insurance modelling scripts, and claim analytics.” * * *
    • “Medusa ransomware is known for publishing file listings and partial screenshots as proof of compromise while holding back the bulk of the data to increase ransom pressure. In this case, the nature of the files points toward actuarial and financial datasets, some of which appear to involve insurance calculations, customer data processing, and claim management systems.”
  • HelpNetSecurity provides us background about and advice on how to avoid Akira ransomware.
  • Wired notes that “Google has launched a new AI-based protection in Drive for desktop that can shut down a [ransomware] attack before it spreads—but its benefits have their limits.”

From the cybersecurity defenses front,

  • Per ISACA,
    • “Cybersecurity professionals from around the world recently weighed in on some of the key findings from ISACA’s latest State of Cybersecurity survey report. Aparna Achanta, security leader, IBM (US); Simon Backwell, head of information security, Benefex (UK); Donavan Cheah, senior cybersecurity consultant, Thales (Singapore); Jenai Marinkovic, vCISO/CTO, Tiro Security, and CEO & chairman of the board, GRCIE (US); Kannammal Gopalakrishnan, cybersecurity and GRC professional (India), and Carlos Portuguez, Sr. Director BISO, Concentrix (Costa Rica)—all of whom are also members of ISACA’s Emerging Trends Working Group—reflect on how these stats show up for them in the profession.”
  • and
    • “Phishing has escalated beyond masquerading techniques. Traditional attacks depended on typos, being in a rush and not so well-disguised social engineering. But hackers today use generative AI, such as WormGPT or FraudGPT, and even deepfakes, to create perfect messages with contextual background that can effortlessly be mixed with everyday corporate messages. Cofense has noted that it receives an AI-enhanced malicious email every 42 seconds, with that pace expected to accelerate in the months to come. This hypergrowth is an indication that phishing is not an outlying issue anymore but a mainstream cyber-crime, now with AI-driven precision. 
    • “The next pivot is neuro-phishing, which can tie in the details of biometric and psycho-physiological indicators, like the EEG, micro-hesitation spikes, blink frequency, and the focus of the eyes, to see the response of the user in real-time and work a different approach. Previous and extensive studies have already established the reliability of finding recognition and stress using the EEG, when users are stimulated with phishing. This is not passive baiting anymore, but a dynamic, cognitive feedback loop, which transforms human users into interactive targets.”
    • The article offers advice on creating resilience against neuro-phishing.
  • Dark Reading adds,
    • “Email security has long dominated the enterprise security conversation — and rightfully so. It remains a key vector for phishing, credential theft, and social engineering. But in 2025, the threat landscape has shifted. Quietly yet decisively, attackers increasingly are bypassing the inbox and expanding their reach across multiple channels. 
    • “Recent data from TechMagic shows that 41% of phishing incidents now employ multichannel tactics, including SMS (smishing), voice calls (vishing), and QR codes (quishing). The trend is clear: While email still matters, adversaries are shifting to mobile-first platforms like text, iMessage, WhatsApp, and social direct messages. These attacks are harder to spot, more difficult to control, and more likely to succeed, because they target the most vulnerable point in the chain: the human behind the screen.
    • “To address this growing threat to mobile platforms, new security approaches are emerging that leverage AI-driven defenses to identify and prevent social engineering attacks in real-time. By training large language models (LLMs) to understand the content and intent behind messages, these systems can flag suspicious activity and enforce protective measures before users fall victim. Whether it’s a text message posing as IT support or impersonating a vendor, these next-generation solutions focus on stopping threats at the human layer — not just at the device.”
  • Infosecurity Magazine explains how “AI-Generated Code Used in Phishing Campaign Blocked by Microsoft.”
  • Per CISO Online,
    • “A surge in vulnerabilities and exploits leaving overloaded security teams with little recourse but to embrace risk-based approaches to patching what they can.
    • “Enterprise attack surfaces continue to expand rapidly, with more than 20,000 new vulnerabilities disclosed in the first half of 2025, straining already hard-pressed security teams.
    • “Nearly 35% (6,992) of these vulnerabilities have publicly available exploit code, according to the Global Threat Intelligence Index study by threat intel firm Flashpoint.
    • “The volume of disclosed vulnerabilities has more than tripled while the amount of exploit code has more than doubled since the end of February 2025 alone.
    • “These increases make it no longer feasible for most organizations to triage, remediate, or mitigate every vulnerability, Flashpoint argues, suggesting enterprises need to apply a risk-based patching framework. But some experts quizzed by CSO went further — arguing a complete operational overhaul of vulnerability management practices is needed.
    • The article delves into that approach.
  • Per the National Institute of Standards,
    • “The NIST National Cybersecurity Center of Excellence (NCCoE) has finalized a guide, NIST Special Publication (SP) 1334, Reducing the Cybersecurity Risks of Portable Storage Media in Operational Technology (OT) Environments, to help organizations protect their industrial control systems from cybersecurity threats when using removable media devices.
    • “Portable storage media devices, like USB flash drives, are commonly used to transfer data between computers. However, using them in OT environments and industrial control systems, such as those used in power plants or manufacturing facilities, can pose a cybersecurity risk. If a USB device is infected with malware, it can spread to the industrial control system and cause problems, such as disrupting operations or compromising safety.
    • “This NCCoE resource suggests implementing physical and technical controls to limit access to these devices and ensure they are used securely.”
  • Here is a link to Dark Readings’ CISO Corner.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Health ISAC reminds us,
    • “Despite widespread public and private interest in reauthorizing the U.S. Cybersecurity Information Sharing Act of 2015 (“CISA 2015”)[i], we are rapidly approaching September 30th, the date when the Act is set to expire barring congressional action to extend it. With time running short, let’s assess the options still being considered and breakdown how and why reauthorization is going down to the wire.” * * *
    • “The current most likely path for a CISA 2015 reauthorization is not a simple standalone bill that is quickly passed by both chambers. Instead, the most likely path runs through a short term extension as part of a continuing resolution (“CR”) and then through the National Defense Authorization Act (“NDAA”).
    • “For those who are unfamiliar, a CR is a “temporary spending [bill] that [allows] federal government operations to continue when final appropriations have not been approved by Congress and the President. Without final appropriations or a CR, there could be a lapse in funding that results in a government shutdown.”[ii] The NDAA is an annual end of year bill that provides appropriations for the Department of Defense (“DOD”). It is generally considered to be a “must pass” piece of legislation that lawmakers attempt to add otherwise unrelated policy matters.”
  • Nextgov/FCW tells us,
    • “Greg Barbaccia, the federal chief information officer, says that the Office of Management and Budget is backing the General Services Administration’s overhaul of FedRAMP, the government’s cloud security assessment and authorization program. 
    • “GSA launched FedRAMP 20x — meant to use more automation in place of annual assessments, cut red tape and speed up authorizations — in March. It announced its phase two pilot on Wednesday.
    • “Barbaccia acknowledged the past problems with FedRAMP at a Wednesday event held by the Alliance for Digital Innovation. 
    • “I have done FedRAMP in my past life,” said Barbaccia, who previously worked at Palantir and more recently at a machine-learning enabled asset manager. “What a pain in the butt.”
    • “The FedRAMP program is planning on pursuing 10 pilot authorizations at the Moderate security level as part of the new phase of FedRAMP 20x, said FedRAMP Director Pete Waterman.”
  • Per a Cybersecurity and Infrastructure Security Agency (“CISA”) news release,
    • Today [September 23, 2025], the Cybersecurity and Infrastructure Security Agency (CISA) announced the appointment of Stephen L. Casapulla as the Executive Assistant Director for Infrastructure Security.
    • “I am pleased to have Steve expand his role on CISA’s leadership team,” said Acting Director Madhu Gottumukkala. “With his extensive experience in critical infrastructure security and working with stakeholders, he is perfectly poised to lead our efforts in securing the nation’s critical infrastructure. I look forward to working with him on this important mission.”
    • Prior to joining CISA, Casapulla served as the Director for Critical Infrastructure Cybersecurity in the Office of the National Cyber Director. He previously spent over thirteen years at CISA and its predecessor, holding a variety of senior roles. His prior federal service includes work at the Small Business Administration and at the Department of State in Iraq. He also serves as an officer in the U.S. Navy Reserve, with over twenty years of service and multiple overseas deployments.

From the cybersecurity vulnerabilities and breaches front,

  • Cybersecurity Dive reports,
    • “The Cybersecurity and Infrastructure Security Agency on Thursday [September 25, 2025,] ordered U.S. government agencies to patch multiple vulnerabilities in Cisco networking products, saying an “advanced threat actor” was using them in a “widespread” campaign.
    • “This activity presents a significant risk to victim networks,” CISA said in an emergency directive that laid out a mandatory timeline for agencies to identify, analyze and patch vulnerable devices.
    • “The hacking campaign — an extension of the sophisticated “ArcaneDoor” operation that Cisco first revealed in April 2024 — has compromised multiple federal agencies, two U.S. officials told Cybersecurity Dive. Both officials requested anonymity to discuss a sensitive and evolving investigation.”
  • Cyberscoop adds,
    • “Cisco said it began investigating attacks on multiple government agencies linked to the state-sponsored campaign in May. The vendor, which attributes the attacks to the same threat group behind an early 2024 campaign targeting Cisco devices it dubbed “ArcaneDoor,” said the new zero-days were exploited to “implant malware, execute commands, and potentially exfiltrate data from the compromised devices.” 
    • “Cisco disclosed three vulnerabilities affecting its Adaptive Security Appliances — CVE-2025-20333, CVE-2025-20363 and CVE-2025-20362 — but said “evidence collected strongly indicates CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.” 
    • “The Cybersecurity and Infrastructure Security Agency said those two zero-days pose an “unacceptable risk” to federal agencies and require immediate action.”
  • Dark Reading points out,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) this week disclosed that threat actors breached a federal agency last year by exploiting a critical vulnerability in the open source GeoServer mapping server.
    • “In the advisory, CISA said it conducted incident response at a large, unnamed federal civilian executive branch (FCEB) agency after malicious activity was flagged by the agency’s endpoint detection and response (EDR) platform, but found the agency’s response playbook to be lacking; so lacking in fact that it hampered CISA’s investigation and allowed the attackers to burrow deeper into the network unchecked.
  • Cybersecurity Dive adds,
    • “[On September 23, 2025,] the Cybersecurity and Infrastructure Security Agency urged security teams to monitor their systems following a massive supply chain attack that struck the Node Package Manager ecosystem. 
    • “The attack, tracked under the name Shai-Hulud, involved a self-replicating worm that compromised more than 500 software packages, according to StepSecurity. 
    • “After gaining access, a malicious attacker injected malware and scanned the environment for sensitive credentials. The credentials included GitHub Personal Access Tokens and application programming interface keys for various cloud services, including Amazon Web Services, Google Cloud Platform and Microsoft Azure. 
    • “The stolen credentials were uploaded to an endpoint controlled by the attacker and then uploaded to a public repository called Shai-Hulud. 
    • “Researchers at Palo Alto Networks said the attacker used an LLM to write the malicious script, according to an updated blog post released Tuesday.” 
  • Cybersecurity Dive relates,
    • “Hackers are conducting brute force attacks against the MySonicWall.com portal in order to access the company’s cloud backup service for firewalls, SonicWall and federal authorities warned in advisories released Monday [September 22, 2025].
    • “SonicWall said its investigation found that hackers gained access to 5% of backup firewall preference files. The company warned that while credentials inside the files were encrypted, the files contained other information that could help attackers exploit the firewall, according to the advisory.  
    • “SonicWall also released a video explaining the scope of the incident. 
    • “In an advisory on Monday, the Cybersecurity and Infrastructure Security Agency urged customers to log into their accounts to determine whether their devices are at risk.” 
  • Cyberscoop reports,
    • “The Secret Service said Tuesday [September 23, 2025] that it disrupted a network of electronic devices in the New York City area that posed imminent telecommunications-based threats to U.S. government officials and potentially the United Nations General Assembly meeting currently underway.
    • “The range of threats included enabling encrypted communications between threat groups and criminals or disabling cell towers and conducting denial-of-service attacks to shut down cell communications in the region. Matt McCool, special agent in charge of the Secret Service’s New York field office, said the agency’s early analysis of the network indicated “cellular communications between foreign actors and individuals that are known to federal law enforcement.”
    • “In all, the agency said it discovered more than 300 servers and 100,000 SIM cards spread across multiple sites within 35 miles of the U.N. meeting. The Secret Service announcement came the same day President Donald Trump was scheduled to deliver a speech to the General Assembly.
    • “The potential for disruption to our country’s telecommunications posed by this network of devices cannot be overstated,” U.S. Secret Service Director Sean Curran said in a news release.”
  • Cyberscoop warns,
    • “Ambitious, suspected Chinese hackers with a slew of goals — stealing intellectual property, mining intelligence on national security and trade, developing avenues for future advanced cyberattacks — have been setting up shop inside U.S. target networks for exceptionally long stretches of time, in a breach that the researchers who uncovered it said could present problems for years to come.
    • “Mandiant and Google Threat Intelligence Group (GTIG) researchers described the campaign as exceptionally sophisticated, stealthy and complex, calling those behind it a “next-level threat.” But they don’t yet have a full handle on who the hackers are behind the malware they’ve dubbed Brickstorm, or how far it stretches. A blog post the company posted Wednesday sheds light on the group.
    • “The primary targets are legal services organizations and tech companies that provide security services, the researchers said. But the hackers aren’t limiting their interest to the primary targets, since they’ve used that access to infiltrate “downstream” customers. The researchers declined to describe those downstream customers or say whether U.S. federal agencies are among those targeted. A great many of them don’t know yet that they’re victims, they said.
    • “By stealing intellectual property from security-as-a-service (SaaS) firms, the hackers aim to find future zero-day vulnerabilities, a kind of vulnerability that is previously unknown and unpatched and thus highly prized, in order to enable more attacks down the line, the researchers from Mandiant and its parent company Google said.”
  • Per Dark Reading,
    • “Salesforce Web forms can be manipulated by the company’s “Agentforce” autonomous agent into exfiltrating customer relationship management (CRM) data — a concerning development as legacy software-as-a-service (SaaS) providers race to integrate agentic AI into their platforms to zhuzh up the user experience and generate buzz among investors.
    • “Agentforce is an agentic AI platform built into the Salesforce ecosystem, which allows users to spin up autonomous agents for most conceivable tasks. As the story often goes though, the autonomous technology appears to be the victim of the complexity of AI prompt training, according to researchers at Noma Security. 
    • “To wit: The researchers have identified a critical vulnerability chain in Agentforce, carrying a 9.4 out of 10 score on the CVSS vulnerability-severity scale. In essence it’s a cross-site scripting (XSS) play for the AI era — an attacker plants a malicious prompt into an online form, and when an agent later processes it, it leaks internal data. In keeping with all of the other prompt injection proofs-of-concept (PoCs) coming out these days, Noma has named its trick “ForcedLeak.”

From the ransomware front,

  • Cybersecurity Dive reports,
    • “RTX Corp., the parent firm of Collins Aerospace, confirmed that ransomware was used in the hack of its airline passenger processing software, in a filing with federal regulators. 
    • “The attack, discovered on Sept. 19, has disrupted flights across Europe since last week, including at London’s Heathrow Airport, Brussels Airport, and airports in Berlin and Dublin. 
    • “The Multi-User System Environment software, known as MUSE, is used by multiple airlines to check-in and board passengers and is also used to track baggage, according to the filing with the U.S. Securities and Exchange Commission. 
    • “Virginia-based RTX said the MUSE system operates on a customer-specific network outside of the company’s enterprise network.
    • “U.K. authorities said Wednesday that a man in his 40s had been arrested on suspicion of violating the Computer Misuse Act. The police investigation is ongoing.” 
  • Dark Reading points out,
    • “Volvo Group North America (Volvo NA) has been breached via a third-party human resources (HR) software provider.
    • “At the root of the story is Miljödata, a Swedish company specializing in occupational software-as-a-service (SaaS), whose cloud infrastructure was breached in August. Thanks to its centralized, multi-tenant arrangement, hundreds of customers and millions of individuals have been affected. In a recent letter to its staff, Volvo NA, whose parent company is based in Sweden, revealed itself to be one such victim.
    • “Like other Miljödata customers, Volvo NA’s systems were untouched by the attack. Still, its employees’ names and Social Security numbers (SSNs) were stolen, and potentially published to the Dark Web. According to its website, Volvo NA employs just shy of 20,000 people.
    • “For municipalities, universities, and even big corporations like Volvo, this isn’t just a security issue, it’s an integrity issue,” says Anders Askasen, vice president of product marketing at Radiant Logic. “People suddenly wonder whether the systems handling their most sensitive data are fit for the purpose, and with good reason. That loss of confidence is as damaging as the leak itself.”
  • Industrial Cyber tells us,
    • “The Rhysida ransomware gang claimed responsibility for a late-August data breach at the Maryland Transit Administration. Exposed data includes names, surnames, dates of birth, driver’s licenses, SSNs, passports, and confidential information.
    • “The group is said to have demanded a ransom of 30 bitcoin, around US $3.4 million at the time of writing, to be paid within seven days. To support its claim, Rhysida posted images of documents allegedly stolen from the MTA, including scans of a Social Security card, driver’s license, passport, and several other records.
    • “Comparitech identified that to prove its claim, Rhysida posted images of what it says are documents stolen from the MTA. They include scans of a Social Security card, driver’s license, passport, and several other documents. 
    • “The Maryland Transit Administration is a division of the state’s Department of Transportation. It operates buses, light rail, subways, commuter trains, taxis, and a paratransit system. The MTA specifically mentioned the paratransit system, MobilityLink, being disrupted by the cyber attack.”
  • Per the Record,
    • “Ransomware hackers stole Social Security numbers, financial information and more during a recent cyberattack on Union County in Ohio. 
    • “The county government began sending out breach notifications to 45,487 local residents and county employees this week. The letters say ransomware was detected on the county’s network on May 18, prompting officials to hire cybersecurity experts and notify federal law enforcement agencies.  
    • “The hackers stole documents that had names, Social Security numbers, driver’s license numbers, financial account information, fingerprint data, medical information, passport numbers and more.  
    • “No ransomware gang has taken credit for the attack publicly, and the letters said the county has been monitoring internet sources but have not found any indication the stolen information was released or offered for sale.  
    • “The county has about 71,000 residents and is 45 minutes outside of Columbus — which dealt with its own ransomware attack one year ago.” 
  • HIPAA Journal lets us know,
    • “There’s good and bad news on the ransomware front. Attacks are down year-over-year; however, successful attacks are proving even costlier to mitigate, according to the Mid-Year Risk Report from the cyber risk management company Resilience. The company saw a 53% reduction in cyber insurance claims in the first half of the year, which indicates organizations are getting better at preventing attacks; however, when ransomware attacks succeed, they have been causing increased financial harm, with losses 17% year-over-year. While ransomware accounted for just 9.6% of claims in H1, 2025, ransomware attacks accounted for 91% of incurred losses.
    • “On average, a successful ransomware attack causes $1.18 million in damages, up from $1.01 million in 2024, and the cost is even higher in healthcare. Resilience’s healthcare clients suffered average losses of $1.3 million in 2024, and in the first half of 2025, some healthcare providers faced extortion demands as high as $4 million. While it is too early to tell what the severity of claims will be in 2025 until claims are settled, Resilience said there are indications that the average severity of incurred losses for healthcare ransomware attacks this year could be $2 million, up from an average of $705,000 in 2024 and $1.6 million in 2023.”

From the cybersecurity defenses front,

  • Cyberscoop advises,
    • “Artificial intelligence is no longer a future concept; it is being integrated into critical infrastructure, enterprise operations and security missions around the world. As we embrace AI’s potential and accelerate its innovation, we must also confront a new reality: the speed of cybersecurity conflict now exceeds human capacity. The timescale for effective threat response has compressed from months or days to mere seconds. 
    • “This acceleration requires removing humans from the tactical security loop. To manage this profound shift responsibly, we must evolve our thinking from abstract debates on “AI safety” to the practical, architectural challenge of “AI security.” The only way to harness the power of probabilistic AI is to ground it with deterministic controls.”
  • A Dark Reading commentator recommends that “With the emergence of AI-driven attacks and quantum computing, and the explosion of hyperconnected devices, zero trust remains a core strategy for security operations.”
  • Per a CISA news releases,
    • “In today’s increasingly interconnected industrial landscape, operational technology (OT) systems are no longer isolated islands of automation—they’re deeply entwined with information technology and business networks, making them prime targets for cyber threats. Recognizing this growing risk, the Cybersecurity and Infrastructure Security Agency (CISA) collaborated with three U.S. federal agencies and five international partners and received contributions from twelve private sector stakeholders to develop and publish, “Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators”.
    • “This key resource helps owners and operators of OT systems create stronger, more secure infrastructures by building a clear inventory and classification of their assets. By identifying, organizing, and managing OT assets effectively, organizations can not only improve cybersecurity but also enhance operational reliability, safety, and resilience.”
  • Per National Institute of Standards news releases,
    • “NIST has released Special Publication (SP) 800-88r2 (Revision 2), Guidelines for Media Sanitization.
    • “Media sanitization is a process that renders access to the target data on media infeasible for a given level of effort. This guide will assist organizations and system owners in setting up a media sanitization program with proper and applicable methods and controls for sanitization and disposal based on the sensitivity of their information.”
  • and
    • “NIST has released Special Publication (SP) 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It is the final document in the SP 800-90 series, which supports the generation of high-quality random bits for cryptographic and non-cryptographic use.
    • “SP 800-90C specifies constructions for implementing random bit generators (RBGs) that include deterministic random bit generator (DRBG) mechanisms as specified in SP 800-90A and use entropy sources as specified in SP 800-90B.”
  • Here is a link to Dark Reading’s CISO Corner.