A critical flaw behind millions of websites. A major data breach. Health plans that may not be what they appear to be.
Three fraud and security warnings worth knowing
In brief
- Critical PHP vulnerabilities: CISA urged organizations to immediately patch two critical vulnerabilities in PHP, software widely used behind websites and online applications. The FBI followed with its own alert. Website operators need to act quickly, while consumers should be cautious of unexpected messages that use a real security incident to create urgency.
- Citizens Bank data breach: A breach reported by Citizens Bank exposed names, Social Security numbers, dates of birth, phone numbers and email addresses. A Texas Attorney General filing reports approximately 1.26 million people affected nationally, including 14,371 Texans.
- "Junk" health plans: Ahead of open enrollment, the Rhode Island Attorney General warned consumers about limited-benefit health plans that can look like traditional health insurance while providing significantly less protection.
This week's warnings look very different, but they have something important in common: the risk may sit behind something you already trust.
A website may rely on vulnerable software. A company you trust with personal information may suffer a breach. A health plan may look legitimate while providing far less protection than you expected.
This week, SecureFi highlights three official warnings and what individuals, families and businesses can do before the risk turns into harm.
This week's warnings
Critical PHP vulnerabilities: A real security problem can create an opportunity for scammers
PHP is software used behind websites and online applications. Most people will never see it, but many businesses, government organizations, hosting providers and online services depend on it.
On October 21, the Cybersecurity and Infrastructure Security Agency, CISA, urged organizations to immediately patch two critical vulnerabilities known as CVE-2026-109618 and CVE-2026-109619.
The vulnerabilities, sometimes referred to collectively as "PHP2Shell," can allow an attacker without prior access to remotely execute code on an affected server.
The FBI followed with its own public alert on October 23. The two vulnerabilities carry a CVSS severity score of 9.2, indicating critical severity.
If you operate a website or business
Contact your IT team, website administrator or hosting provider and determine whether your systems use an affected version of PHP.
CISA recommends:
- identifying systems running PHP
- immediately applying available security updates
- prioritizing internet-facing systems
- monitoring systems for suspicious activity
- taking affected systems offline if they cannot be safely updated
Do not assume that a hosted website means someone else has already addressed the problem. Confirm it.
Older, unsupported versions of PHP may not have a standard security update available and may need to be upgraded to a currently supported version.
If you are a consumer
You probably will not be patching PHP yourself.
What matters is that criminals can use real security events to make fraudulent messages sound more believable.
Be cautious of unexpected emails, texts or pop-ups claiming:
- your account has been affected by a security vulnerability
- you need to install an urgent security update
- you must click a link to secure your account
- a website or service needs you to verify information because of the vulnerability
Do not use the link or telephone number in an unexpected message.
Go directly to the organization's official website, app or independently verified support channel.
If you suspect a system was compromised
Businesses should isolate affected systems, preserve relevant logs and report signs of compromise through appropriate cybersecurity and law-enforcement channels.
The FBI directs organizations that identify signs of compromise to their local FBI field office or the FBI Internet Crime Complaint Center at IC3.
A real warning does not make every message about that warning real.
Organizations need to patch the underlying vulnerability. Consumers should independently verify any unexpected communication that tries to use a security event to make them act quickly.
Citizens Bank breach: Stolen information can remain useful to criminals for years
Citizens Bank reported a data breach involving personal information belonging to customers.
California's Attorney General breach portal lists the incident as occurring on September 10, 2026, with the breach reported on October 19.
A filing with the Texas Attorney General reports approximately 1.26 million people affected nationally, including 14,371 Texas residents.
Reportedly exposed information included:
- names
- Social Security numbers
- dates of birth
- phone numbers
- email addresses
That combination matters because criminals can use accurate personal information to make future phishing, impersonation and identity-theft attempts considerably more convincing.
A caller knowing your name, date of birth, bank or other personal details does not prove the caller actually represents that organization.
What to do
If you receive an official notice that your information was involved:
- Read the notification carefully and follow the bank's official instructions.
- Consider placing a credit freeze with Equifax, Experian and TransUnion.
- Monitor bank and credit accounts for activity you do not recognize.
- Be particularly cautious of calls, emails or texts claiming to be from the bank.
- Do not provide passwords, security codes or other sensitive information in response to an unexpected contact.
- Contact the bank using its official website, mobile app, the number on your card or another independently verified channel.
If you see signs of identity theft
Contact affected financial institutions promptly and document what occurred.
Consumers can also report identity theft and receive a recovery plan through the Federal Trade Commission's IdentityTheft.gov service.
A breach may happen once. The information taken in that breach can be reused repeatedly.
Be especially cautious when someone contacting you already knows accurate information about you. That information may be exactly what makes the fraud convincing.
"Junk" health plans: Make sure the coverage is really insurance
With open enrollment approaching, the Rhode Island Attorney General warned consumers on October 20 about limited-benefit or "junk" health plans.
These products can look similar to regulated health insurance but may provide substantially less coverage.
The Attorney General highlighted several warning signs.
Before you buy
Look closely at the disclosures
Look carefully for disclosures stating that the product is "not insurance" or provides only limited benefits.
Do not assume that something marketed as a health plan provides the protections of comprehensive health insurance.
Look closely at what is actually covered
Watch for:
- caps on benefits
- broad exclusions
- limited-duration coverage
- unusually low premiums
- "limited time" offers
- missing coverage for hospital, physician or laboratory services
Be careful with online advertising
Avoid clicking on unexpected pop-up advertisements for health coverage, particularly sites that require personal information before showing you what the plan actually covers.
Ask for the complete terms in writing before paying.
Consumers should understand:
- covered services
- exclusions
- deductibles
- coverage limits
- provider networks
- maximum benefits
- cancellation terms
With open enrollment approaching, consumers should use their official state marketplace, HealthCare.gov where applicable, or a properly licensed insurance professional when evaluating coverage.
If you believe you purchased a fraudulent plan
Contact your state insurance regulator or Attorney General's consumer-protection office.
Rhode Island residents can contact the Rhode Island Attorney General's Office for assistance.
A professional-looking website, familiar terminology or convincing salesperson does not prove that a health product provides the protection you think you are buying.
Get the coverage details in writing and verify the organization before providing personal information or payment.
The SecureFi takeaway: Verify what sits behind the trusted name
This week's warnings involve very different risks:
- software operating behind websites and services
- personal information held by a financial institution
- health coverage offered under a legitimate-looking name
The protective habit is the same.
- Pause. Do not let urgency force a decision.
- Verify independently. Use contact information and sources you obtained yourself.
- Understand what changed. A real event can create opportunities for follow-on scams and impersonation.
- Act quickly if harmed. Contact affected institutions, preserve evidence and follow appropriate reporting and recovery steps.
SecureFi.AI is designed to help people understand risks affecting the things they depend on, evaluate suspicious situations before acting, and guide reporting and recovery when something has already gone wrong.
Edited by David Haberland · Published by SecureFi, Inc. · All Fraud and Scam Watch editions · New edition every week · Follow on LinkedIn · RSS