If it is online, plan as if it is already copied
Quest Diagnostics told regulators this week that someone got into Quanum, the system some clinics use to order labs and look up results. Quest learned of it on October 21, paused that system, and called federal law enforcement. They believe certain patient records were opened. They have not said how many. They also said the rest of the business kept running, and that this was not the PHP problem everyone else was patching.
I was not surprised. After twenty years in this work I treat most connected systems as already visited by someone who was not invited. The organizations that are careful find it and say so. The ones that are not careful find it later, or their customers do.
That is not a reason to fear every app on your phone. It is a reason to sort your information before you type it into one.
The argument I keep having
When Ready Center came out, someone I respect pushed back hard. People want it online. People want it on the phone. Nobody is going to run desktop software, keep an encrypted copy, or store a record they cannot open from a coffee shop.
I said it is not that simple. If the record lives in someone else’s cloud, you do not have custody of it. You have permission, and permission can be interrupted. The connection drops. The vendor has a bad week. The account is locked for “review.” The company is sold. Or the system is broken into, and you read about it in the news with everyone else.
Their answer was fair. They thought the whole point of a readiness record is the bad week. Power out. Roads closed. The ordinary systems busy or dark. If the inventory, the checklists, the manuals, and the copies of the papers all live in that same cloud, the week you need them is the week you cannot reach them.
A program on a thumb drive does not have that problem. It sits in the kit. It does not ask a data center for permission to open. That is self-custody. You hold it. You can still print it. When the screen is dead, the paper journal in the same kit still lists what you own and where it is.
We did not agree. They left convinced I was seeing disaster in every headline.
They called last night. The tone had changed. They said they had thought I was black-pilled, meaning I had given up and assumed the worst with no way through. Now they thought I was red-pilled, meaning I was looking at how the systems actually fail.
I told them not to be hard on themselves. This is easier to see after you have watched the same pattern for twenty years. Most of life runs fine on a service you rent. The mistake is renting a place to store the records you cannot afford to lose, or to publish, and then assuming the landlord’s lock is your lock.
They are a Ready Center user now. That part is nice. The point of the company is smaller than a product announcement. Help people be ready by giving them a system that organizes what they already own, reminds them before something fails, and prints a paper journal they can keep with the kit. The record stays in their custody.
What the last few days actually were
This is not a list to scare you. It is a list of ordinary internet parts failing in public, in the same week, with a patch or a shutdown as the remedy. If your readiness file had been sitting in one of these systems, you would have been a passenger.
- PHP, October 20–21. Two flaws in the language underneath a large share of websites, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 out of 10. In the right setup an outsider can run their own code on the server with no password. The fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Governments took public sites offline rather than guess. Wikipedia and the Internet Archive pulled systems while they patched. Impact if you were the customer: the application and everything it stored could be read or changed, and you would not have been the one holding the keyboard.
- GitLab, October 21. On self-hosted servers, CVE-2026-110264, scored 10, can let an outsider run code with no login. GitLab’s own cloud was already patched. Impact: source code, keys, and internal notes on a server you thought was private.
- Node.js, October 21. CVE-2026-111497, in the piece that unpacks compressed web data, can lead to code running where an application trusts that data. Fixed in 22.23.4, 24.22.1, and 26.12.1. Impact: a normal-looking request becomes a foothold on the server.
- eMudhra certificates, disclosed around October 17–20. A certificate authority had weak keys on certificates that vouch for websites. Browsers moved to stop trusting them. Impact: a fake site can wear a real site’s name, and a careful person still sees a lock icon.
- Arista VeloCloud, October 22. CVE-2026-114625, scored 9.9, already used in attacks. A normal login on the on-premises network controller can be turned into full operator control. Impact: the map of a company’s network, not just one web page.
- Quest Diagnostics, discovered October 21, disclosed October 22. Unauthorized access to one lab-ordering system and, Quest believes, certain patient records. Scope unknown. Quest says this is separate from the PHP flaws. Impact: health information is not like a newsletter signup. It does not expire when the password changes.
None of these mean “throw away the internet.” They mean the internet is a shared machine, patched by strangers, on a schedule you do not set.
Two ideas worth keeping
An attack surface is every place someone can touch the thing you are trying to protect. The website. The phone app. The vendor’s backup. The support account. The laptop in a coffee shop. The spreadsheet someone exported “just for the meeting.” Each one is another door. A cloud app feels like one door. It is your door, their door, their host’s door, and the door of every contractor who can open a ticket.
A threat vector is the path through one of those doors. An unpatched bug. A reused password. A vendor who was breached upstream. A message that looks like the password reset you were expecting. You can lock your front door and still lose the record because the company that stored it had a side entrance you never saw.
Sort the record before you store it
Information classification is a plain question. If this page were posted tomorrow, what would a stranger be able to do with it?
A canned-goods count is one thing. A canned-goods count plus the layout of the house is another. A list of firearms, with serial numbers, stored next to your address, is a map. A list of gold and silver, with weights and a location, is an invitation. A copy of a passport, a permit, or a medical note is a key to the rest of your life. Manuals and checklists feel harmless until they describe how your household actually runs.
SaaS, software you rent and open in a browser, is a good tool for work that has to be shared and would not hurt you if it leaked. Mail. A shared calendar. A public website. It is a poor safe for the records above. You do not pick the patch window. You do not hold the keys. When the service is down, so are you.
The working rule I gave my friend, and the one I use myself: before you finish the form, ask how you would be if that answer were stolen or published. Then assume it will be. If the honest answer is “I would be fine,” use the convenient service. If the honest answer is “someone would know what I have and where I sleep,” keep that record where you can unplug it.
What self-custody means here
Ready Center is built for the second pile. The database stays on your machine or on a drive you carry. It is encrypted with AES-256, the same class of encryption banks and governments use for data at rest, and it opens with a password you choose. There is no account for us to reset, and no copy on our side to lose. A portable copy runs from the drive itself, so the record can live in the safe and travel in the kit. Print the paper journal and the screen becomes optional.
That will not stop a lab, a hospital, or a certificate authority from having a bad week. Those are their records. It will keep your inventory, your documents, and your checklists from becoming one more folder in someone else’s breach.
Information is leverage. A person who has your list has a kind of power over you, even if they never knock on the door. The quiet move is to decide, item by item, which facts you are willing to rent out, and which facts stay in the safe.
