Greetings, The Australian Signals Directorate (ASD) has introduced the ASD Essentials framework, expanding on the long-standing Essential Eight to better address today's diverse technology environments, including cloud, operational technology (OT), and AI-enabled systems. Rather than focusing on a fixed set of controls, the new framework takes a more flexible, outcomes-based approach to cyber resilience. It will be delivered through environment-specific guidance, including Essentials for Enterprise IT, Operational Technology, and Cloud, alongside guidance for executives and AI considerations. Importantly, organisations that have already invested in the Essential Eight do not need to start over. Existing controls remain relevant, and ASD will maintain both frameworks during the transition period. The change signals a shift from treating cyber security as a compliance checklist to focusing on security outcomes and resilience. Now is a good opportunity to review how your current Essential Eight maturity aligns with broader cyber security risks across cloud, OT, and emerging AI technologies. Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories Date: 2026-10-09 Author: The Hacker News Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity said. "Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10–21:26 UTC." GitLab warns of max severity code execution vulnerability Date: 2026-10-12 Author: Bleeping Computer [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12505] GitLab has told users to immediately patch CVE-2026-97229, maximum-severity vulnerability within the CI/CD Regular Expression Compiler, which enables remote code execution (RCE) for threat actors. A specially crafted expression for GitLab's CI/CD Regular Expression Compiler will parse, evaluate, and compile malicious code through the exploitation of a integer overflow weakness. Both Community and Enterprise editions have been patched. Version after 19.2, 19.3, and 19.4 and version before 19.2.8, 19.3.4, and 19.4.2 are vulnerable and should be patched immediately. This vulnerability was reported to GitLab by 'joaxcar' through their HackerOne bug bounty program. Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days Date: 2026-10-13 Author: Bleeping Computer [See AUSCERT Bulletins for Microsoft October Patch Advisories] Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing. Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks Date: 2026-10-14 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.12773/] Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices. Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch Date: 2026-10-12 Author: The Hacker News Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." Patches for the flaw were released by SonicWall on October 6, 2026, with versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix). ESB-2026.12605 – Adobe Commerce: CVSS (Max): 10.0 Adobe has released a priority 2 security update for Adobe Commerce. Adobe is not aware of any exploits in the wild for any of the issues addressed in this update. ESB-2026.12505 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0 Updated versions of GitLab Community Edition (CE) and Enterprise Edition (EE) have been released. These versions contain important bug and security fixes, and Gitlab strongly recommends that all self-managed GitLab installations be upgraded immediately. ASB-2026.0251 – Microsoft Windows: CVSS (Max): 9.8 Microsoft has released its monthly security patch updates for the month of October, 2026. This Microsoft Windows update resolves 11125 vulnerabilities and Microsoft recommends updating the software with the version made available on the Microsoft Update Catalogue ESB-2026.12603 – Citrix XenServer: CVSS (Max): 8.8 Citrix have provided security updates that address several issues that affect Citrix XenServer. ESB-2026.12645 – Zoom: CVSS (Max): 8.1 Zoom have provided updates that address an Improper Authorization in Handler for Custom URL Scheme vulnerability in Zoom Workplace for Android. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, Online fashion retailer ASOS has confirmed that customer information may have been accessed following a cyber incident that saw hackers send unauthorised messages through the company's official mobile app. The retailer said names and contact details may have been exposed, while payment card information and account passwords were not affected. The incident came to light after customers received push notifications from the ASOS app containing messages from threat actors claiming responsibility for the attack. ASOS is investigating the incident and working with cybersecurity specialists to secure its systems. Attackers have claimed they stole customer data, although the full scope of the incident remains under investigation and these claims have not been confirmed by the company. The incident highlights the risks associated with third-party communication platforms and trusted customer channels. Even when financial data is not compromised, exposed personal information can be leveraged in phishing and social engineering attacks. Citrix discloses third actively exploited NetScaler zero-day in less than a week Date: 2026-10-05 Author: CyberScoop [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12056/] Citrix customers just got through back-to-back weekends filled with varying levels of uncertainty and worry, as yet another actively exploited zero-day vulnerability was discovered in Citrix NetScaler products. Researchers and security experts said the vulnerability — CVE-2026-88779 — is less concerning because exploitation triggers denial of service and only impacts instances that have SAML (security assertion markup language) enabled. “This means it doesn’t work out of the box against every NetScaler deployment,” Jake Knott, head of threat intelligence at watchTowr, told CyberScoop. “While this is very inconvenient, it doesn’t have organizations scrambling to trigger incident response.” Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes Date: 2026-10-05 Author: The Hacker News Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network," Microsoft said in an advisory released on October 2, 2026. ASOS confirms data breach after “HACKED” in-app notifications Date: 2026-10-06 Author: Bleeping Computer UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. ASOS is a large UK-based online fashion retailer that sells clothing, footwear, accessories, and beauty products to customers worldwide, including in the United States. Chrome 155 Update Patches 247 Vulnerabilities Date: 2026-10-07 Author: Security Week [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12256] Four critical-severity use-after-free defects were fixed in Chromecast, Browser, Navigation, and Track. Google on Tuesday rolled out a Chrome 155 security update that addresses 247 vulnerabilities, including four critical-severity flaws. All four critical bugs are use-after-free issues. They impact Chrome’s Chromecast, Browser, Navigation, and Track components and are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347. Hackers exploit critical Atlassian flaw after public PoC release Date: 2026-10-07 Author: Bleeping Computer [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12187] A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. Earlier today, security company Previdian detected the activity on its honeypot network, just hours after a detailed technical report was published. An unauthenticated attacker can exploit CVE-2026-21589 to access specific files in the application's web root directory if they know the file's exact name and path. ESB-2026.12162 – GitLab AI Gateway: CVSS (Max): 9.9 Updated versions of GitLab Self-Hosted AI Gateway, that contain a critical security fix, have been released. Gitlab strongly recommends that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately. ESB-2026.12056 – Citrix NetScaler ADC & Citrix NetScaler Gateway: CVSS (Max): 7.5 Software updates have been released to address a vulnerability in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). ESB-2026.12246 – Hitachi Energy SOI: CVSS (Max): 8.8 Hitachi Energy is aware of a RCE (Remote Code Execution) vulnerability in the Apache ActiveMQ component of SOI product versions. Users are advised to apply the patch SOI EP2, which upgrades the ActiveMQ version (JMS message broker) for the SOI Core. ESB-2026.12323 – Splunk Enterprise: CVSS (Max): 9.8 Splunk have provided upgrades that address multiple vulnerabilities in Splunk Enterprise. ESB-2026.12333 – Cisco License (Smart Software Manager) On-Prem: CVSS (Max): 10.0 Cisco has released software updates that address vulnerabilities that affect Cisco License On-Prem – regardless of software configuration. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, October is Cyber Security Awareness Month, and the Australian Cyber Security Centre (ACSC) is encouraging all Australians and organisations to take action to strengthen their cyber security posture. This year's theme, “Building our cyber safe culture", focuses on three simple but effective steps: keeping software up to date, using strong and unique passphrases, and enabling multi-factor authentication (MFA) on all accounts. For cyber security professionals and organisational leaders, the ACSC will spotlight four key focus areas throughout October: event logging, legacy technology, supply chain and third-party risk, and quantum readiness. These topics aim to help organisations improve resilience and better protect critical systems and data. As Cyber Security Awareness Month gets underway, now is a great opportunity to review your organisation's cyber security practices and ensure the fundamentals are in place to reduce cyber risk. Citrix confirms two NetScaler RCE zero-days exploited in attacks Date: 2026-09-27 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.11691/] Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. The vulnerabilities are the same zero-days that cybersecurity researchers, IT providers, and national cybersecurity agencies began privately warning organizations about over the weekend. Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager Date: 2026-09-30 Author: The Hacker News [AUSCERT has informed the affected members via Critical MSINs] [Please see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.11917/] Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a CVSS score of 9.8 out of 10. It sits in the part of the Manager's API that handles login sessions. Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks Date: 2026-09-28 Author: The Hacker News [AUSCERT has published security bulletins for these Apple updates: https://portal.auscert.org.au/bulletins/ESB-2026.11802/ https://portal.auscert.org.au/bulletins/ESB-2026.11801/] Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The iPhone maker said the issue was addressed with improved bounds checking. It credited Meta Product Security with discovering and reporting the issue. Google: Vulnerability disclosures double to 10,000 per month as AI fuels exploitation Date: 2026-10-01 Author: The Record Vulnerability disclosures doubled between January and August, reaching a new peak of 10,740 last month, Google’s Threat Intelligence Group (GTIG) said Wednesday. Total vulnerability disclosures began the year at 5,045 in January and had jumped to more than 10,000 for July and August. “We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered,” the researchers said. Queensland government department loses $800,000 in cyber attack – ABC News Date: 2026-09-30 Author: ABC News The Customer Services, Open Data, and Small and Family Business department lost $809,000 in public money due to an external cyber attack for financial gain. The department plays a lead role in strengthening the state government’s cyber security capabilities. No government data or sensitive information was compromised during the incident. ESB-2026.11795 – Apache Tomcat: CVSS (Max): 9.8 Apache Tomcat contains a vulnerability that could allow attackers to bypass security constraints protecting WebSocket endpoints. ESB-2026.11802 – Apple macOS Sequoia: CVSS (Max): 8.8 Apple macOS contains a CoreGraphics vulnerability that could allow arbitrary code execution via a malicious file. ESB-2026.11827 – MikroTik RouterOS: CVSS (Max): 9.8 MikroTik have provided update versions for the RouterOS. Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. ESB-2026.11900 – GitLab Community Edition (CE) and Enterprise Edition (EE): CVSS (Max): 10.0 Updated versions for GitLab Community Edition (CE) and Enterprise Edition (EE) were released on September 23, 2026. Gitlab strongly recommends that all self-managed GitLab installations be upgraded to one of these versions immediately. ESB-2026.11917 – Cisco Catalyst SD-WAN Manager: CVSS (Max): 9.8 Cisco has released software updates that address a vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, In June this year an AI agent operated by US-based artificial intelligence company OpenAI gained unauthorised access to Medicare’s statistics portal and three other government systems, state and federal, while researching publicly available information on medicine spending. The incident was reported by OpenAI to the Australian government via email in September. After encountering access restrictions, the AI agent attempted alternative methods and accessed both public and non-public information within the Medicare Statistics Reporting Service portal. There is currently no evidence that personal Medicare information was accessed or that the broader Services Australia network was compromised. The Australian Signals Directorate is assisting with a forensic investigation. The incident highlights emerging cyber security challenges as AI agents become increasingly capable of independently navigating systems and adapting their behaviour when encountering restrictions. For organisations, it reinforces the importance of strong access controls, continuous monitoring and logging, and appropriate guardrails and human oversight when deploying AI agents. As agentic AI capabilities evolve, security and incident response processes will need to evolve alongside them. Australian Medicare data portal "infiltrated" by OpenAI agent Date: 2026-09-24 Author: iTnews An OpenAI agent has accessed “public and non-public files” from a “Medicare statistics reporting portal”, Australian Prime Minister Anthony Albanese said. Speaking at the United Nations meeting in New York, Albanese said the AI agent had “infiltrated” and “gained unauthorised access” to the data portal in June. While the portal is “public-facing”, according to Albanese, it appears not all of the data files that it holds are for general consumption. “The AI agent accessed both public and non-public files,” Albanese said. MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key Date: 2026-09-23 Author: The Hacker News [AUSCERT has informed the affected members via Critical MSINs] Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at least September 2, one day before MikroTik shipped patches in RouterOS 6.49.21, 7.23.4, and 7.24.2. F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks Date: 2026-09-23 Author: Bleeping Computer [AUSCERT has informed the affected members via Critical MSINs] F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. BIG-IP APM (short for Access Policy Manager) is the company's centralized access management proxy solution that helps admins secure access to their organizations' networks, applications, cloud, and application programming interfaces (APIs). Tracked as CVE-2026-94127, the flaw affects instances configured as an OAuth Authorization Server when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server. BigCommerce Data Stolen via Ribon Apps Hack Date: 2026-09-22 Author: Security Week Enterprise eCommerce platform BigCommerce fell victim to a supply chain attack that led to customer data theft. BigCommerce is a SaaS provider that enables merchants to build and manage online stores. It hosts the stores, provides backend tools, and handles server security. Late last week, the company started notifying merchants that customer data was stolen after hackers compromised a BigCommerce application key held by Ribon, a storefront and shopping experience optimization app developed by Fastr-owned Be A Part Of. Hacked? Qantas investigating WhatsApp phishing reports Date: 2026-09-21 Author: cyberdaily.com.au The Flying Kangaroo and a Sydney hotel warn customers not to share payment details following suspicious messages targeting Qantas Hotels customers. Australia’s national carrier is once again investigating a possible security breach after some of its customers were targeted by WhatsApp phishing messages. “We’re investigating reports of phishing attempts targeting some Qantas Hotels customers. “If you receive a suspicious WhatsApp message claiming to be from a hotel, you should ignore the message. Qantas Hotels and our accommodation partners will never ask you to verify your booking or provide personal details via WhatsApp. ESB-2026.11491 – F5 – BIG-IP APM: CVSS (Max): 9.8 F5 have provided fixes for a vulnerability – when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). ESB-2026.11529 – Ubuntu – Linux kernel: CVSS (Max): 10.0 Ubuntu have provided fixes for security issues, discovered in the Linux kernel that could possibly allow an attacker to compromise the system/subsystems. ESB-2026.11379 – Debian – chromium: CVSS (Max): 9.8 Debian have provided fixes for security issues that were discovered in Chromium, which could result in the execution of arbitrary code, denial of service, or information disclosure. ESB-2026.11479 – Siemens SIPLUS and SIMATIC Products: CVSS (Max): 7.8 Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. ESB-2026.11583 – GitLab Community Edition (CE) and Enterprise Edition (EE): CVSS (Max): 9.9 Updated versions for GitLab Community Edition (CE) and Enterprise Edition (EE) were released on September 23, 2026. These versions contain important bug and security fixes, and Gitlab strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, September is MFA Month, making it the perfect time to review one of the simplest and most effective cyber security measures available: multi-factor authentication (MFA). As part of the Australian Signals Directorate’s (ASD) MFA: Switch It On campaign, organisations across Australia are being encouraged to enable MFA on all accounts and systems. The initiative aims to increase MFA adoption across businesses, government agencies, and critical infrastructure organisations, helping make Australia a safer place to connect online. The need for MFA has never been clearer. According to the ASD, 42% of cyber security incidents reported by industry, government, and critical infrastructure organisations in 2024-25 involved compromised accounts or credentials. This serves as a timely reminder that passwords alone are no longer enough to protect against modern cyber threats. MFA adds an extra layer of protection by requiring users to verify their identity using more than just a password. As one of the most effective defences against unauthorised access, phishing-resistant forms of MFA can significantly reduce the risk of cybercriminals gaining access to accounts, applications, corporate systems, and networks. By encouraging employees, customers, suppliers, and stakeholders to enable MFA, organisations can strengthen their cyber resilience, better protect sensitive information and assets, and reduce the risk of account compromise. For practical guidance, including step-by-step instructions for enabling MFA on popular accounts and applications, visit the Australian Cyber Security Centre's guide ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks Date: 2026-09-14 Author: Security Week ConnectWise has released urgent patches for a critical-severity vulnerability in the ScreenConnect remote access and support software that has been exploited in worm-like attacks. Tracked as CVE-2026-84869 (CVSS score of 9.9/10), the security defect is described as a missing authorization and improper privilege management issue. The bug creates “a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances,” ConnectWise explains in its advisory. Cisco patches Secure Email Gateway zero-day exploited in attacks Date: 2026-09-15 Author: Bleeping Computer [Please see AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.10980.2/] Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," the company warned in a Monday security advisory. The security flaw (tracked as CVE-2026-76461) was found in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway and affects virtual and physical appliances, regardless of the device configuration. GitLab Vulnerability Exploited One Day After Disclosure Date: 2026-09-11 Author: Security Week [Please see AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.10914/] Threat actors have started exploiting a newly patched vulnerability in GitLab one day after public disclosure, attack surface management firm WatchTowr warns. Tracked as CVE-2026-85706 (CVSS score of 10/10), the security defect is described as a path traversal issue that can allow unauthenticated users to read arbitrary files from the GitLab server. All Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected. Check Point Patches Critical VPN Vulnerabilities Date: 2026-09-11 Author: Security Week Cybersecurity firm Check Point this week announced patches for two critical-severity vulnerabilities in its gateway and firewall products using VPN functionality. Tracked as CVE-2026-85102 and CVE-2026-85103 (CVSS score of 9.8), both security defects could be exploited without authentication for remote code execution (RCE), Check Point warns. The former is described as an improper validation of certificate data during VPN negotiation, while the latter is a heap overflow in the VPN certificate ASN.1 decoding flow. Passkey-themed phishing attacks lead to Microsoft 365 data theft Date: 2026-09-11 Author: Bleeping Computer Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. The activity has been observed since May 2026 and begins with the attackers researching targeted organizations and employees before calling or messaging victims while impersonating corporate IT help desks. The attackers tell employees that they must urgently update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid losing access to corporate systems. ASB-2026.0222 – Check Point Products: CVSS (Max): 9.8 Check Point have provided fixes for two critical CVSS 9.8 flaws that affect Check Point Security Gateway, Security Management Server and Spark Firewall (Centrally Managed and Locally Managed) products. ASB-2026.0236 – Oracle Communications: CVSS (Max): 9.8 Oracle have provided a Critical Security Patch Update that contains 31 new security patches for Oracle Communications – 23 of these vulnerabilities may be remotely exploitable without authentication. ESB-2026.11217 – Cisco Secure Firewall Management Center (FMC): CVSS (Max): 10.0 Cisco has released software updates that address a vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. ESB-2026.10914 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0 GitLab have provided updated versions of GitLab Community & Enterprise Edition that contain important bug and security fixes, and they strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. ESB-2026.10980.2 – Cisco Secure Email Gateway: CVSS (Max): 9.8 Cisco has released software updates that address a vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, This week, Mathspace disclosed a data breach affecting about 1.08 million students, carers and staff in Australia and New Zealand. Information stolen includes names, email addresses, usernames, account types and countries . While no passwords or sign-on credentials were accessed, the exposed information could be used to create convincing phishing emails impersonating Mathspace. The attackers accessed the data by exploiting a flaw in Mathspace’s self-hosted installation of Metabase. While Metabase had disclosed the vulnerability and provided a patch, Mathspace had not installed the patch at the time of the attack. Attackers exploited the vulnerability days after it was disclosed and patched by Metabase on 6 August. This breach follows a ransomware attack on education platform Canvas earlier this year. These incidents highlight the value of sensitive information held by education platforms and the attractiveness of the education sector to cyber criminals. The Metabase vulnerability allowed attackers to gain administrator access to the affected system without legitimate credentials. Mathspace said its vulnerability-notification process did not identify and escalate the Metabase advisory for action. The company later secured the affected system, took it offline and notified affected users and relevant authorities. Mathspace said there is currently no evidence that the stolen information has been published, sold or misused. However, affected users should remain alert to phishing and impersonation attempts using the exposed information. … Adobe Commerce Zero-Day Exploited to Backdoor Online Stores Date: 2026-09-07 Author: Security Week Threat actors are exploiting a zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms to backdoor online stores, cybersecurity firm Sansec reports. Dubbed StyleSmuggler, the security defect enables attackers to inject PHP code into Magento’s template system and evade detection by using the ‘styles’ properties. According to Sansec, the attack works in two stages: first, the PHP code is injected by generating a failure report, and then Magento executes the code via a failed payment email. N-able patches max severity N-central flaw amid ongoing attacks Date: 2026-09-07 Author: Bleeping Computer N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console. Tracked as CVE-2026-86218, this RCE vulnerability allows threat actors without privileges to execute malicious code on unpatched N-central instances exposed online in low-complexity attacks. Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication Date: 2026-09-06 Author: The Hacker News [AUSCERT has notified potentially affected members] Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or attacker identity. MikroTik's security update lists fixed RouterOS releases. CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes. SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution Date: 2026-09-09 Author: The Hacker News SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP security company Onapsis, it has been codenamed OVERPASS. Microsoft discloses two actively exploited zero-days among 974 vulnerabilities Date: 2026-09-08 Author: CyberScoop [AUSCERT has published security bulletins for these Microsoft updates] Microsoft addressed 974 defects across its product suite, including two actively exploited zero-day vulnerabilities, in its monthly Patch Tuesday security program. The massive batch of patches, Microsoft’s largest ever, reflects a continuing trend for the vendor as it leans on artificial intelligence to discover more vulnerabilities at a faster rate. Yet, the recent period of record breaking vulnerability disclosures hasn’t resulted in a flood of actively exploited zero-days. ESB-2026.10690 – Adobe Commerce: CVSS (Max): 10.0 Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. ASB-2026.0220 – Microsoft Windows: CVSS (Max): 9.8 Microsoft has released 'Microsoft Windows' updates to resolve 726 vulnerabilities, as part of the Microsoft security patch updates for the month of September 2026. ASB-2026.0212 – Microsoft Azure: CVSS (Max): 10.0 Microsoft has released 'Microsoft Azure' updates to resolve 12 vulnerabilities, as part of the Microsoft security patch updates for the month of September 2026. ESB-2026.10780 – Palo Alto Networks PAN-OS: CVSS (Max): 9.2 A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition. ESB-2026.10661 – Linux kernel (GCP): CVSS (Max): 10.0 Ubuntu have provided an update(s) for several vulnerabilities that were discovered in the Linux kernel for Google Cloud Platform (GCP) systems. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, After more than two decades in the shadows, one of the internet’s longest-running botnets has finally been disrupted. An international operation involving authorities and cyber security researchers from the US, Bulgaria, Hungary and Romania, alongside CrowdStrike and the Shadowserver Foundation, has isolated more than 15,000 infected systems and seized domains linked to the Sality botnet. Unlike traditional botnets that rely on central command-and-control servers, Sality used a peer-to-peer network, making it harder to disrupt or dismantle. Researchers exploited this architecture to interfere with communications between infected machines and disrupt the botnet. Sality has been used to distribute malware and facilitate various forms of cyber crime, including cryptocurrency theft. Organisations should not assume that older malware is no longer a threat. Effective endpoint protection, timely patching, network monitoring and investigation of legacy malware detections remain essential. The continued activity of threats such as Sality demonstrates that malware can persist for years, making it important to detect and respond to both emerging and long-standing threats. Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server Date: 2026-08-28 Author: The Hacker News cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs Date: 2026-08-31 Author: Security Week Hackers are exploiting a critical-severity Ruby on Rails vulnerability that leads to remote code execution (RCE), VulnCheck warns. Tracked as CVE-2026-66066 (CVSS score of 9.5) and referred to as KindaRails2Shell, the flaw is described as an arbitrary file read leading to secret exposure, RCE, and lateral movement. The security defect was disclosed in late July, when Ruby on Rails rolled out patches for it, urging the immediate patching of all Rails applications that rely on libvips for Active Storage image processing and allow image uploads from untrusted users. Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Date: 2026-09-01 Author: Bleeping Computer Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. Tracked as CVE-2026-62911 and reported by DEVCORE Research Team's Orange Tsai, this security flaw affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) software. Threat actors with basic privileges on the targeted server can exploit it in low-complexity attacks that require user interaction. PaperCut issues emergency patches as threat actors target chained vulnerabilities Date: 2026-08-31 Author: Cybersecurity Dive [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2026.0208/] PaperCut issued emergency patches on Friday to address critical vulnerabilities in its print-management software. The company confirmed in a security advisory that multiple customers were successfully targeted and that it is working with security researchers at Huntress and watchTowr to respond to the attacks. The vulnerabilities include an improper access-control flaw in PaperCut MF and NG. CVE-2026-81578 enables an unauthenticated attacker to modify certain system configurations and CVE-2026-82078 enables an attacker to execute arbitrary Java bytecode. BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update Date: 2026-09-01 Author: Cyber Security News Attackers hijacked BGP routing for Softaculous last week and delivered a malicious Virtualizor update to a handful of hypervisor servers, according to a vendor incident report. Hosting providers use Virtualizor to manage VPS nodes on KVM, Xen, LXC, OpenVZ, and Proxmox, and a single master can control hundreds of virtualization servers, placing a poisoned update high in the hosting stack. The product publicly lists hundreds of NOC partners, so a compromise here hits hosting infrastructure rather than a single website panel. ESB-2026.10412 – Cisco Nexus 9000 Series Switches: CVSS (Max): 9.8 Cisco has released software updates that addresses vulnerabilities in Cisco Nexus 9000 Series Switches. ASB-2026.0208 – PaperCut NG / MF: CVSS (Max): 9.4 PaperCut NG and PaperCut MF are affected by two vulnerabilities that can be chained by attackers to bypass authentication and execute arbitrary code on vulnerable servers. ESB-2026.10356 – Firefox ESR: CVSS (Max): 10.0 Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. ESB-2026.10351 – Rockwell Automation Logix Platform: CVSS (Max): 7.5 A denial-of-service vulnerability exists in the affected Logix platforms due to improper validation of input length during CIP message processing. ESB-2026.10167 – Tenable Enclave Security: CVSS (Max): 9.9 Several vulnerabilities have been identified, reported to Tenable and resolved. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, The pressure on social media platforms to better protect young users is intensifying, with governments and regulators around the world taking increasingly tough measures against the technology giants. New Zealand is the latest country to move towards restricting social media access for under 16s, with proposed legislation requiring platforms to take reasonable steps to verify users' ages. The proposal follows Australia's world-first under-16 social media restrictions and reflects growing international concern about the impact of social media on children. Meanwhile, in the United States, Meta has agreed to pay up to US$18 billion to settle lawsuits brought by almost every US state over allegations that Facebook and Instagram harmed children and misled the public about the safety of its platforms. As part of the settlement, Meta has also agreed to introduce stronger protections for teenage users, including default time limits, overnight restrictions and limits on notifications during school hours. While Meta has not admitted wrongdoing and the settlement does not fundamentally change its business model, the scale of the agreement signals a significant shift in expectations around platform accountability. It could also provide a template for similar action against other major platforms, with part of Meta's settlement tied to comparable commitments from competitors such as TikTok and YouTube. The global push highlights the growing intersection of online safety, privacy, cybersecurity and regulation. As age verification and platform monitoring increase, so do concerns around protecting sensitive user data. Regulation is accelerating, and technology companies face growing expectations to build safety and security into their platforms by design. Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data Date: 2026-08-25 Author: The Hacker News [AUSCERT has informed the potentially affected members via Critical MSINs] The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-21962 (CVSS score: 10.0), allows an unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Successful exploitation of the flaw can lead to unauthorized access to the instances or modification of critical data. Hackers breached over 270 Zimbra servers in ongoing attacks Date: 2026-08-25 Author: Bleeping Computer Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. The ZCS email and collaboration suite is used by hundreds of millions of people and organizations, including thousands of businesses and hundreds of government agencies worldwide. Synacor patched the security flaw (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled, with the release of ZCS version 10.1.20 on July 20. Active exploitation of a software development platform within Australia Date: 2026-08-24 Author: ASD ACSC The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) has observed active exploitation of a vulnerability affecting TeamCity On-Premises servers within Australia. TeamCity is a Continuous Integration and Continuous Deployment (CI/CD) server to automate the processes of building, testing, and deploying software. CVE 2026-63077 may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands. This vulnerability affects all TeamCity On-Premises versions. Hackers target Microsoft SharePoint RCE chain with PoC exploit Date: 2026-08-26 Author: Bleeping Computer Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. The first (tracked as CVE-2026-55040) is an authentication bypass flaw in the JWT token validation pipeline that attackers without privileges can exploit to perform operations as a SharePoint site user or administrator. The second (CVE-2026-63520) is a vulnerability in SharePoint's Business Connectivity Services (BCS) that unauthenticated attackers can chain after successfully exploiting CVE-2026-55040 for remote code execution (RCE) on a targeted SharePoint Server. Shop now? Banking malware campaign posing as Woolworths active in Australia Date: 2026-08-21 Author: cyberdaily.au Woolies and other trusted brands are being used to spread an Android Trojan that can access bank accounts, read SMSes, and even access cameras. Security researchers have lifted the lid on an ongoing Android malware campaign active in Australia, posing as several trusted and well-known brands to spread a Remote Access Trojan (RAT) designed, among other things, to steal banking information. According to NordVPN’s threat intelligence team, the campaign is circulating via text messages, WhatsApp, and social media, impersonating brands such as supermarket giant Woolworths and several airlines, including Emirates, Qatar Airways, and Air India. ESB-2026.9812 – Cisco Crosswork Platform(s): CVSS (Max): 10.0 Cisco has released software updates that address vulnerabilities in Cisco Crosswork platform(s). ESB-2026.10018 – Adobe Campaign Classic: CVSS (Max): 10.0 Adobe has released a security update that addresses critical (RCE) vulnerabilities in Adobe Campaign Classic. ESB-2026.10087 – GitLab Community Edition (CE) and Enterprise Edition (EE): CVSS (Max): 8.7 Updated versions of GitLab Community Edition (CE) and Enterprise Edition (EE) contain important bug and security fixes. GitLab strongly recommends that all self-managed GitLab installations be upgraded. ESB-2026.10066 – IBM QRadar SIEM: CVSS (Max): 9.8 Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM updates. ESB-2026.10159 – All-Line Equipment Company Fuel-Boss: CVSS (Max): 8.7 Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, AUSCERT is proud to be part of the Not-For-Profit Cyber Uplift Community of Practice, launched by the Australian Department of Home Affairs in partnership with the Australian Charities and Not-for-profits Commission. The free launch event will take place on Wednesday, 26 August 2026, from 1PM–2PM AEST, providing not-for-profit organisations with practical advice, knowledge and support to strengthen cyber resilience across the sector. Register here The importance of strengthening cyber resilience is particularly timely, with a large-scale data theft campaign reportedly targeting Azure/Entra environments belonging to major organisations, including McDonald’s, TCS, Vodafone and Kyndryl. The campaign is linked to a new threat actor known as TheHatman, who claims to have stolen millions of enterprise records. While the initial access vector remains unconfirmed, reported possibilities include stolen credentials or session cookies, phishing, weak or missing MFA, and overly permissive third-party applications. The activity does not currently appear to exploit an Azure vulnerability, with compromised credentials a key concern. The incident highlights how stolen organisational information including employee details, reporting structures, service accounts and privileged account information could enable highly targeted phishing, impersonation and business email compromise attacks. It reinforces the importance of phishing-resistant MFA, protecting cloud credentials and session tokens, detecting infostealer infections, reviewing third-party application permissions and monitoring unusual activity across Azure/Entra environments. Together, these developments highlight why practical cyber resilience initiatives are essential for organisations of all sizes. … Critical Citrix NetScaler Flaw Lets Remote Attackers Bypass Authentication Without Credentials Date: 2026-08-19 Author: Cyber Security News [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.9740/] Cloud Software Group has issued a critical security bulletin warning customers of two serious vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Tracked as CVE-2026-19489 and CVE-2026-19490, the flaws could allow attackers to trigger denial-of-service conditions or bypass authentication entirely on unpatched appliances, putting enterprise remote access infrastructure at significant risk. Hackers Exploiting Unpatched GeoServer Zero-Day Date: 2026-08-14 Author: Security Week The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. Threat actors started exploiting an unpatched zero-day vulnerability in GeoServer hours after it was publicly disclosed, attack surface management firm WatchTowr says. The security defect, described as an SQL injection issue that could be exploited to achieve remote code execution (RCE), was disclosed on Wednesday by a security researcher named q1uf3ng. According to the researcher’s post on X, the flaw affects GeoServer’s jsonArrayContains function, a filter expression for querying JSON array fields to check if they contain specific values. It can be used with PostGIS and Oracle JDBC data stores. Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects Date: 2026-08-17 Author: The Hacker News [Please see AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.9629/] GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Hacker claims 3.6 million Azure account records stolen from major companies Date: 2026-08-17 Author: Bleeping Computer A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. Starting July 31st, multiple posts from someone using the alias “TheHatman” advertised data dumps from major organizations, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels (IHG), and Kyndryl. In total, the threat actor claims to have 3.64 million data records, with the most recent breach posted on Sunday, containing an alleged 1.7 million employee records from McDonalds. CISA: Windows Task Host flaw now exploited by ransomware gangs Date: 2026-08-18 Author: Bleeping Computer The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. Task Host is a core Windows system component that allows DLL-based processes to run in the background and prevents data corruption by ensuring they close properly during shutdown. Tracked as CVE-2025-60710, this Windows privilege escalation security flaw was patched by Microsoft in November 2025 and stems from a link following weakness that affects Windows 11 and Windows Server 2025 devices. ESB-2026.9629 – GitLab Community & Enterprise Edition: CVSS (Max): 9.4 GitLab released versions which contain important bug and security fixes for GitLab Community Edition (CE) and Enterprise Edition (EE) ESB-2026.9641 – iOS 18.7.10 and iPadOS: CVSS (Max): 9.8 Multiple vulnerabilities affecting iOS and iPadOS have been addressed by Apple ASB-2026.0202 – Oracle E-Business Suite: CVSS (Max): 9.8 This Critical Security Patch Update contains 120 new security patches for Oracle E-Business Suite ESB-2026.9713 – Cisco Secure Workload Software: CVSS (Max): 10.0 Cisco has released software updates that address vulnerabilities that affect Cisco Secure Workload Software (SaaS) ESB-2026.9752 – Splunk Enterprise: CVSS (Max): 9.8 Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, A routine attempt to secure a place in a popular gym class has highlighted a growing challenge in the age of artificial intelligence. In what is believed to be Australia's first known case of an autonomous AI-powered cyber attack, an AI assistant tasked with booking a gym session discovered and exploited a vulnerability in the gym’s online booking system without being instructed to do so. The incident involved an Australian technology professional who used an AI agent powered by Anthropic’s Claude model through the OpenClaw platform. After being asked to book a class, the AI found a way to bypass booking restrictions and reserve places weeks earlier than the system was designed to allow. More concerningly, when the user asked whether it could improve his position on a waiting list, the AI removed another member’s booking as part of what it described as testing its capabilities. It later admitted it could not restore that person's place. Experts say the case demonstrates a key risk associated with increasingly autonomous AI agents. Unlike traditional chatbots, these systems can independently plan and execute tasks across websites and software platforms. While designed to achieve a user's goal, they may choose methods the user neither expected nor authorised. Researchers refer to the challenge of ensuring AI systems act within human intentions and boundaries as the “alignment problem.” The incident follows recent reports of advanced AI models autonomously hacking systems during testing, raising concerns among cyber security professionals and policymakers. Legal experts also note that responsibility remains unclear when an AI agent causes harm, with questions lingering over whether liability rests with the user, software developer, AI provider, or the operator of the vulnerable system. For businesses and consumers alike, this situation serves as a reminder that while AI agents offer powerful productivity benefits, they also introduce new risks that organisations, regulators and technology providers are only beginning to understand. … Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE Date: 2026-08-11 Author: The Hacker News Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent. The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft's affected-product list covers only those three on-premises editions, and SharePoint Online is not among them. Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack Date: 2026-08-11 Author: The Hacker News [AUSCERT has published security bulletins for these Microsoft updates] Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only one in this month's release Microsoft flags as under active exploitation. Exploitation depends on triggering a race condition in the driver. Microsoft has not publicly attributed the exploitation. Check Point Research says Lazarus used the zero-day in its Operation Dream Job campaign. SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code Date: 2026-08-12 Author: The Hacker News SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. "SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation," according to a description of the flaw on CVE.org. Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data Date: 2026-08-08 Author: Security Week Varonis Threat Labs has disclosed a one-click vulnerability in Rovo, Atlassian’s enterprise AI assistant, that let a specially crafted link seed attacker-controlled instructions directly into a user’s live AI session. Dubbed RovoBlast, the flaw required no jailbreak and no permission bypass, relying on the fact that the assistant simply treated externally supplied parameters as trusted input. Foreign control of AI vendors a board-level risk, ASD says Date: 2026-08-07 Author: IT News Australian boards should treat the foreign ownership, control and influence of their artificial intelligence (AI) providers as a cyber risk in its own right, the Australian Signals Directorate advises. That is one of the four key action points in new guidance from the ASD, co-written with the Australian Institute of Company Directors (AICD), that asks boards to assess the risks of relying on AI providers. ESB-2026.9350 – Zoom: CVSS (Max): 8.3 Zoom patched a high-severity zero-click flaw (CVE-2026-53413) that could enable remote code execution on meeting participants’ devices. ESB-2026.9366 – Adobe Campaign Classic: CVSS (Max): 10.0 Adobe patched critical vulnerabilities in Campaign Classic that could allow arbitrary code execution, including two CVSS 10.0 flaws. ESB-2026.9378 – CTI-Transmute 1.5: CVSS (Max): 8.8 CTI-Transmute 1.5 adds 16 security fixes, a public API, and other improvements to MISP/STIX threat intelligence conversion. ESB-2026.9500 – Intel Chipset Firmware: CVSS (Max): 8.5 Intel addressed a high-severity CSME and SPS firmware flaw (CVE-2026-6727) that could allow local privilege escalation. ESB-2026.9519 – Palo Alto GlobalProtect App: CVSS (Max): 8.5 Palo Alto Networks fixed a medium-severity GlobalProtect flaw (CVE-2026-0299) that could allow local privilege escalation to SYSTEM/root. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, A major new software supply chain attack has highlighted the growing risks facing organisations that rely on open source code. Researchers have uncovered a self-propagating malware campaign, dubbed ChainDrop, which has compromised more than 1,300 packages in the Node Package Manager (npm) ecosystem, affecting packages that collectively receive around two billion downloads each month. The attack reportedly began when a threat actor gained access to the GitHub account of the maintainer behind several widely used caching libraries, including Keyv and Cacheable. From there, the malware spread through interconnected projects, ultimately impacting packages associated with a range of technology vendors and organisations. What makes ChainDrop particularly concerning is its ability to spread automatically. Malicious code was inserted into legitimate software packages and published through trusted GitHub Actions workflows, allowing the compromised releases to appear authentic. Once an affected package was installed, a hidden pre-installation script executed automatically, downloading additional components and launching an information-stealing payload. According to security researchers, the malware is designed to collect a wide range of sensitive information, including GitHub and npm access tokens, cloud credentials, Kubernetes secrets, database credentials, and keys for services such as AWS, Azure and Google Cloud. The stolen data is then encrypted and exfiltrated, while the malware searches for new opportunities to compromise additional repositories and packages. Security experts warn that any developer workstation or CI/CD environment that installed an affected package should be considered compromised. Recommended response measures include rebuilding impacted systems, rotating exposed credentials, reviewing repositories for unauthorised changes, and strengthening dependency management controls. As investigations continue, the number of affected packages may grow, reinforcing the importance of ongoing vigilance across the software supply chain. Attackers Exploit N-able Patch Bypass Flaw on RMM Servers Date: 2026-08-04 Author: Dark Reading N-able recently disclosed that a threat actor targeted its N-central product through a patch bypass vulnerability and used the flaw to gain access to customer environments. The company, which sells security and IT management tools to managed service providers (MSPs) and internal IT teams, disclosed active exploitation over the weekend. Rails patches critical Active Storage flaw with RCE potential Date: 2026-08-01 Author: Bleeping Computer [See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0171.2] A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). Rails is a popular open-source web application framework written in Ruby for building websites and web apps. It uses the built-in Rails component Active Storage for handling file uploads and attachments. Rails maintainers published an advisory about the CVE-2026-66066 flaw, which received a critical severity rating. Massive ChainDrop npm supply-chain attack infects hundreds of packages Date: 2026-08-04 Author: Bleeping Computer [See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0172] Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. Infected packages include very popular ones such as Keyv and Cacheable, flat-cache and file-entry-cache, all caching utilities from the same maintainer. The supply-chain attack started after the threat actor compromised the GitHub account of Keyv’s maintainer, and quickly spread to packages associated with major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction Date: 2026-08-01 Author: The Hacker News [See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.8857] Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction. The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads. New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts Date: 2026-08-05 Author: Security Week The new attack methods, named ‘Pass-ta-key’ by Palo Alto Networks, focus on Google-synced passkeys. The security firm’s researchers showed how a threat actor could use the techniques to take over accounts without needing privilege escalation or user interaction. In a Pass-ta-key attack, malware already present on a Windows machine running Chrome can examine the browser’s local synchronization database to identify which online accounts the user has protected with passkeys, along with associated usernames and encrypted credential material. ASB-2026.0171.2 – UPDATE Ruby on Rails (Active Storage): CVSS (Max): 9.5 Ruby on Rails has released security updates to address a critical vulnerability in Active Storage that could allow an attacker to perform arbitrary file reads and potentially achieve remote code execution under vulnerable image processing configurations. ASB-2026.0172 – npm packages: CVSS (Max): None A large-scale npm supply chain attack, dubbed ChainDrop, compromised hundreds of widely used npm packages. ESB-2026.9044 – Adobe Campaign Classic: CVSS (Max): 10.0 This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read. ESB-2026.9115 – Cisco Catalyst SD-WAN: CVSS (Max): 9.9 Cisco has released software updates that address these vulnerabilities. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, Organisations using JetBrains TeamCity On-Premises are being urged to patch a newly disclosed critical security vulnerability that could allow attackers to bypass authentication and execute malicious commands on affected servers. The flaw, tracked as CVE-2026-63077, impacts all versions of TeamCity On-Premises and has been rated particularly severely because it enables remote code execution with the privileges of the TeamCity server process. TeamCity Cloud customers are not affected, as mitigations have already been implemented by JetBrains. TeamCity is widely used by development teams to automate software building, testing, and deployment processes. According to JetBrains, successful exploitation of the vulnerability could expose sensitive project data, system configurations, stored credentials, and potentially compromise software build pipelines and release artifacts. These risks make the issue especially significant for organisations that rely on TeamCity as a core component of their software delivery environment. While JetBrains stated there is currently no evidence of active exploitation, the warning carries added weight given TeamCity’s history as a target for cybercriminals, including ransomware operators and state-sponsored threat actors in 2023 and 2024. Past vulnerabilities in the platform have been rapidly exploited in real-world attacks, prompting experts to recommend swift remediation whenever critical flaws are disclosed. JetBrains has already addressed the issue in TeamCity versions 2025.11.7 and 2026.1.3 and strongly recommends upgrading as soon as possible. For customers unable to immediately move to the latest releases, the company has also provided a security patch plugin for supported versions dating back to TeamCity 2017.1. Additional security measures, including restricting access through VPNs and limiting exposure of internet-facing TeamCity services, are also recommended to reduce the risk of compromise. Critical VM Escape Vulnerability Patched in VMware ESXi Date: 2026-07-29 Author: Security Week [AUSCERT has informed the affected members via Critical MSINs] [AUSCERT has published security bulletin for this – https://portal.auscert.org.au/bulletins/ESB-2026.8797/] Broadcom published a new security advisory on Wednesday, informing VMware product users that patches are available for several vulnerabilities affecting ESXi, vCenter, Workstation, and Fusion. Three of the vulnerabilities have been assigned a ‘critical’ severity rating. One of them is CVE-2026-47876, an out-of-bounds write issue in ESXi’s VMXNET3 virtual network adapter. An attacker with local admin privileges on a VM with this adapter can exploit it to execute arbitrary code on the host. CVE-2026-47876 has been described by VMware as a VM escape. Cisco warns of FMC static credential flaw exploited in zero-day attacks Date: 2026-07-29 Author: Bleeping Computer [AUSCERT has published security bulletin for this – https://portal.auscert.org.au/bulletins/ESB-2026.8812/] Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices. The vulnerability is caused by static credentials for a low-privilege account built into Cisco Secure FMC Software. Cisco says an unauthenticated, remote attacker can use these credentials to log in to an affected system and access sensitive data available to the account. Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Date: 2026-07-25 Author: The Hacker News Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it. The attacker commits a crafted Jupyter notebook and opens its commit diff, which leaks a heap pointer. Enough of those and an automated probe can locate the libraries in memory. Two more notebooks then fire the payload. No administrator rights, no CI or runner access, no victim interaction, no access to anyone else's project. US, Australia Release OT Isolation Guidance for Critical Infrastructure Date: 2026-07-29 Author: Security Week The US cybersecurity agency CISA and Australia’s Cyber Security Centre (ACSC) have published joint guidance detailing how critical infrastructure (CI) organizations can isolate vital OT and supporting systems. Aimed at boosting cyber resilience, the CI Fortify – Advice for isolating vital systems guidance also includes details on how these systems can be operated in isolation for long periods, to ensure the continuity of critical services in case of disruption or crisis. The document is designed to help OT owners, operators, and cybersecurity teams improve their preparedness, response, and recovery. Origin Energy boss confirms almost a million Australians compromised by data breach Date: 2026-07-28 Author: Cyber Daily Aussie energy supplier Origin has said it has completed its initial investigations into a cyber security incident first disclosed on 22 July. “We have now completed the initial phase of our review into Origin’s customer data security incident,” Origin CEO Frank Calabria said in a 28 July statement. “At this point in time, we believe the information of approximately 900,000 current and former customers was accessed.” ESB-2026.8651 – macOS Sequoia 15.7.8: CVSS (Max): 9.1* Apple has released security updates for macOS Sequoia 15.7.8 to address multiple security vulnerabilities. Users are advised to install the update to help protect their systems. ESB-2026.8797 – VMware Products: CVSS (Max): 7.8 Broadcom has released security updates for VMware Aria Operations to address a high-severity local privilege escalation vulnerability. ESB-2026.8812 – Cisco Secure FMC Software: CVSS (Max): 5.3 Cisco has released a security update for Secure Firewall Management Center (FMC) to address a critical static credential vulnerability that has been exploited in zero-day attacks. ESB-2026.8839 – GitLab Community & Enterprise Edition: CVSS (Max): 8.5 GitLab has released GitLab 19.2.1 patch updates for Community and Enterprise Editions to address security vulnerabilities and bug fixes. ESB-2026.8857 – Adobe Campaign Classic: CVSS (Max): 10.0 Adobe has published security updates for Adobe Campaign addressing multiple vulnerabilities. Users are advised to apply the available updates to mitigate potential security risks. Stay safe, stay patched and have a good weekend! The AUSCERT team