Publications

Greetings, This week, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The flaws could allow remote code execution and affect a wide range of PHP deployments, with reports indicating exploitation attempts emerged shortly after disclosure. The Critical vulnerabilities in PHP alert from the Australian Cyber Security Centre (ACSC) warned that all PHP versions from PHP 5 onwards may be affected and urged organisations to identify PHP within their environments, apply available security updates, and monitor systems for suspicious activity. The impact of patching was felt globally, with many web sites temporarily taken offline while remediations were implemented. PHP powers a significant portion of the internet, with estimates of 70% of all web sites running it. This means vulnerabilities in the scripting language can have widespread consequences across the globe. The wave of exploitation activity that has started to emerge is likely to be significant, with many web sites unlikely to be patched. This incident reinforces the importance of maintaining visibility over the software supply chain and applying critical security updates as quickly as possible to reduce exposure to emerging threats. PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Date: 2026-10-21 Author: The Hacker News [AUSCERT has notified potentially affected members via a Critical MSIN. Also see AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0252.2] PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs. Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Date: 2026-10-21 Author: The Hacker News [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.13041/] GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. Drupal patches critical RCE flaws, warns exploits may emerge soon Date: 2026-10-17 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.12790/] Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to apply updates promptly because attackers could develop exploits shortly after the vulnerabilities’ disclosure. “The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project's security team warned. Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Date: 2026-10-20 Author: The Hacker News [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12627] Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Patches for the flaw were released last week by Fortinet in the following versions – FortiSIEM 7.5.0 (Upgrade to 7.5.1 or above) FortiSIEM 7.6 (Not affected) AdFection: How mercenary spyware invades victims’ devices through targeted advertising Date: 2026-10-15 Author: CyberScoop That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it. The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru. ASB-2026.0252.2 – PHP: CVSS (Max): 9.8 PHP have released updates to address two critical PHP vulnerabilities – CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state) which allow unauthenticated remote code execution and have been assigned a CVSS score of 9.2 (v4.0) by PHP. ASB-2026.0261 – Oracle E-Business Suite: CVSS (Max): 10.0 Oracle have released a Critical Patch Update that contains 194 new security patches for Oracle E-Business Suite; 31 of these vulnerabilities may be remotely exploitable without authentication ESB-2026.13041 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0 On October 21, 2026, GitLab released updated versions for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and GitLab strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. ESB-2026.13044 – Fortinet Products: CVSS (Max): 9.8 Fortinet have published their advisory on PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619). Fortinet is currently investigating the impact of CVE-2026-109618 over Fortinet Products. ESB-2026.13061 – Palo Alto Products: CVSS (Max): 9.2 Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Palo Alto Networks is not aware of any malicious exploitation of this issue against their products and will update their advisory with fixed versions and release estimates as they become available. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – Ep 68: The Accidental Security Architect with Lidia Giuliano In this episode of Share Today, Save Tomorrow, host Bec Cheb sits down with cybersecurity leader and security architect Lidia Giuliano to explore the evolving role of security architecture and why so many cyber professionals find themselves in the field by accident. Drawing on more than two decades of experience across industries including finance, telecommunications, healthcare, energy and defence, Lidia shares insights into the importance of trust, communication and experience in building effective security programs. The conversation also covers mentoring, overcoming imposter syndrome, the challenges of balancing business needs with security requirements, and practical advice for aspiring conference speakers. Throughout the discussion, Lidia highlights the power of community, knowledge sharing and helping the next generation of cyber professionals find their place in the industry. The AUSCERT podcast can also be found on Spotify and Apple Podcasts.

Greetings, The Australian Signals Directorate (ASD) has introduced the ASD Essentials framework, expanding on the long-standing Essential Eight to better address today's diverse technology environments, including cloud, operational technology (OT), and AI-enabled systems. Rather than focusing on a fixed set of controls, the new framework takes a more flexible, outcomes-based approach to cyber resilience. It will be delivered through environment-specific guidance, including Essentials for Enterprise IT, Operational Technology, and Cloud, alongside guidance for executives and AI considerations. Importantly, organisations that have already invested in the Essential Eight do not need to start over. Existing controls remain relevant, and ASD will maintain both frameworks during the transition period. The change signals a shift from treating cyber security as a compliance checklist to focusing on security outcomes and resilience. Now is a good opportunity to review how your current Essential Eight maturity aligns with broader cyber security risks across cloud, OT, and emerging AI technologies. Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories Date: 2026-10-09 Author: The Hacker News Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity said. "Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10–21:26 UTC." GitLab warns of max severity code execution vulnerability Date: 2026-10-12 Author: Bleeping Computer [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12505] GitLab has told users to immediately patch CVE-2026-97229, maximum-severity vulnerability within the CI/CD Regular Expression Compiler, which enables remote code execution (RCE) for threat actors. A specially crafted expression for GitLab's CI/CD Regular Expression Compiler will parse, evaluate, and compile malicious code through the exploitation of a integer overflow weakness. Both Community and Enterprise editions have been patched. Version after 19.2, 19.3, and 19.4 and version before 19.2.8, 19.3.4, and 19.4.2 are vulnerable and should be patched immediately. This vulnerability was reported to GitLab by 'joaxcar' through their HackerOne bug bounty program. Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days Date: 2026-10-13 Author: Bleeping Computer [See AUSCERT Bulletins for Microsoft October Patch Advisories] Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing. Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks Date: 2026-10-14 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.12773/] Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices. Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch Date: 2026-10-12 Author: The Hacker News Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." Patches for the flaw were released by SonicWall on October 6, 2026, with versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix). ESB-2026.12605 – Adobe Commerce: CVSS (Max): 10.0 Adobe has released a priority 2 security update for Adobe Commerce. Adobe is not aware of any exploits in the wild for any of the issues addressed in this update. ESB-2026.12505 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0 Updated versions of GitLab Community Edition (CE) and Enterprise Edition (EE) have been released. These versions contain important bug and security fixes, and Gitlab strongly recommends that all self-managed GitLab installations be upgraded immediately. ASB-2026.0251 – Microsoft Windows: CVSS (Max): 9.8 Microsoft has released its monthly security patch updates for the month of October, 2026. This Microsoft Windows update resolves 11125 vulnerabilities and Microsoft recommends updating the software with the version made available on the Microsoft Update Catalogue ESB-2026.12603 – Citrix XenServer: CVSS (Max): 8.8 Citrix have provided security updates that address several issues that affect Citrix XenServer. ESB-2026.12645 – Zoom: CVSS (Max): 8.1 Zoom have provided updates that address an Improper Authorization in Handler for Custom URL Scheme vulnerability in Zoom Workplace for Android. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, Online fashion retailer ASOS has confirmed that customer information may have been accessed following a cyber incident that saw hackers send unauthorised messages through the company's official mobile app. The retailer said names and contact details may have been exposed, while payment card information and account passwords were not affected. The incident came to light after customers received push notifications from the ASOS app containing messages from threat actors claiming responsibility for the attack. ASOS is investigating the incident and working with cybersecurity specialists to secure its systems. Attackers have claimed they stole customer data, although the full scope of the incident remains under investigation and these claims have not been confirmed by the company. The incident highlights the risks associated with third-party communication platforms and trusted customer channels. Even when financial data is not compromised, exposed personal information can be leveraged in phishing and social engineering attacks. Citrix discloses third actively exploited NetScaler zero-day in less than a week Date: 2026-10-05 Author: CyberScoop [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12056/] Citrix customers just got through back-to-back weekends filled with varying levels of uncertainty and worry, as yet another actively exploited zero-day vulnerability was discovered in Citrix NetScaler products. Researchers and security experts said the vulnerability — CVE-2026-88779 — is less concerning because exploitation triggers denial of service and only impacts instances that have SAML (security assertion markup language) enabled. “This means it doesn’t work out of the box against every NetScaler deployment,” Jake Knott, head of threat intelligence at watchTowr, told CyberScoop. “While this is very inconvenient, it doesn’t have organizations scrambling to trigger incident response.” Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes Date: 2026-10-05 Author: The Hacker News Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network," Microsoft said in an advisory released on October 2, 2026. ASOS confirms data breach after “HACKED” in-app notifications Date: 2026-10-06 Author: Bleeping Computer UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. ASOS is a large UK-based online fashion retailer that sells clothing, footwear, accessories, and beauty products to customers worldwide, including in the United States. Chrome 155 Update Patches 247 Vulnerabilities Date: 2026-10-07 Author: Security Week [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12256] Four critical-severity use-after-free defects were fixed in Chromecast, Browser, Navigation, and Track. Google on Tuesday rolled out a Chrome 155 security update that addresses 247 vulnerabilities, including four critical-severity flaws. All four critical bugs are use-after-free issues. They impact Chrome’s Chromecast, Browser, Navigation, and Track components and are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347. Hackers exploit critical Atlassian flaw after public PoC release Date: 2026-10-07 Author: Bleeping Computer [See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12187] A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. Earlier today, security company Previdian detected the activity on its honeypot network, just hours after a detailed technical report was published. An unauthenticated attacker can exploit CVE-2026-21589 to access specific files in the application's web root directory if they know the file's exact name and path. ESB-2026.12162 – GitLab AI Gateway: CVSS (Max): 9.9 Updated versions of GitLab Self-Hosted AI Gateway, that contain a critical security fix, have been released. Gitlab strongly recommends that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of these versions immediately. ESB-2026.12056 – Citrix NetScaler ADC & Citrix NetScaler Gateway: CVSS (Max): 7.5 Software updates have been released to address a vulnerability in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). ESB-2026.12246 – Hitachi Energy SOI: CVSS (Max): 8.8 Hitachi Energy is aware of a RCE (Remote Code Execution) vulnerability in the Apache ActiveMQ component of SOI product versions. Users are advised to apply the patch SOI EP2, which upgrades the ActiveMQ version (JMS message broker) for the SOI Core. ESB-2026.12323 – Splunk Enterprise: CVSS (Max): 9.8 Splunk have provided upgrades that address multiple vulnerabilities in Splunk Enterprise. ESB-2026.12333 – Cisco License (Smart Software Manager) On-Prem: CVSS (Max): 10.0 Cisco has released software updates that address vulnerabilities that affect Cisco License On-Prem – regardless of software configuration. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, October is Cyber Security Awareness Month, and the Australian Cyber Security Centre (ACSC) is encouraging all Australians and organisations to take action to strengthen their cyber security posture. This year's theme, “Building our cyber safe culture", focuses on three simple but effective steps: keeping software up to date, using strong and unique passphrases, and enabling multi-factor authentication (MFA) on all accounts. For cyber security professionals and organisational leaders, the ACSC will spotlight four key focus areas throughout October: event logging, legacy technology, supply chain and third-party risk, and quantum readiness. These topics aim to help organisations improve resilience and better protect critical systems and data. As Cyber Security Awareness Month gets underway, now is a great opportunity to review your organisation's cyber security practices and ensure the fundamentals are in place to reduce cyber risk. Citrix confirms two NetScaler RCE zero-days exploited in attacks Date: 2026-09-27 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.11691/] Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. The vulnerabilities are the same zero-days that cybersecurity researchers, IT providers, and national cybersecurity agencies began privately warning organizations about over the weekend. Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager Date: 2026-09-30 Author: The Hacker News [AUSCERT has informed the affected members via Critical MSINs] [Please see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.11917/] Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a CVSS score of 9.8 out of 10. It sits in the part of the Manager's API that handles login sessions. Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks Date: 2026-09-28 Author: The Hacker News [AUSCERT has published security bulletins for these Apple updates: https://portal.auscert.org.au/bulletins/ESB-2026.11802/ https://portal.auscert.org.au/bulletins/ESB-2026.11801/] Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The iPhone maker said the issue was addressed with improved bounds checking. It credited Meta Product Security with discovering and reporting the issue. Google: Vulnerability disclosures double to 10,000 per month as AI fuels exploitation Date: 2026-10-01 Author: The Record Vulnerability disclosures doubled between January and August, reaching a new peak of 10,740 last month, Google’s Threat Intelligence Group (GTIG) said Wednesday. Total vulnerability disclosures began the year at 5,045 in January and had jumped to more than 10,000 for July and August. “We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered,” the researchers said. Queensland government department loses $800,000 in cyber attack – ABC News Date: 2026-09-30 Author: ABC News The Customer Services, Open Data, and Small and Family Business department lost $809,000 in public money due to an external cyber attack for financial gain. The department plays a lead role in strengthening the state government’s cyber security capabilities. No government data or sensitive information was compromised during the incident. ESB-2026.11795 – Apache Tomcat: CVSS (Max): 9.8 Apache Tomcat contains a vulnerability that could allow attackers to bypass security constraints protecting WebSocket endpoints. ESB-2026.11802 – Apple macOS Sequoia: CVSS (Max): 8.8 Apple macOS contains a CoreGraphics vulnerability that could allow arbitrary code execution via a malicious file. ESB-2026.11827 – MikroTik RouterOS: CVSS (Max): 9.8 MikroTik have provided update versions for the RouterOS. Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. ESB-2026.11900 – GitLab Community Edition (CE) and Enterprise Edition (EE): CVSS (Max): 10.0 Updated versions for GitLab Community Edition (CE) and Enterprise Edition (EE) were released on September 23, 2026. Gitlab strongly recommends that all self-managed GitLab installations be upgraded to one of these versions immediately. ESB-2026.11917 – Cisco Catalyst SD-WAN Manager: CVSS (Max): 9.8 Cisco has released software updates that address a vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 67: Data Breaches, Disclosure and the Gaps in Between with Troy Hunt In this episode of Save Today, Tomorrow, host Bec Cheb sits down with renowned security researcher Troy Hunt to discuss the evolving landscape of data breaches, breach notifications, and privacy regulations. From the realities of incident disclosure to the limitations of current reporting frameworks, Troy shares his insights on how organisations handle breaches, what individuals should know about their data, and why transparency remains a critical component of cyber resilience. The AUSCERT podcast can also be found on Spotify, and Apple Podcasts,

Greetings, In June this year an AI agent operated by US-based artificial intelligence company OpenAI gained unauthorised access to Medicare’s statistics portal and three other government systems, state and federal, while researching publicly available information on medicine spending. The incident was reported by OpenAI to the Australian government via email in September. After encountering access restrictions, the AI agent attempted alternative methods and accessed both public and non-public information within the Medicare Statistics Reporting Service portal. There is currently no evidence that personal Medicare information was accessed or that the broader Services Australia network was compromised. The Australian Signals Directorate is assisting with a forensic investigation. The incident highlights emerging cyber security challenges as AI agents become increasingly capable of independently navigating systems and adapting their behaviour when encountering restrictions. For organisations, it reinforces the importance of strong access controls, continuous monitoring and logging, and appropriate guardrails and human oversight when deploying AI agents. As agentic AI capabilities evolve, security and incident response processes will need to evolve alongside them. Australian Medicare data portal "infiltrated" by OpenAI agent Date: 2026-09-24 Author: iTnews An OpenAI agent has accessed “public and non-public files” from a “Medicare statistics reporting portal”, Australian Prime Minister Anthony Albanese said. Speaking at the United Nations meeting in New York, Albanese said the AI agent had “infiltrated” and “gained unauthorised access” to the data portal in June. While the portal is “public-facing”, according to Albanese, it appears not all of the data files that it holds are for general consumption. “The AI agent accessed both public and non-public files,” Albanese said. MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key Date: 2026-09-23 Author: The Hacker News [AUSCERT has informed the affected members via Critical MSINs] Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at least September 2, one day before MikroTik shipped patches in RouterOS 6.49.21, 7.23.4, and 7.24.2. F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks Date: 2026-09-23 Author: Bleeping Computer [AUSCERT has informed the affected members via Critical MSINs] F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. BIG-IP APM (short for Access Policy Manager) is the company's centralized access management proxy solution that helps admins secure access to their organizations' networks, applications, cloud, and application programming interfaces (APIs). Tracked as CVE-2026-94127, the flaw affects instances configured as an OAuth Authorization Server when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server. BigCommerce Data Stolen via Ribon Apps Hack Date: 2026-09-22 Author: Security Week Enterprise eCommerce platform BigCommerce fell victim to a supply chain attack that led to customer data theft. BigCommerce is a SaaS provider that enables merchants to build and manage online stores. It hosts the stores, provides backend tools, and handles server security. Late last week, the company started notifying merchants that customer data was stolen after hackers compromised a BigCommerce application key held by Ribon, a storefront and shopping experience optimization app developed by Fastr-owned Be A Part Of. Hacked? Qantas investigating WhatsApp phishing reports Date: 2026-09-21 Author: cyberdaily.com.au The Flying Kangaroo and a Sydney hotel warn customers not to share payment details following suspicious messages targeting Qantas Hotels customers. Australia’s national carrier is once again investigating a possible security breach after some of its customers were targeted by WhatsApp phishing messages. “We’re investigating reports of phishing attempts targeting some Qantas Hotels customers. “If you receive a suspicious WhatsApp message claiming to be from a hotel, you should ignore the message. Qantas Hotels and our accommodation partners will never ask you to verify your booking or provide personal details via WhatsApp. ESB-2026.11491 – F5 – BIG-IP APM: CVSS (Max): 9.8 F5 have provided fixes for a vulnerability – when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). ESB-2026.11529 – Ubuntu – Linux kernel: CVSS (Max): 10.0 Ubuntu have provided fixes for security issues, discovered in the Linux kernel that could possibly allow an attacker to compromise the system/subsystems. ESB-2026.11379 – Debian – chromium: CVSS (Max): 9.8 Debian have provided fixes for security issues that were discovered in Chromium, which could result in the execution of arbitrary code, denial of service, or information disclosure. ESB-2026.11479 – Siemens SIPLUS and SIMATIC Products: CVSS (Max): 7.8 Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. ESB-2026.11583 – GitLab Community Edition (CE) and Enterprise Edition (EE): CVSS (Max): 9.9 Updated versions for GitLab Community Edition (CE) and Enterprise Edition (EE) were released on September 23, 2026. These versions contain important bug and security fixes, and Gitlab strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, September is MFA Month, making it the perfect time to review one of the simplest and most effective cyber security measures available: multi-factor authentication (MFA). As part of the Australian Signals Directorate’s (ASD) MFA: Switch It On campaign, organisations across Australia are being encouraged to enable MFA on all accounts and systems. The initiative aims to increase MFA adoption across businesses, government agencies, and critical infrastructure organisations, helping make Australia a safer place to connect online. The need for MFA has never been clearer. According to the ASD, 42% of cyber security incidents reported by industry, government, and critical infrastructure organisations in 2024-25 involved compromised accounts or credentials. This serves as a timely reminder that passwords alone are no longer enough to protect against modern cyber threats. MFA adds an extra layer of protection by requiring users to verify their identity using more than just a password. As one of the most effective defences against unauthorised access, phishing-resistant forms of MFA can significantly reduce the risk of cybercriminals gaining access to accounts, applications, corporate systems, and networks. By encouraging employees, customers, suppliers, and stakeholders to enable MFA, organisations can strengthen their cyber resilience, better protect sensitive information and assets, and reduce the risk of account compromise. For practical guidance, including step-by-step instructions for enabling MFA on popular accounts and applications, visit the Australian Cyber Security Centre's guide ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks Date: 2026-09-14 Author: Security Week ConnectWise has released urgent patches for a critical-severity vulnerability in the ScreenConnect remote access and support software that has been exploited in worm-like attacks. Tracked as CVE-2026-84869 (CVSS score of 9.9/10), the security defect is described as a missing authorization and improper privilege management issue. The bug creates “a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances,” ConnectWise explains in its advisory. Cisco patches Secure Email Gateway zero-day exploited in attacks Date: 2026-09-15 Author: Bleeping Computer [Please see AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.10980.2/] Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," the company warned in a Monday security advisory. The security flaw (tracked as CVE-2026-76461) was found in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway and affects virtual and physical appliances, regardless of the device configuration. GitLab Vulnerability Exploited One Day After Disclosure Date: 2026-09-11 Author: Security Week [Please see AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.10914/] Threat actors have started exploiting a newly patched vulnerability in GitLab one day after public disclosure, attack surface management firm WatchTowr warns. Tracked as CVE-2026-85706 (CVSS score of 10/10), the security defect is described as a path traversal issue that can allow unauthenticated users to read arbitrary files from the GitLab server. All Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected. Check Point Patches Critical VPN Vulnerabilities Date: 2026-09-11 Author: Security Week Cybersecurity firm Check Point this week announced patches for two critical-severity vulnerabilities in its gateway and firewall products using VPN functionality. Tracked as CVE-2026-85102 and CVE-2026-85103 (CVSS score of 9.8), both security defects could be exploited without authentication for remote code execution (RCE), Check Point warns. The former is described as an improper validation of certificate data during VPN negotiation, while the latter is a heap overflow in the VPN certificate ASN.1 decoding flow. Passkey-themed phishing attacks lead to Microsoft 365 data theft Date: 2026-09-11 Author: Bleeping Computer Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. The activity has been observed since May 2026 and begins with the attackers researching targeted organizations and employees before calling or messaging victims while impersonating corporate IT help desks. The attackers tell employees that they must urgently update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid losing access to corporate systems. ASB-2026.0222 – Check Point Products: CVSS (Max): 9.8 Check Point have provided fixes for two critical CVSS 9.8 flaws that affect Check Point Security Gateway, Security Management Server and Spark Firewall (Centrally Managed and Locally Managed) products. ASB-2026.0236 – Oracle Communications: CVSS (Max): 9.8 Oracle have provided a Critical Security Patch Update that contains 31 new security patches for Oracle Communications – 23 of these vulnerabilities may be remotely exploitable without authentication. ESB-2026.11217 – Cisco Secure Firewall Management Center (FMC): CVSS (Max): 10.0 Cisco has released software updates that address a vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. ESB-2026.10914 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0 GitLab have provided updated versions of GitLab Community & Enterprise Edition that contain important bug and security fixes, and they strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. ESB-2026.10980.2 – Cisco Secure Email Gateway: CVSS (Max): 9.8 Cisco has released software updates that address a vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 66:From Night Markets to Cyber Mindsets: Rethinking Security Awareness Why does traditional cyber security awareness training so often fail to change behaviour? In this episode of Share Today, Save Tomorrow, Bec Chebb sits down with Eric “Pinky” Pinkerton to explore the gap between compliance-driven training and genuine cyber resilience. Using relatable real-world examples, including navigating unfamiliar cities and bustling night markets, Pinky explains how developing a mindset of situational awareness can help people better recognise and respond to online threats. The conversation challenges conventional approaches to security education and offers practical insights into building a stronger, more resilient security culture. The AUSCERT podcast can also be found on Spotify, and Apple Podcasts,

Greetings, This week, Mathspace disclosed a data breach affecting about 1.08 million students, carers and staff in Australia and New Zealand. Information stolen includes names, email addresses, usernames, account types and countries . While no passwords or sign-on credentials were accessed, the exposed information could be used to create convincing phishing emails impersonating Mathspace. The attackers accessed the data by exploiting a flaw in Mathspace’s self-hosted installation of Metabase. While Metabase had disclosed the vulnerability and provided a patch, Mathspace had not installed the patch at the time of the attack. Attackers exploited the vulnerability days after it was disclosed and patched by Metabase on 6 August. This breach follows a ransomware attack on education platform Canvas earlier this year. These incidents highlight the value of sensitive information held by education platforms and the attractiveness of the education sector to cyber criminals. The Metabase vulnerability allowed attackers to gain administrator access to the affected system without legitimate credentials. Mathspace said its vulnerability-notification process did not identify and escalate the Metabase advisory for action. The company later secured the affected system, took it offline and notified affected users and relevant authorities. Mathspace said there is currently no evidence that the stolen information has been published, sold or misused. However, affected users should remain alert to phishing and impersonation attempts using the exposed information. … Adobe Commerce Zero-Day Exploited to Backdoor Online Stores Date: 2026-09-07 Author: Security Week Threat actors are exploiting a zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms to backdoor online stores, cybersecurity firm Sansec reports. Dubbed StyleSmuggler, the security defect enables attackers to inject PHP code into Magento’s template system and evade detection by using the ‘styles’ properties. According to Sansec, the attack works in two stages: first, the PHP code is injected by generating a failure report, and then Magento executes the code via a failed payment email. N-able patches max severity N-central flaw amid ongoing attacks Date: 2026-09-07 Author: Bleeping Computer N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console. Tracked as CVE-2026-86218, this RCE vulnerability allows threat actors without privileges to execute malicious code on unpatched N-central instances exposed online in low-complexity attacks. Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication Date: 2026-09-06 Author: The Hacker News [AUSCERT has notified potentially affected members] Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or attacker identity. MikroTik's security update lists fixed RouterOS releases. CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes. SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution Date: 2026-09-09 Author: The Hacker News SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP security company Onapsis, it has been codenamed OVERPASS. Microsoft discloses two actively exploited zero-days among 974 vulnerabilities Date: 2026-09-08 Author: CyberScoop [AUSCERT has published security bulletins for these Microsoft updates] Microsoft addressed 974 defects across its product suite, including two actively exploited zero-day vulnerabilities, in its monthly Patch Tuesday security program. The massive batch of patches, Microsoft’s largest ever, reflects a continuing trend for the vendor as it leans on artificial intelligence to discover more vulnerabilities at a faster rate. Yet, the recent period of record breaking vulnerability disclosures hasn’t resulted in a flood of actively exploited zero-days. ESB-2026.10690 – Adobe Commerce: CVSS (Max): 10.0 Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. ASB-2026.0220 – Microsoft Windows: CVSS (Max): 9.8 Microsoft has released 'Microsoft Windows' updates to resolve 726 vulnerabilities, as part of the Microsoft security patch updates for the month of September 2026. ASB-2026.0212 – Microsoft Azure: CVSS (Max): 10.0 Microsoft has released 'Microsoft Azure' updates to resolve 12 vulnerabilities, as part of the Microsoft security patch updates for the month of September 2026. ESB-2026.10780 – Palo Alto Networks PAN-OS: CVSS (Max): 9.2 A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition. ESB-2026.10661 – Linux kernel (GCP): CVSS (Max): 10.0 Ubuntu have provided an update(s) for several vulnerabilities that were discovered in the Linux kernel for Google Cloud Platform (GCP) systems. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 65 : Challenging Quantum Hype, Human Error and AI Myths with Peter Guttmann In this AUSCERT podcast episode, cyber security researcher Peter Gutmann discusses his conference talk questioning the hype around quantum cryptanalysis, arguing that there is little real-world evidence that quantum computers can currently break modern encryption. He also challenges the idea that humans are the weakest link in cybersecurity, suggesting that overly complex systems are often to blame for security failures. The conversation covers the importance of knowledge sharing, the practical use of AI for identifying software vulnerabilities, and the growing challenge of managing cybersecurity risks in an increasingly complex digital environment. The AUSCERT podcast can also be found on Spotify, and Apple Podcasts,

Greetings, After more than two decades in the shadows, one of the internet’s longest-running botnets has finally been disrupted. An international operation involving authorities and cyber security researchers from the US, Bulgaria, Hungary and Romania, alongside CrowdStrike and the Shadowserver Foundation, has isolated more than 15,000 infected systems and seized domains linked to the Sality botnet. Unlike traditional botnets that rely on central command-and-control servers, Sality used a peer-to-peer network, making it harder to disrupt or dismantle. Researchers exploited this architecture to interfere with communications between infected machines and disrupt the botnet. Sality has been used to distribute malware and facilitate various forms of cyber crime, including cryptocurrency theft. Organisations should not assume that older malware is no longer a threat. Effective endpoint protection, timely patching, network monitoring and investigation of legacy malware detections remain essential. The continued activity of threats such as Sality demonstrates that malware can persist for years, making it important to detect and respond to both emerging and long-standing threats. Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server Date: 2026-08-28 Author: The Hacker News cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs Date: 2026-08-31 Author: Security Week Hackers are exploiting a critical-severity Ruby on Rails vulnerability that leads to remote code execution (RCE), VulnCheck warns. Tracked as CVE-2026-66066 (CVSS score of 9.5) and referred to as KindaRails2Shell, the flaw is described as an arbitrary file read leading to secret exposure, RCE, and lateral movement. The security defect was disclosed in late July, when Ruby on Rails rolled out patches for it, urging the immediate patching of all Rails applications that rely on libvips for Active Storage image processing and allow image uploads from untrusted users. Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Date: 2026-09-01 Author: Bleeping Computer Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. Tracked as CVE-2026-62911 and reported by DEVCORE Research Team's Orange Tsai, this security flaw affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) software. Threat actors with basic privileges on the targeted server can exploit it in low-complexity attacks that require user interaction. PaperCut issues emergency patches as threat actors target chained vulnerabilities Date: 2026-08-31 Author: Cybersecurity Dive [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2026.0208/] PaperCut issued emergency patches on Friday to address critical vulnerabilities in its print-management software. The company confirmed in a security advisory that multiple customers were successfully targeted and that it is working with security researchers at Huntress and watchTowr to respond to the attacks. The vulnerabilities include an improper access-control flaw in PaperCut MF and NG. CVE-2026-81578 enables an unauthenticated attacker to modify certain system configurations and CVE-2026-82078 enables an attacker to execute arbitrary Java bytecode. BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update Date: 2026-09-01 Author: Cyber Security News Attackers hijacked BGP routing for Softaculous last week and delivered a malicious Virtualizor update to a handful of hypervisor servers, according to a vendor incident report. Hosting providers use Virtualizor to manage VPS nodes on KVM, Xen, LXC, OpenVZ, and Proxmox, and a single master can control hundreds of virtualization servers, placing a poisoned update high in the hosting stack. The product publicly lists hundreds of NOC partners, so a compromise here hits hosting infrastructure rather than a single website panel. ESB-2026.10412 – Cisco Nexus 9000 Series Switches: CVSS (Max): 9.8 Cisco has released software updates that addresses vulnerabilities in Cisco Nexus 9000 Series Switches. ASB-2026.0208 – PaperCut NG / MF: CVSS (Max): 9.4 PaperCut NG and PaperCut MF are affected by two vulnerabilities that can be chained by attackers to bypass authentication and execute arbitrary code on vulnerable servers. ESB-2026.10356 – Firefox ESR: CVSS (Max): 10.0 Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. ESB-2026.10351 – Rockwell Automation Logix Platform: CVSS (Max): 7.5 A denial-of-service vulnerability exists in the affected Logix platforms due to improper validation of input length during CIP message processing. ESB-2026.10167 – Tenable Enclave Security: CVSS (Max): 9.9 Several vulnerabilities have been identified, reported to Tenable and resolved. Stay safe, stay patched and have a good weekend! The AUSCERT team