Publications

Brand Protection from Phishing at Scale with AUSCERT’s Takedown Service A major public-facing institution experiences a surge in phishing attempts during key financial times of the year. Its digital identity is frequently exploited by threat actors who impersonate it to extract sensitive information from individuals. Challenge High Volume of Phishing Attempts: A surge in phishing websites exploiting the institution’s renowned name at specific times. Sophisticated Lures: Many campaigns used official-looking domains and cloned websites to deceive users. Urgency to Protect the Brand and the Public: Public trust and safety depended on removing malicious content quickly. Limited Internal Takedown Resources: The institution had good detection capabilities, but takedown requests would have been too time-consuming for them. Solution 1. Direct Reporting Channel The institution securely submitted suspected phishing URLs, screenshots, and email headers to AUSCERT using an encrypted, member-only channel. During peak financial milestones, submissions rose to hundreds per week. 2. Triage & Verification AUSCERT analysts manually verified each submission for validation. Automation was supplemented with human analysis to confirm malicious behaviour and avoid false positives. 3. Takedown Execution AUSCERT initiated takedowns by contacting: Hosting providers and registrars. Domain authorities. Third-party abuse contacts across global networks. Where possible, they also used CERT partnerships and API integrations for rapid removal. 4. Threat Intelligence Sharing All verified malicious domains and infrastructure were added to AUSCERT’s Malicious URL Feed, protecting other members in real time. They were also added to Google Safe Browsing and Netcraft. 5. Follow-Up & Feedback The institution received status updates on takedown progress and closure, including success confirmations and timelines, allowing for clear internal reporting. Outcome Dozens of phishing sites removed weekly, in particular during key financial milestones. Fast turnaround on phishing domain deactivation, reducing public harm and reputational risk, and enhancing brand protection. Community-wide defence by integrating takedown IOCs into AUSCERT’s threat feeds. Scalable support that delivers on brand protection. Reliance on AUSCERT’s strong network of international partnerships. Possibility to have comprehensive overview of takedown statistics.

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 48: Cyber Resilience and AI Risk: Insurance, Regulation & Boardroom Strategy In this episode of Share Today, Save Tomorrow, we are joined by two of WTW’s Cyber and Technology Risk team, Ben Di Marco & Leah Mooney, to expertly unpack the evolving landscape of AI governance, cyber risk, and insurance. They explore how voluntary guardrails are shaping future regulation, why cyber insurance is now essential (not optional), and the practical steps SMEs and large enterprises can take to boost resilience. The discussion highlights the importance of cross-functional collaboration, board-level engagement, and clear risk communication to navigate a complex threat environment. Whether you’re in cyber security, risk, or leadership, this episode offers valuable insights to help you stay ahead of regulatory change and emerging digital risks. This episode was hosted by Bek Cheb. The AUSCERT podcast can also be found on Spotify, Apple Podcasts, and our YouTube channel!

Greetings, Today we officially opened our Call for Tutorials for the AUSCERT2026 Conference, and we can’t wait to see the incredible submissions that come through. The standard rises every year, and we know 2026 will be no exception. Submissions close 10 November, so get in early! For details on tutorial categories and submission tips, head to our conference website. In case you missed it, we’ve also revealed our AUSCERT2026 theme: Game On! Step into the cyber arena where defenders are the most valuable players, tactics are everything, and every move matters. Game On! embodies the fast-paced, high-stakes nature of cyber security today where teamwork, quick thinking, and domain mastery are the keys to victory. With the threat landscape as our playing field, AUSCERT2026 challenges players to level up, unite under pressure, and face adversaries head-on. Featuring the International Cyber Championships, next year’s conference promises high-impact learning, fierce collaboration, and game-changing moments. Because in this arena, the stakes are real and it’s Game On! We look forward to welcoming you 19-22 May 2026 at The Star Gold Coast, Australia. Keep an eye out, registrations will open in January! AWS outage crashes Amazon, Prime Video, Fortnite, Perplexity and more Date: 2025-10-20 Author: Bleeping Computer AWS outage has taken down millions of websites, including Amazon.com, Prime Video, Perplexity AI, Canva and more. The outage started approx 30 minutes ago and it's affecting consumers in all regions, including the United States and Europe. According to AWS Health page, Amazon is aware of major disruption affecting multiple services. Oracle Releases October 2025 Patches Date: 2025-10-21 Author: Security Week [AUSCERT has published security bulletins for these Oracle updates] Oracle on Tuesday released 374 new security patches as part of its October 2025 Critical Patch Update (CPU), including over 230 fixes for vulnerabilities that are remotely exploitable without authentication. There appear to be roughly 260 unique CVEs in Oracle’s October 2025 CPU advisory, including a dozen critical-severity flaws. CISA Adds Microsoft, Oracle Vulnerabilities To KEV Catalog Date: 2025-10-20 Author: The Cyber Express The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five CVEs to its Known Exploited Vulnerabilities (KEV) catalog today, including Microsoft, Apple and Oracle vulnerabilities. Hidden "Glassworm" malware spreads through infected VS Code extensions Date: 2025-10-21 Author: iTnews A new malware worm campaign has infected multiple Microsoft Visual Studio Code extensions using invisible Unicode characters to hide malicious code from both reviewers and security tools, security researchers say. The worm, named Glassworm, compromised seven extensions on the OpenVSX marketplace on October 17, reaching more than 10,700 downloads. Email Bombs Exploit Lax Authentication in Zendesk Date: 2025-10-17 Author: Krebs on Security Cybercriminals are abusing a widespread lack of authentication in the customer service platform Zendesk to flood targeted email inboxes with menacing messages that come from hundreds of Zendesk corporate customers simultaneously. Zendesk is an automated help desk service designed to make it simple for people to contact companies for customer support issues. Earlier this week, KrebsOnSecurity started receiving thousands of ticket creation notification messages through Zendesk in rapid succession, each bearing the name of different Zendesk customers, such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder. ESB-2025.7610 – Atlassian Products: CVSS (Max): 10.0 14 high-severity vulnerabilities which have been fixed in new versions of Atlassian products. ASB-2025.0198 – Oracle Communications Applications: CVSS (Max): 9.8 This Critical Patch Update contains 64 new security patches for Oracle Communications Applications. 46 of these vulnerabilities may be remotely exploitable without authentication. ESB-2025.7565 – Rockwell Automation 1783-NATR: CVSS (Max): 10.0 This upgrade patches vulnerabilities where successful exploitation could result in a denial-of-service, data modification, or in an attacker obtaining sensitive information. ESB-2025.7544 – Samba: CVSS (Max): 10.0 USN-7826-1 fixed vulnerabilities in Samba where an authenticated attacker could possibly use this vulnerability to obtain sensitive information. ESB-2025.7495 – Tenable Identity Exposure: CVSS (Max): 9.9 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. One of the third-party components (.NET) was found to contain vulnerabilities. Stay safe, stay patched and have a good weekend! The AUSCERT team

As artificial intelligence (AI) continues to transform the cyber landscape, access to practical, trustworthy guidance is imperative. These assets empower organisations to stay ahead of emerging threats, foster a culture of responsible innovation, and contribute to a safer digital future for all. The following resources are freely available for download: Artificial Intelligence Perspective – Executive Briefing Pack AI Policy Statement and Guidelines for Staff Developed by the Cyber Leaders Network’s Artificial Intelligence working group, these resources were created to help organisations confidently navigate and implement responsible AI practices. The Cyber Leaders Network brings together cyber security professionals from across industries to collaborate, share best practices, and exchange insights on emerging challenges. Coordinated by AUSCERT, the Network provides a trusted forum for leaders to collectively strengthen Australia’s cyber resilience. All resources are shared under a Creative Commons Attribution 4.0 International License (CC BY 4.0), allowing you to share and adapt the material with appropriate credit to the AUSCERT Cyber Leaders Network.

Third-party providers remain one of the biggest blind spots in cyber security. With most major breaches originating from third-party vulnerabilities, it’s critical to assess and manage these relationships with precision. Developed by the Cyber Leaders Network’s Third-Party Risk Management working group, this resource offers a practical framework to help security teams make informed decisions and reduce exposure: Third-Party Risk and Contract Management Decision Tree Toolkit The Cyber Leaders Network brings together cyber security professionals from across industries to collaborate, share best practices, and exchange insights on emerging challenges. Coordinated by AUSCERT, the Network provides a trusted forum for leaders to collectively strengthen Australia’s cyber resilience. This artefact is shared under a Creative Commons Attribution 4.0 International License (CC BY 4.0), allowing you to share and adapt the material with appropriate credit to the AUSCERT Cyber Leaders Network.

Greetings, This week, we have released a new episode of the Share Today, Save Tomorrow podcast, Episode 47: Building Cyber Resilience with Lucas from the AUSCERT Dev Team. Our host, Bek, chats with Lucas Rossdeutscher, one of AUSCERT’s senior software developers, for an engaging behind-the-scenes look at MSINs (Member Security Incident Notifications) – a personalised and vital security service that helps AUSCERT members stay ahead of emerging threats. Lucas offers practical advice on how members can make the most of this tool to strengthen their cyber resilience and streamline their incident response efforts. Listeners will also get to know the person behind the code, as Lucas shares stories from his half-marathon training journey, his love of coffee, and how his passion for cyber security developed over time. This episode is available now on Spotify and Apple Podcasts now! After nearly a decade, Windows 10 is now unsupported as of 14th October 2025, marking a major shift for millions of users and organisations still relying on the operating system. Despite running on over a third of the world’s PCs, Microsoft have now ceased providing security updates, leaving unpatched vulnerabilities that cybercriminals could exploit. Ondrej Kubovič from ESET (a global digital company) warned that continuing to use unsupported systems creates “a significantly larger attack surface,” exposing users to data theft, malware, and potential operational or reputational damage. He recommends that if upgrading isn’t immediately possible, organisations should implement strict security controls such as restricting user privileges, limiting exposed services, using VPNs, and enhancing monitoring and audits. Still, Kubovič stresses that these measures are only stopgaps. “Temporary fixes can buy you time, but they are not a substitute for a full upgrade,” he said. “Start planning your transition now to avoid unnecessary risks.” F5 releases BIG-IP patches for stolen security vulnerabilities Date: 2025-10-15 Author: Bleeping Computer [AUSCERT has published security bulletins for these F5 updates and an ASB-https://portal.auscert.org.au/bulletins/ASB-2025.0175] Cybersecurity company F5 has released security updates to address BIG-IP vulnerabilities stolen in a breach detected on August 9, 2025. The company disclosed today that state hackers breached its systems and stole source code and information on undisclosed BIG-IP security flaws. F5 added that there's no evidence the threat actors leveraged the undisclosed vulnerabilities in attacks and said it has not yet found evidence that the flaws have been disclosed. Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws Date: 2025-10-14 Author: Bleeping Computer [AUSCERT has published security bulletins for these Microsoft updates] Today is Microsoft's October 2025 Patch Tuesday, which includes security updates for 172 flaws, including six zero-day vulnerabilities. This Patch Tuesday also addresses eight "Critical" vulnerabilities, five of which are remote code execution vulnerabilities and three are elevation of privilege vulnerabilities. Qantas says customer data released by cyber criminals Date: 2025-10-13 Author: iTnews Qantas Airways confirmed customer data stolen in a July breach had been published by cybercriminals. Qantas says customer data released by cyber criminals The airline said in July that more than a million customers had sensitive details such as phone numbers, birth dates or home addresses accessed in one of Australia's biggest cyber breaches in years. Another four million customers had just their name and email address taken during the hack, it said at the time. Annual Cyber Threat Report 2024-2025 Date: 2025-10-14 Author: ASD ACSC Australia is an early and substantial adopter of digital technology which drives public services, productivity and innovation. Our increasing dependency on digital and internet-connected technology means Australia remains an attractive target for criminal and state-sponsored cyber actors. In FY2024–25, ASD’s ACSC received over 42,500 calls to the Australian Cyber Security Hotline – a 16% increase from the previous year, over 1,200 cyber security incidents – an 11% increase, more than 1,700 times of potentially malicious cyber activity – an 83% increase from last year – highlighting the ongoing need for vigilance and action to mitigate against persistent threats. Oracle silently fixes zero-day exploit leaked by ShinyHunters Date: 2025-10-14 Author: Bleeping Computer Oracle has silently fixed an Oracle E-Business Suite vulnerability (CVE-2025-61884) that was actively exploited to breach servers, with a proof-of-concept exploit publicly leaked by the ShinyHunters extortion group. The flaw was addressed with an out-of-band security update released over the weekend, which Oracle said could be used to access “sensitive resources.” ESB-2025.7359 – Adobe: Adobe Connect: CVSS (Max): 9.3 Adobe has released a security update for Adobe Connect. This update resolves critical and moderate vulnerabilities that could lead to arbitrary code execution and security feature bypass. ESB-2025.7350 – F5 Networks: F5 BIG-IP (all modules): CVSS (Max): 9.8 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. (CVE-2016-2148) ESB-2025.7295 – Debian: Linux: CVSS (Max): 9.8 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. ESB-2025.7269 – Linux kernel (Azure): CVSS (Max): 9.8* Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. ESB-2025.7222 – Red Hat: kernel: CVSS (Max): 7.8 A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 47: Building Cyber Resilience with Lucas from the AUSCERT Dev Team In this episode of the Share Today, Save Tomorrow podcast, host Bek chats with Lucas, one of our senior software developers, for a behind-the-scenes look at MSINs — a vital security service for AUSCERT members. Lucas takes us through his development journey and explains how the dev team builds and maintains the systems that power AUSCERT’s incident response and threat intelligence capabilities. He also shares practical advice on how members can make the most of these services to strengthen their own cyber resilience. This episode was hosted by Bek Cheb. The AUSCERT podcast can also be found on Spotify and Apple Podcasts.

Greetings, The hacking collective Scattered Lapsus$ Hunters has continued its campaign of cyber extortion this week, targeting major Australian organisations including Telstra and Qantas. The group, which has claimed responsibility for a string of recent Salesforce-based attacks, alleged it had stolen millions of customer records from both companies and threatened to release the data unless “a resolution” was reached. Telstra was listed on the group’s darknet leak site overnight, with hackers claiming to hold 19 million sets of personal data including names, mobile numbers, and addresses. However, Telstra has denied the breach, confirming that the data was scraped from publicly available sources and did not come from its systems. Cyber Daily’s analysis suggests the information instead matches data from Reverse Australia, a public reverse phone lookup service. Meanwhile, Qantas has also reappeared on Scattered Lapsus$ Hunters’ leak site following an earlier breach in June. The group claims to possess over five million records of personally identifiable information, including customer names, contact details, and Frequent Flyer numbers, with a data release deadline set for 10 October. Qantas said its systems remain secure and that the incident stemmed from a third-party contact centre platform. The airline continues to strengthen its cyber defences and support affected customers. Oracle Rushes Patch for CVE-2025-61882 After Cl0p Exploited It in Data Theft Attacks Date: 2025-10-06 Author: The Hacker News [AUSCERT has published a MISP event with IOCs. Also see bulletin https://portal.auscert.org.au/bulletins/ASB-2025.0163] Oracle has released an emergency update to address a critical security flaw in its E-Business Suite that it said has been exploited in the recent wave of Cl0p data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle Concurrent Processing component. ShinyHunters Wage Broad Corporate Extortion Spree Date: 2025-10-07 Author: Krebs on Security A cybercriminal group that used voice phishing attacks to siphon more than a billion records from Salesforce customers earlier this year has launched a website that threatens to publish data stolen from dozens of Fortune 500 firms if they refuse to pay a ransom. The group also claimed responsibility for a recent breach involving Discord user data, and for stealing terabytes of sensitive files from thousands of customers of the enterprise software maker Red Hat. Salesforce refuses to pay a ransom in recent wave of attacks Date: 2025-10-08 Author: SC Media News that Salesforce has refused to negotiate or pay a ransom in the recent wave of cyberattacks experienced by at least 39 of its customers was viewed as a double-edged sword by some security professionals. “Salesforce's public refusal to pay the ransom sets a precedent that discourages future extortion attempts,” MacKenzie Brown, vice president, Adversary Pursuit Group at Blackpoint Cyber. “However, this strategy shifts the risk to their customers, who must now prepare for a potential data leak.” Redis warns of critical flaw impacting thousands of instances Date: 2025-10-06 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.7128] The Redis security team has released a patch for a vulnerability CVE-2025-49844 which could allow threat actors to gain remote code execution on thousands of vulnerable instances. An authenticated threat actor can exploit a 13-year-old use-after-free vulnerability to escape the Lua sandbox to establish a reverse shell for persistent access and achieve remote code execution on the targeted Redis host. SonicWall Concludes Investigation Into Incident Affecting MySonicWall Configuration Backup Files Date: 2025-10-08 Author: Arctic Wolf Recommendations On September 17, 2025, SonicWall released a knowledge base article detailing the exposure of firewall configuration backup files stored in certain MySonicWall accounts. As of October 8, 2025, the investigation has concluded and SonicWall has updated their advisory accordingly. While the original SonicWall advisory stated that under 5% of customers using the MySonicWall configuration file backup feature were affected by the incident, the finalized verbiage now specifies that all customers who have used SonicWall’s cloud backup service were affected. ASB-2025.0163 – Oracle E-Business Suite: CVSS (Max): 9.8 Oracle released an emergency patch to fix CVE-2025-61882, a critical remote-code-execution flaw in its E-Business Suite that has already been exploited by the Cl0p group in data theft campaigns. ESB-2025.7127 – Tenable Security Center: CVSS (Max): 10.0 Tenable fixed a medium-severity access control flaw (CVE-2025-36636) in Security Center ≤ 6.6.0, with the issue resolved in version 6.7.0. ESB-2025.7128 – redis: CVSS (Max): 9.9 Redis has disclosed a maximum-severity use-after-free flaw (CVE-2025-49844) in its Lua scripting engine that enables remote code execution when exploited. ESB-2025.7165 – IBM Db2 Data Management Console: CVSS (Max): 8.3 IBM warned of critical flaws in Db2 Data Management Console 3.1.12, including RCE via SnakeYAML, now added to CISA’s KEV catalog. Upgrading to version 3.1.13+ is strongly advised. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, We are excited to release our latest episode of the Share Today, Save Tomorrow podcast, Episode 46: Jess Dodson on Security, Strategy & Sci-Fi. Our General Manager, Ivano Bongiovanni, sits down with Jess Dodson, Cloud Solution Architect at Microsoft, and a long-time friend of AUSCERT. Jess shares her unconventional journey from sysadmin to cyber security leader, exploring the importance of mastering the basics, the role of communication, and challenges for SMBs and government. She also unpacks AI’s impact on data protection, the Essential Eight (with a sci-fi twist), and why cyber security should be seen as business transformation. This episode is sure to educate and entertain, and it’s available now on Spotify, Apple Podcasts, and YouTube! This October is Cyber Awareness Month 2025, with the theme, Building our cyber safe culture, reminding us to make cyber safe practices part of our everyday lives. This month encourages us to not only strengthen our own habits but also help friends and family build their confidence in cyber security. From spotting phishing attempts to using stronger passwords and enabling multi-factor authentication, small steps can go a long way in protecting the people around you. By sharing your knowledge, you can help extend a culture of cyber safety beyond the workplace and into the community. The ASD has developed a wide range of resources to support Cyber Awareness Month, including practical guides, tips, and shareable tools to help you and your loved ones stay secure online. CISA warns of critical Linux Sudo flaw exploited in attacks Date: 2025-09-30 Author: Bleeping Computer [AUSCERT has published bulletins for Sudo security updates] Hackers are actively exploiting a critical vulnerability (CVE-2025-32463) in the sudo package that enables the execution of commands with root-level privileges on Linux operating systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, describing it as “an inclusion of functionality from untrusted control sphere.” 50K Cisco firewalls remain vulnerable to advanced attacks Date: 2025-09-30 Author: The Register Nearly 50,000 Cisco ASA/FTD instances vulnerable to two bugs that are actively being exploited by "advanced" attackers remain exposed to the internet, according to Shadowserver data. The internet monitoring outfit said that as of Monday, the internet-facing Cisco firewalls are potentially exploitable, with the vast majority of those – more than 19,000 – located in the US. How to Use a Password Manager to Share Your Logins After You Die Date: 2025-09-29 Author: WIRED It’s not fun to talk about, but there’s only one thing certain in life. You need to have a plan for your digital legacy, just like you make a plan for your physical assets; otherwise, your accounts, services, and logins will rot away in a data center before they’re inevitably erased by a data retention policy. Some services recognize how important digital legacy is. Apple and Facebook have legacy contacts that can gain access to your accounts, and the American Bar Association is still grappling with the legalities of accessing online accounts when someone passes away. Most online services don't. Apple Patches Single Vulnerability CVE-2025-43400 Date: 2025-09-29 Author: SANS ISC [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.6939, https://portal.auscert.org.au/bulletins/ESB-2025.6938, https://portal.auscert.org.au/bulletins/ESB-2025.6937, https://portal.auscert.org.au/bulletins/ESB-2025.6936, https://portal.auscert.org.au/bulletins/ESB-2025.6935, https://portal.auscert.org.au/bulletins/ESB-2025.6934] It is typical for Apple to release a ".0.1" update soon after releasing a major new operating system. These updates typically fix various functional issues, but this time, they also fix a security vulnerability. The security vulnerability not only affects the "26" releases of iOS and macOS, but also older versions. Apple released fixes for iOS 18 and 26, as well as for macOS back to Sonoma (14). Apple also released updates for WatchOS and tvOS, but these updates do not address any security issues. For visionOS, updates were only released for visionOS 26. Hackers Actively Scanning to Exploit Palo Alto Networks PAN-OS Global Protect Vulnerability Date: 2025-09-30 Author: Cyber Security News Security researchers are observing a significant increase in internet-wide scans targeting the critical PAN-OS GlobalProtect vulnerability (CVE-2024-3400). Exploit attempts have surged as attackers seek to leverage an arbitrary file creation flaw to achieve OS command injection and ultimately full root code execution on vulnerable firewalls. Since late September 2025, honeypots deployed globally have logged thousands of TCP connections probing PAN-OS SSL VPN portals. ESB-2025.7032 – chromium Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. ESB-2025.7020 – Linux kernel (Oracle) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. ESB-2025.7007 – Splunk Enterprise Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.0.1, 9.4.4, 9.3.6, 9.2.8, and higher. ESB-2025.6759.2 – Cisco IOS and IOS XE Software An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 46: Jess Dodson on Security, Strategy & Sci-Fi In this episode of Share Today, Save Tomorrow, our General Manager Ivano Bongiovanni sits down with Jess Dodson, Cloud Solution Architect at Microsoft and long-time friend of AUSCERT. With her signature blend of technical insight and infectious enthusiasm, Jess shares her unconventional journey into cyber security – from sysadmin roots to strategic security leadership. The conversation dives into the importance of mastering the basics, the evolving role of communication in cyber strategy, and the challenges facing SMBs and government sectors. Jess also offers her take on AI’s impact on data protection, the Essential Eight (with a sci-fi twist), and why reframing cyber security as business transformation is key to resilience. Listen now and join the conversation on how we can build a more secure, inclusive, and forward-thinking cyber industry. This episode was hosted by Ivano Bongiovanni. The AUSCERT podcast can also be found on Spotify, Apple Podcasts, and our YouTube channel!

Greetings, Cisco is warning customers to urgently patch two critical zero-day vulnerabilities affecting the VPN web server of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software. Both flaws, which the company confirmed have been exploited in the wild, pose serious risks to affected networks. The first, tracked as CVE-2025-20333 with a CVSS score of 9.9, could allow an attacker with valid VPN credentials to execute arbitrary code as root by sending crafted HTTP requests. The second, CVE-2025-20362, with a CVSS score of 6.5, could enable unauthenticated attackers to access restricted endpoints without authentication. Cisco noted that attackers appear to be chaining the vulnerabilities to bypass authentication and run malicious code on vulnerable devices. The company credited international partners including the ACSC, CISA, and the UK’s NCSC, for assisting with the investigation. In response, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive ED 25-03, requiring federal agencies to immediately identify, analyse, and mitigate potential compromises. Both flaws have also been added to CISA’s Known Exploited Vulnerabilities catalogue, with a 24-hour deadline for applying mitigations. CISA warned that the campaign, linked to the advanced threat cluster ArcaneDoor, is ongoing and widespread. Attackers are said to be leveraging these zero-day flaws to gain unauthenticated remote code execution on ASA devices, even manipulating read-only memory to persist through reboots and upgrades. Customers are strongly urged to apply patches without delay to defend against ongoing exploitation. Fortra warns of max severity flaw in GoAnywhere MFT’s License Servlet Date: 2025-09-19 Author: Bleeping Computer Fortra has released security updates to patch a maximum severity vulnerability in GoAnywhere MFT's License Servlet that can be exploited in command injection attacks. GoAnywhere MFT is a web-based managed file transfer tool that helps organizations securely transfer files and maintain audit logs of who accesses the shared files. Tracked as CVE-2025-10035, this security flaw is caused by a deserialization of untrusted data weakness and can be exploited remotely in low-complexity attacks that don't require user interaction. While Fortra stated that the vulnerability was discovered over the weekend, it didn't specify who reported it or whether the flaw has been exploited in attacks. Cisco warns of IOS zero-day vulnerability exploited in attacks Date: 2025-09-24 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.6759/] Cisco has released security updates to address a high-severity zero-day vulnerability in Cisco IOS and IOS XE Software that is currently being exploited in attacks. Tracked as CVE-2025-20352, the flaw is due to a stack-based buffer overflow weakness found in the Simple Network Management Protocol (SNMP) subsystem of vulnerable IOS and IOS XE software, impacting all devices with SNMP enabled. Authenticated, remote attackers with low privileges can exploit this vulnerability to trigger denial-of-service (DoS) conditions on unpatched devices. High-privileged attackers, on the other hand, can gain complete control of systems running vulnerable Cisco IOS XE software by executing code as the root user. Microsoft Entra ID flaw allowed hijacking any company's tenant Date: 2025-09-21 Author: Bleeping Computer A critical combination of legacy components could have allowed complete access to the Microsoft Entra ID tenant of every company in the world. The fatal mix included undocumented tokens called “actor tokens” and a vulnerability in the Azure AD Graph API (CVE-2025-55241) that allowed the tokens to work with any organization’s Entra ID environment. SolarWinds releases third patch to fix Web Help Desk RCE bug Date: 2025-09-23 Author: Bleeping Computer [AUSCERT has contacted potentially affected members about this vulnerability where possible] SolarWinds has released a hotfix for a critical a critical vulnerability in Web Help Desk that allows remote code execution (RCE) without authentication. Tracked as CVE-2025-26399, the security issue is the company's third attempt to address an older flaw identified as CVE-2024-28986 that impacted Web Help Desk (WHD) 12.8.3 and all previous versions. SolarWinds WHD is a help desk and ticketing suite used by medium-to-large organizations for IT support request tracking, workflow automation, asset management, and compliance assurance. Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials Date: 2025-09-24 Author: The Hacker News Cloud security company Wiz has revealed that it uncovered in-the-wild exploitation of a security flaw in a Linux utility called Pandoc as part of attacks designed to infiltrate Amazon Web Services (AWS) Instance Metadata Service (IMDS). The vulnerability in question is CVE-2025-51591 (CVSS score: 6.5), which refers to a case of Server-Side Request Forgery (SSRF) that allows attackers to compromise a target system by injecting a specially crafted HTML iframe element. ESB-2025.6802 – Red Hat JBoss Enterprise Application Platform 7: CVSS (Max): 8.8 Redhat has released important patches for Red Hat JBoss EAP 7.1 on RHEL 7 to fix multiple vulnerabilities, and it has been added to the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog. ESB-2025.6809 – Tenable Security Center: CVSS (Max): 8.8 Tenable addresses PostgreSQL vulnerabilities in Security Center 6.5.1 and 6.6.0. The patch update mitigates risks of data exposure, denial of service, and other security weaknesses in the affected versions. ESB-2025.6814 – Cisco Products: CVSS (Max): 9.9 Cisco has confirmed two critical zero-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) are actively being exploited in its ASA/FTD VPN web server appliances. ESB-2025.6820 – GitLab Community Edition and Enterprise Edition: CVSS (Max): 7.5* GitLab issued patch releases 18.4.1, 18.3.3, and 18.2.7, bringing a number of security and bug fixes and urging all self-managed installations to upgrade immediately Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, This week, we have released an exciting new episode of the Share Today, Save Tomorrow podcast, Episode 45: Phishing, Passion & Progress: A Conversation with Shane Lim. Our host Bek Cheb sits down with Shane, one of our valued analysts at AUSCERT, for a deep dive into his journey from IT generalist to cyber security specialist. This episode also features an insider look at one of AUSCERT’s most vital member services, Phishing Takedowns. Shane breaks down how the process works, why phishing remains a persistent threat, and the technical and human challenges involved in taking malicious sites offline. This is an episode you won’t want to miss, and it’s available on Spotify, Apple Podcasts, and Soundcloud now. SonicWall has warned customers to reset credentials following a breach that exposed firewall configuration backup files linked to MySonicWall accounts. Attackers exploited the company’s cloud backup API service using brute-force methods, affecting fewer than 5% of its firewall install base. While the files contained encrypted passwords, SonicWall cautioned that they also held details that could make it easier for attackers to exploit impacted devices. The company has since blocked attacker access, launched an investigation with law enforcement and cyber security partners, and published guidance for administrators. Recommendations include restricting WAN access, resetting all credentials, and updating keys and tokens across related services. SonicWall emphasised this was not a ransomware event but a series of targeted brute-force attacks, adding there is no evidence that the files have been leaked online. Apple backports zero-day patches to older iPhones and iPads Date: 2025-09-16 Author: Bleeping Computer [See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2025.6540]​ Apple has released security updates to backport patches released last month to older iPhones and iPads, addressing a zero-day bug that was exploited in "extremely sophisticated" attacks. This security flaw is the same one Apple has patched for devices running iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, and macOS (Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8) on August 20. Tracked as CVE-2025-43300, this vulnerability was discovered by Apple security researchers and is caused by an out-of-bounds write weakness in the Image I/O framework, which enables apps to read and write image file formats. From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques Date: 2025-09-17 Author: Bleeping Computer During the past fifteen business days, Huntress analysts have observed increased threat activity involving several notable techniques. One case involved a malicious AnyDesk installer, which initially mimicked a standard ClickFix attack through a fake Cloudflare verification page but then utilized Windows File Explorer and an MSI package masked as a PDF to deploy MetaStealer malware. FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data Date: 2025-09-14 Author: Bleeping Computer The FBI has issued a FLASH alert warning that two threat clusters, tracked as UNC6040 and UNC6395, are compromising organizations’ Salesforce environments to steal data and extort victims. "The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate Indicators of Compromise (IOCs) associated with recent malicious cyber activities by cyber criminal groups UNC6040 and UNC6395, responsible for a rising number of data theft and extortion intrusions," reads the FBI's FLASH advisory. Threat Actors Leverage Several RMM Tools in Phishing Attack to Maintain Remote Access Date: 2025-09-15 Author: Cyber Security News Cybercriminals are increasingly exploiting legitimate remote monitoring and management (RMM) tools to establish persistent access to compromised systems through sophisticated phishing campaigns. Joint research conducted by Red Canary Intelligence and Zscaler threat hunters has identified multiple malicious campaigns utilizing ITarian (also known as Comodo), PDQ, SimpleHelp, and Atera RMM solutions as attack vectors. HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks Date: 2025-09-15 Author: The Hacker News Chinese-speaking users are the target of a search engine optimization (SEO) poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet FortiGuard Labs researcher Pei Han Liao said. "By using convincing language and small character substitutions, they tricked victims into visiting spoofed pages and downloading malware." ESB-2025.6633 – Linux kernel: CVSS (Max): 9.1* Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. ESB-2025.6569 – pcp: CVSS (Max): 8.8 This update for pcp fixes the following issues, exposure of the redis server backend allows remote command execution via pmproxy. ESB-2025.6567 – Mozilla Firefox: CVSS (Max): 8.8* Memory safety bugs are present. Some of these bugs showed evidence of memory corruption and it's presumed that with enough effort some of these could have been exploited to run arbitrary code. ESB-2025.6636 – Google Chrome: CVSS (Max): None Google released security updates for the Chrome web browser, to addresses four vulnerabilities, including one that it said has been exploited in the wild. The vulnerability has been described as a type confusion issue in the V8 JavaScript and WebAssembly engine. ESB-2025.6555 – Delta Electronics DIALink: CVSS (Max): 10.0 Delta Electronics DIALink has an Improper Limitation of a Pathname to a Restricted Directory vulnerability which could allow an attacker to bypass authentication. Stay safe, stay patched and have a good weekend! The AUSCERT team