16 Oct 2026
Week in review
Greetings,
The Australian Signals Directorate (ASD) has introduced the ASD Essentials framework, expanding on the long-standing Essential Eight to better address today's diverse technology environments, including cloud, operational technology (OT), and AI-enabled systems.
Rather than focusing on a fixed set of controls, the new framework takes a more flexible, outcomes-based approach to cyber resilience. It will be delivered through environment-specific guidance, including Essentials for Enterprise IT, Operational Technology, and Cloud, alongside guidance for executives and AI considerations.
Importantly, organisations that have already invested in the Essential Eight do not need to start over. Existing controls remain relevant, and ASD will maintain both frameworks during the transition period.
The change signals a shift from treating cyber security as a compliance checklist to focusing on security outcomes and resilience. Now is a good opportunity to review how your current Essential Eight maturity aligns with broader cyber security risks across cloud, OT, and emerging AI technologies.
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Date: 2026-10-09
Author: The Hacker News
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories.
"Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity said. "Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10–21:26 UTC."
GitLab warns of max severity code execution vulnerability
Date: 2026-10-12
Author: Bleeping Computer
[See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12505]
GitLab has told users to immediately patch CVE-2026-97229, maximum-severity vulnerability within the CI/CD Regular Expression Compiler, which enables remote code execution (RCE) for threat actors. A specially crafted expression for GitLab's CI/CD Regular Expression Compiler will parse, evaluate, and compile malicious code through the exploitation of a integer overflow weakness.
Both Community and Enterprise editions have been patched. Version after 19.2, 19.3, and 19.4 and version before 19.2.8, 19.3.4, and 19.4.2 are vulnerable and should be patched immediately. This vulnerability was reported to GitLab by 'joaxcar' through their HackerOne bug bounty program.
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Date: 2026-10-13
Author: Bleeping Computer
[See AUSCERT Bulletins for Microsoft October Patch Advisories]
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.
This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing.
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Date: 2026-10-14
Author: Bleeping Computer
[See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.12773/]
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.
The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices.
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Date: 2026-10-12
Author: The Hacker News
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.
The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
Patches for the flaw were released by SonicWall on October 6, 2026, with versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix).
ESB-2026.12605 – Adobe Commerce: CVSS (Max): 10.0
Adobe has released a priority 2 security update for Adobe Commerce. Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.
ESB-2026.12505 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0
Updated versions of GitLab Community Edition (CE) and Enterprise Edition (EE) have been released. These versions contain important bug and security fixes, and Gitlab strongly recommends that all self-managed GitLab installations be upgraded immediately.
ASB-2026.0251 – Microsoft Windows: CVSS (Max): 9.8
Microsoft has released its monthly security patch updates for the month of October, 2026. This Microsoft Windows update resolves 11125 vulnerabilities and Microsoft recommends updating the software with the version made available on the Microsoft Update Catalogue
ESB-2026.12603 – Citrix XenServer: CVSS (Max): 8.8
Citrix have provided security updates that address several issues that affect Citrix XenServer.
ESB-2026.12645 – Zoom: CVSS (Max): 8.1
Zoom have provided updates that address an Improper Authorization in Handler for Custom URL Scheme vulnerability in Zoom Workplace for Android.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
