21 Aug 2026
Week in review
Greetings,
AUSCERT is proud to be part of the Not-For-Profit Cyber Uplift Community of Practice, launched by the Australian Department of Home Affairs in partnership with the Australian Charities and Not-for-profits Commission. The free launch event will take place on Wednesday, 26 August 2026, from 1PM–2PM AEST, providing not-for-profit organisations with practical advice, knowledge and support to strengthen cyber resilience across the sector. Register here
The importance of strengthening cyber resilience is particularly timely, with a large-scale data theft campaign reportedly targeting Azure/Entra environments belonging to major organisations, including McDonald’s, TCS, Vodafone and Kyndryl. The campaign is linked to a new threat actor known as TheHatman, who claims to have stolen millions of enterprise records.
While the initial access vector remains unconfirmed, reported possibilities include stolen credentials or session cookies, phishing, weak or missing MFA, and overly permissive third-party applications. The activity does not currently appear to exploit an Azure vulnerability, with compromised credentials a key concern.
The incident highlights how stolen organisational information including employee details, reporting structures, service accounts and privileged account information could enable highly targeted phishing, impersonation and business email compromise attacks. It reinforces the importance of phishing-resistant MFA, protecting cloud credentials and session tokens, detecting infostealer infections, reviewing third-party application permissions and monitoring unusual activity across Azure/Entra environments.
Together, these developments highlight why practical cyber resilience initiatives are essential for organisations of all sizes.
…
Critical Citrix NetScaler Flaw Lets Remote Attackers Bypass Authentication Without Credentials
Date: 2026-08-19
Author: Cyber Security News
[See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.9740/]
Cloud Software Group has issued a critical security bulletin warning customers of two serious vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway).
Tracked as CVE-2026-19489 and CVE-2026-19490, the flaws could allow attackers to trigger denial-of-service conditions or bypass authentication entirely on unpatched appliances, putting enterprise remote access infrastructure at significant risk.
Hackers Exploiting Unpatched GeoServer Zero-Day
Date: 2026-08-14
Author: Security Week
The security defect is described as an SQL injection that could allow attackers to achieve remote code execution.
Threat actors started exploiting an unpatched zero-day vulnerability in GeoServer hours after it was publicly disclosed, attack surface management firm WatchTowr says.
The security defect, described as an SQL injection issue that could be exploited to achieve remote code execution (RCE), was disclosed on Wednesday by a security researcher named q1uf3ng.
According to the researcher’s post on X, the flaw affects GeoServer’s jsonArrayContains function, a filter expression for querying JSON array fields to check if they contain specific values. It can be used with PostGIS and Oracle JDBC data stores.
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Date: 2026-08-17
Author: The Hacker News
[Please see AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.9629/]
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data.
The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4.
Hacker claims 3.6 million Azure account records stolen from major companies
Date: 2026-08-17
Author: Bleeping Computer
A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials.
Starting July 31st, multiple posts from someone using the alias “TheHatman” advertised data dumps from major organizations, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels (IHG), and Kyndryl.
In total, the threat actor claims to have 3.64 million data records, with the most recent breach posted on Sunday, containing an alleged 1.7 million employee records from McDonalds.
CISA: Windows Task Host flaw now exploited by ransomware gangs
Date: 2026-08-18
Author: Bleeping Computer
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April.
Task Host is a core Windows system component that allows DLL-based processes to run in the background and prevents data corruption by ensuring they close properly during shutdown.
Tracked as CVE-2025-60710, this Windows privilege escalation security flaw was patched by Microsoft in November 2025 and stems from a link following weakness that affects Windows 11 and Windows Server 2025 devices.
ESB-2026.9629 – GitLab Community & Enterprise Edition: CVSS (Max): 9.4
GitLab released versions which contain important bug and security fixes for GitLab Community Edition (CE) and Enterprise Edition (EE)
ESB-2026.9641 – iOS 18.7.10 and iPadOS: CVSS (Max): 9.8
Multiple vulnerabilities affecting iOS and iPadOS have been addressed by Apple
ASB-2026.0202 – Oracle E-Business Suite: CVSS (Max): 9.8
This Critical Security Patch Update contains 120 new security patches for Oracle E-Business Suite
ESB-2026.9713 – Cisco Secure Workload Software: CVSS (Max): 10.0
Cisco has released software updates that address vulnerabilities that affect Cisco Secure Workload Software (SaaS)
ESB-2026.9752 – Splunk Enterprise: CVSS (Max): 9.8
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions
Stay safe, stay patched and have a good weekend!
The AUSCERT team
