30 Oct 2026
Week in review
Greetings,
Several major Australian holiday park operators have warned customers about fraudulent emails and messages following a cyber incident affecting booking software provider RMS Cloud. Threat actors reportedly leveraged guest booking information to deliver convincing phishing communications requesting payment and credit card details.
The incident highlights the growing risk posed by third-party providers, where a compromise of a trusted supplier can expose customer data and enable highly targeted social engineering attacks. Organisations should use this as a reminder to review supplier risk management processes, strengthen customer communication plans, and ensure staff and customers can identify and conveniently report suspicious requests for sensitive information.
A breach doesn't need to occur within your own environment to impact your customers and your reputation. Third-party risk management remains a critical component of cyber resilience.
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Date: 2026-10-24
Author: The Hacker News
[See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0286]
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.
Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Date: 2026-10-28
Author: The Hacker News
[AUSCERT has notified potentially affected members via a Critical MSIN. Also, see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2026.0261/]
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update.
PHP2Shell security flaws now sucessfully exploited in the wild
Date: 2026-10-26
Author: Bleeping Computer
[See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0252.2]
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.
"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Date: 2026-10-25
Author: The Hacker News
[See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0252.2]
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said.
"They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation."
Report: Aussie cyber agency received more than 82k cyber crime reports in 12 months
Date: 2026-10-27
Author: Cyber Daily
The stark new warning is based on the ASD’s seventh Annual Cyber Threat Report, covering the 2025–26 financial year.
In that time, the ASD’s Australian Cyber Security Centre (ACSC) fielded over 82,000 cyber crime reports – about one every six minutes.
In addition, the agency responded to more than 1,500 cyber security incidents and notified more than 4,400 Australian organisations of potentially malicious activity.
ASB-2026.0286 – Brotli Decoder: CVSS (Max): 9.2
A severe memory-corruption vulnerability that exists in Google's reference Brotli decompression library affects a wide array of popular software ecosystems including Node.js, Bun, Envoy, Istio, and Python packages (Brotli and Brotlicffi). Fixed versions have been provided for each affected framework allowing organisations to independently update every impacted runtime or dependency.
ESB-2026.13343 – Tenable Network Monitor: CVSS (Max): 9.8
Tenable have provided fixes for Tenable Network Monitor addressing multiple vulnerabilities found in several of their third-party components (OpenSSL, curl, expat, libxml2).
ESB-2026.13329 – Apple iOS & iPadOS: CVSS (Max): 8.8
Apple have released software updates to address issues in iOS & iPadOS. Apple recommend applying these updates immediately if possible.
ESB-2026.13471 – VMware Cloud Foundation: CVSS (Max): 9.8
Node.js as used in SDDC manager contains a RCE vulnerability due to an out-of-bounds write issue in Brotli decoder. The Broadcom Response Matrix shows that fixed versions for this 'Critical' severity vulnerability are pending.
ESB-2026.13388 – Adobe Campaign Classic: CVSS (Max): 10.0
Adobe has released a priority 2 security update for Adobe Campaign Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution, security feature bypass, and privilege escalation.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
