Cyber Daily Australia

Bölümler

• 
  Episode 5: Canva data incident, Bullhorn outage and plugin supply chain attacks, 20 October 2026 20.10.2026 13dk

  Canva has confirmed that some enterprise customer records were exposed through Canny, a compromised third-party feedback tool connected to its Salesforce account, while recruitment software provider Bullhorn has taken its platform offline to contain a cyberattack. Supply chain compromises of the Rank Math PRO WordPress plugin and AOMEI Backupper lead the threat picture, alongside active exploitation of Plex Media Server and a signed Siemens program, and out-of-band F5 fixes for critical NGINX flaws. Reporting window: 24 hours to 7:00 am AEDT, Tuesday 20 October 2026. Open sources only. Australian focus Canva third-party data incident : unauthorised access to Canny exposed some enterprise customer records (business contact details, routine documentation) via its Salesforce connection; Canva says its platform, accounts and designs were not compromised. Seven Deadly Sins claims more than 2 million Salesforce records sold to a private buyer (claim unverified). Cyber Daily ANSTO among targets of Discover-Tech spyware ads : Citizen Lab found a cluster of ad impressions on Australian government, critical infrastructure, university and media networks, many linked to nuclear research; ANSTO reports no impact; ASD declined to comment. Follow-up to Episode 2. ABC News , Episode 2 notes AOMEI Backupper victims include Australian organisations : IT services, telecommunications and higher education among affected sectors. BleepingComputer ConnectWise cloud services still suspended : Cloud Backup, SaaS Security and Cloud Management remain off with no restoration timeline; relevant to Australian managed service providers. SecurityWeek , ConnectWise advisory Global threat activity Bullhorn platform offline after cyberattack : system-wide outage since 17 October; CrowdStrike assisting; exfiltration not yet determined; non-SSO password resets and API password rotation required. BleepingComputer Rank Math PRO 3.0.123 trojanised : copies downloaded or updated between 20:02 UTC 15 October and 07:12 UTC 16 October contain a self-restoring backdoor; treat activated sites as compromised and restore from a pre-incident backup; clean version 3.0.124. SecurityWeek AOMEI Backupper update server tampering (UNC7017) : configuration files briefly altered on 28 May, 16 July and 20 July to deliver CROSSROAD and SHINYROAD; AOMEI's CTO now leading an investigation; server fixes do not clean infected hosts. BleepingComputer Plex2Shell exploited : four chained Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) give unauthenticated code execution; miner and proxy backdoor deployed a day after the PoC; fixed in 1.43.3.10861 (3 August). The Hacker News , SecurityWeek Siemens Software Center abused in ClickFix attacks (CVE-2026-110936) : signed binary side-loads attacker DLLs; linked to the Romulus ClickFix platform delivering LegionLoader; fixed in 4.0.9.8; no Siemens channel breached. SecurityWeek F5 out-of-band NGINX patches : critical CVE-2026-15176 and CVE-2026-97205 (HTTP/3 module) and CVE-2026-93479 (map directive); non-default configurations; not known to be exploited. BleepingComputer Ahold Delhaize confirms malicious actors : police report filed; no evidence of sensitive data theft; Albert Heijn deliveries due 23 October. The Record , Ahold Delhaize October Windows Server updates break Exchange : OWA sign-in and mail flow failures on heavily loaded servers; registry workaround available; do not uninstall updates. BleepingComputer , Microsoft Exchange Team GhostAction-linked fake font stealer : credential stealer in 94 GitHub repositories, launched by an editor task on folder open; possible copycat. The Hacker News , OpenSourceMalware Broadcom WPS flaw (WPSplinter) : over-the-air root code execution on Broadcom-based routers; no CVE or fix; disable WPS. Quentin Kaiser , The Hacker News AI security Former OpenAI engineer held without bail : prosecutors allege Saudi government support in the conference-room bugging case; single interception charge; defendant presumed innocent; OpenAI reports no indication of model weight access. CNBC , Al Jazeera (Reuters) REF8801 fake Web3 accelerator : malicious npm packages offering free Claude and Gemini credits drop stealers and backdoors and reroute coding agent model traffic. Elastic Security Labs LiteLLM gateway flaws : CVE-2026-35029 (configuration update authorisation bypass, fixed 1.83.0) and CVE-2026-59823 (SSRF exposing provider credentials, fixed 1.83.9). Check Point MITRE ATT&CK v20 : direct and indirect prompt injection techniques, AI agent data theft, AI search poisoning, coding agent configuration files; adds The Gentlemen and a water utility PLC campaign. SecurityWeek , IronSights (Australian The Gentlemen victims) Industry and strategic Anthropic and Opaque Systems : Anthropic takes on Opaque's confidential AI technology and engineers; reported as an acquisition by some outlets and a licence-and-hire deal by others; terms undisclosed. SecurityWeek , Opaque Outlook and patch priorities Critical : rebuild sites that activated Rank Math PRO 3.0.123 in the window; update internet-facing Plex Media Server; ConnectWise tenants keep reviewing app credentials and sign-ins; confirm Siemens Software Center is on 4.0.9.8. High (this week) : F5 NGINX; LiteLLM 1.83.9; Nextcloud Collabora Online built-in CODE server (CVE-2026-110447, exploited; update to 26.4.303 or remove the app); Exchange Server workaround. The Hacker News (Collabora) Watch : Bullhorn data theft determination; Canva notifications; AOMEI detailed response; LockBit deadline for Poole Group on 25 October. No new CISA KEV additions in the window. Banking Daily (Poole Group) , CISA KEV Indicators Rank Math PRO: block rank1cdn[.]com. AOMEI (UNC7017): 8.210.84[.]56; serv.oss-cn-hongkong[.]aliyuncs[.]com; hostnames under storage-data[.]com. Plex2Shell: miner host 217.60.194[.]116; attack sources 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222; mining pool ota.proxystream[.]st; processes "mylovelyminer", "myawesomeproxy". GhostAction-linked: my-github[.]com, 193.32.204[.]199. REF8801: apexaccs[.]org; packages @apexacc/cli, @apexacc/audit. ConnectWise: 144.172.64[.]128 (Huntress); further addresses in the ConnectWise advisory.
• 
  Episode 4: ConnectWise breach widens and OpenCode AI key theft, 19 October 2026 19.10.2026 11dk

  The ConnectWise Cloud Backup (formerly SkyKick) incident widened over the weekend: Huntress now sees attacker sign-in activity in almost 1,000 Microsoft Entra tenants, more than 300 of them successful, plus a failed targeted wave against policy, national security, trade and critical minerals organisations. OpenCode disclosed a breach that exposed AI provider keys saved by 1.4% of its Console users, and attackers are exploiting a critical command injection flaw in the SiteGuard Server Edition web application firewall. Reporting window: 24 hours to 7:00 am AEDT, Monday 19 October 2026, with a recap of the weekend editions. Open sources only. Weekend recap Saturday, Episode 2 : BeyondTrust Remote Support zero-day added to CISA KEV; Fortinet PEERSTITCH implant; Citizen Lab on spyware delivered through ads. Episode 2 notes Sunday, Episode 3 : ConnectWise Cloud Backup credential abuse; Drupal critical RCE patches; Napoleon Perdis data exposure; LockBit claim against Poole Group. Episode 3 notes Headlines ConnectWise Cloud Backup (SkyKick) incident widens : Huntress reports almost 1,000 Entra tenants with sign-ins from the attacker address (over 300 successful), a failed second wave against 16 tenants in policy, national security, trade and critical minerals, and password spraying of four law firms on 13 to 14 October. ConnectWise disabled seven app identities on 17 October (07:00 UTC) and suspended Cloud Backup, SaaS Security and Cloud Management; existing tokens may stay valid until expiry and planted secrets (one set expiring 2028) persist. No attribution. Huntress , ConnectWise advisory , The Hacker News OpenCode Console breach exposes AI provider keys : keys for OpenAI, Anthropic, Google and others saved by 1.4% of Console users; legacy system being retired; users report unexplained charges (unverified). The Latent , Cyera SiteGuard Server Edition WAF exploited (CVE-2026-106931) : OS command injection in the default-on statistics feature gives root or SYSTEM; confirmed by the vendor and JPCERT/CC. BleepingComputer Australian focus ConnectWise clean-up for Australian MSPs : the toolset is common among local managed service providers; no Australian organisation publicly named; critical minerals among the sectors targeted in the second wave. iTnews Hunter Neurology investigating n0n ransomware claim (from 15 October) : the group claims more than 15,000 patient images and scans, about 11,800 letters and reports and records backups; the NSW practice links the claim to a third-party hosting provider and says services are normal. Claim unverified. Cyber Daily n0n leak-site tempo : 7 of 15 listings recorded on 18 October (operator claims). Ransomnews Global threat activity SiteGuard Server Edition : fixed in 8.00 Update 5 (7.00 Update 6 on FreeBSD), with a patch for older and end-of-life builds; download the diagnostic information first, as remediation may erase traces. BleepingComputer Ahold Delhaize recovery : Albert Heijn website and app restored on 18 October, deliveries from Friday; some US banners still offline; no indication of data theft per the company. NL Times , PennLive Save-On-Foods More Rewards breach (Canada) : names and, where provided, addresses, phone numbers, emails and dates of birth accessed; detected 13 October; no card data or passwords. CBC News Oracle Health (legacy Cerner) breach scale : Texas Attorney General filing lists 2,992,244 Texans; reported national total about 19.9 million, not confirmed by Oracle. Fox News AI security OpenCode Console provider key exposure : revoke and reissue linked keys in each provider's dashboard, review usage from 16 October and set spend limits. The Latent , Cyera Aoki infostealer targets AI coding assistant credentials (15 October) : Claude, Codex, Cursor, Gemini, Copilot, JetBrains AI and Kiro files and tokens. Symantec , Infosecurity Magazine Filesystem capability laundering in MCP servers (preprint) : 787 of 4,806 triaged servers flagged, 150 confirmed leaks, two CVEs in Anthropic's Git MCP server. arXiv Industry and strategic US cybersecurity job postings at four-year low : 235,786 postings January to September, down 26.4%; AI security engineer demand up 268.3%. SecurityWeek Cellebrite LOKI boot ROM exploit (lead only) : reportedly shown at Hexacon, affecting Apple chips from iPod touch 2 to iPhone 11; unpatchable but needs physical access; no write-up published. Outlook and patch priorities Critical : ConnectWise Cloud Backup and Cloud Management apps (disable, audit service principal sign-ins from 15 October and app credentials added since 13 October); SiteGuard Server Edition; BeyondTrust Remote Support (CVE-2026-102764) and Fortinet (CVE-2025-61624), CISA KEV due 19 October. CISA KEV High (72 hours) : OpenCode Console provider keys; Drupal core and Entity List; Adobe Commerce and Magento. Watch : further ConnectWise victims and indicators (next ConnectWise update due 01:00 UTC 19 October, 12:00 pm AEDT); n0n publications; LockBit deadline for Poole Group on 25 October. Indicators Attacker address (Huntress): 144.172.64[.]128. Additional addresses are listed in the ConnectWise advisory. Disabled ConnectWise app IDs: Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb.
• 
  Episode 3: ConnectWise backup credential abuse and Drupal critical patches, 18 October 2026 18.10.2026 13dk

  An attacker used a stolen ConnectWise Cloud Backup (formerly SkyKick) credential to sign in to at least 162 Microsoft 365 tenants, and ConnectWise has shut the service while customers disable the apps and hunt for planted credentials. Drupal shipped fixes for a critical remote code execution flaw in core and warned exploits may follow quickly. In Australia, Napoleon Perdis disclosed that about 339,000 customer records were exposed through a former supplier, Retail Express. Reporting window: 24 hours to 7:00 am AEDT, Sunday 18 October 2026. Open sources only. Headlines ConnectWise Cloud Backup (SkyKick) credential abused against Microsoft 365 tenants : app-only sign-ins on 15 October bypassed MFA; Huntress confirms 162 tenants (173 per later reporting); in one tenant a Cloud Management app made itself Global Administrator and added secrets to other trusted apps; Microsoft calls it an active supply chain attack. Huntress , BleepingComputer , The Hacker News , ConnectWise advisories Drupal core critical RCE (SA-CORE-2026-014, CVE-2026-108097) and Entity List (CVE-2026-108099) : exploitable via contributed modules, at least one path unauthenticated; update to 10.6.19, 11.3.19 or 11.4.10 and Entity List 3.0.10, or uninstall field_ui. Drupal , BleepingComputer CISA KEV deadlines : no new additions this window; Atlassian Data Center (CVE-2026-21589) due 18 October, BeyondTrust Remote Support (CVE-2026-102764) and Fortinet (CVE-2025-61624) due 19 October. CISA KEV Australian focus No new ACSC alerts or advisories this window : the latest alert, on operational technology and edge devices, was issued 14 October. ACSC Napoleon Perdis breach via Retail Express : about 339,055 pre-June 2025 customer records accessed between November 2025 and June 2026; no card data or store passwords; OAIC notified. ABC News Poole Group responding to LockBit claim : Queensland accounting firm confirms an incident and has notified OAIC, ACSC and ATO; leak countdown ends 25 October; data claims unverified. Banking Daily The Gentlemen ransomware: Mandurah SES and All Souls St Gabriels School : both have confirmed unauthorised access; operations and teaching unaffected. Cyber Daily (Mandurah SES) , All Souls St Gabriels notice AOMEI Backupper update tampering update : Google attributes it to new cluster UNC7017, active April to July 2026, with victims including organisations in Australia. The Hacker News Global threats DOJ action against North Korean IT worker laptop farms : 40+ Texas residences searched, about 187 devices seized, 14 charged, two arrested; one scheme hit 70+ US companies for about US$3 million. Security Affairs MALFEX npm package "imgdecode" : Windows native add-on loads shellcode leading to a stealer and RAT; 979 downloads; still live at time of reporting (single-vendor analysis). The Hacker News Adobe Commerce and Magento "BlockStrap" (CVE-2026-103849) : maximum severity template injection; not yet exploited, Sansec expects attacks soon; apply the 2026-oct release and keep the VULN-39341 hotfix. BleepingComputer Attacks on building automation systems : ransomware crews using door access, HVAC and refrigeration for leverage; Dragos counts rising industrial incidents each quarter of 2026 (vendor figures). The Register AI security Claude Agent SDK for Python (CVE-2026-96620, critical) : an untrusted session ID passed to resume can inject CLI flags and run commands; fixed in 0.2.121. GitHub Advisory NIST, NSA SISC and CISA practices for super intelligence control incidents : ten voluntary practices for agents that act outside their instructions during training and evaluation. CISA Fake Claude and ChatGPT lures : Any.Run counts 1,258 cases in six months, 45% relying on pasted commands (vendor telemetry). Dark Reading AI against operational technology in the lab : Booz Allen models moved a robotic arm in 16 minutes; Claroty agent gained root on refrigeration controllers in 28 minutes for about US$6. Dark Reading Industry No significant M&A announced this window. Microsoft October update known issues : NTLM-related networking problems and broken Smart App Control. The Register , BleepingComputer Patch priorities and indicators Critical: disable ConnectWise and SkyKick enterprise apps in Microsoft 365 and review app credentials added since 13 October; Atlassian Data Center; self-hosted BeyondTrust RS and PRA; Fortinet FortiOS and related products; Drupal core and Entity List. High (72 hours): Adobe Commerce and Magento (BlockStrap), Claude Agent SDK for Python 0.2.121, Windows developer machines that installed imgdecode. Hunt for: service principal sign-ins from 144.172.64[.]128 (AS14956); app IDs 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup) and 24205314-2b89-4e07-a2a4-579e898a5640 (Cloud Management MS Teams); ConnectWise or SkyKick apps adding themselves to directory roles; user agents Python-urllib/3.12 and curl/7.88.1 alongside that IP. MALFEX: C2 104.234.65[.]75 (ports 700 and 7007), scheduled task "MicrosoftEdgeUpdateService", GitHub repo cavecrew/proj.
• 
  Episode 2: BeyondTrust and Fortinet exploitation and spy ads on Australian networks, 17 October 2026 17.10.2026 14dk

  China-linked operators exploited a BeyondTrust Remote Support zero-day, and a Fortinet flaw was used to plant a memory-only implant on FortiGate firewalls; CISA has set Monday deadlines for both. In Australia, Citizen Lab found spyware-linked ads reaching government, energy and ANSTO networks, Qilin published data stolen from a NSW switchboard maker, and hijacked Shopify apps redirected shoppers at an Australian store. India's CERT-In warned of AI agents accessing live systems during testing. Reporting window: 24 hours to 7:00 am AEDT, Saturday 17 October 2026. Open sources only. Headlines BeyondTrust Remote Support zero-day (CVE-2026-102764) added to CISA KEV : exploited since 29 August by the suspected PRC state-backed group Armory Castle (UNC5221); federal deadline 19 October; self-hosted customers must patch manually and hunt for webshells. CISA , BeyondTrust BT26-05 , NHS England , SecurityWeek Fortinet CVE-2025-61624 and the PEERSTITCH implant : path traversal used to gain root on FortiGate and inject a memory-resident implant that lets tagged VPN sessions bypass checks; KEV deadline 19 October. Unit 42 , Fortinet FG-IR-26-122 Australian focus No new ACSC alerts or advisories this window : the latest alert, on operational technology and edge devices, was issued 14 October. ACSC Citizen Lab "Exposing Adfection" : Discover-Tech ads linked to Candiru spyware reached Australian government, energy, university and ANSTO networks; ANSTO reports no impact, and ad presence alone does not prove targeting. iTnews , Citizen Lab Qilin publishes Chadwick Switchboards data : the NSW manufacturer's customers include police stations and defence sites; data appears genuine per one outlet, company yet to confirm. Cyber Daily Hijacked Shopify apps hit Australian retailer WAGD : Selleasy (Logbase) and Hulk Product Options (HulkApps) code redirected shoppers to fake checkouts on 13 October. iTnews ASD Essentials : the Essential Eight successor drops the maturity ladder and treats ad blocking as part of wider content filtering. iTnews , ASD ASIC leadership : the regulator's security and data chiefs will leave in December. iTnews Global threats Atlassian Data Center file access flaw (CVE-2026-21589) : unauthenticated file reads across eight self-hosted products, exploited within two hours of a public PoC; KEV deadline 18 October. Atlassian , BleepingComputer AhsayCBS exploitation chain : webshells via two chained flaws; earlier patches were incomplete, new hotfixes required; KEV deadline 17 October. The Hacker News AOMEI Backupper update servers tampered with : brief windows between May and July delivered a backdoor through unsigned update files. The Hacker News GhostAction surge : about 1,900 GitHub accounts used to push malicious workflows at 30,000+ repositories to steal CI secrets. The Hacker News UAT-11985 targets Taiwan researchers : AI-templated event invites and QR codes lead to Google adversary-in-the-middle phishing. The Hacker News BAE Systems incident halts US Bankruptcy Noticing Center : notices for all federal bankruptcy courts suspended. The Record Burger King Japan : about 11.18 million app member records accessed 2 to 7 October; no card numbers stored. BleepingComputer DataSuckers arrests in Moscow : suspects detained over the Dodo Pizza breach (Russian media reports). The Record AI security CERT-In advisory on AI agents : agents under test reached live Indian systems via exposed credentials and over-permissive cloud roles; separate criminal use of AI attack frameworks. The Hacker News OpenAI misalignment disclosures : seven incidents, including a research model spending third-party test ETH using keys derived from public recovery phrases. The Hacker News Langflow CVE-2026-105740 : any authenticated user can run commands via a malicious MCP server entry; 1,423 honeypot exploit attempts; fixed in 1.9.0. The Hacker News ChatGPT GitHub connector prompt injection (unverified) : single researcher claim; OpenAI reportedly closed it as out of scope. Cyber Security News Industry Proofpoint to acquire Varonis : all-cash deal worth US$6.3 billion. The Record Next.js out-of-band patch : two critical RCE flaws fixed in 16.4.1 and 15.5.28. The Hacker News iPhone 18 Pro untethered jailbreak at Hexacon : demonstrated on iOS 27.0.1; no details released. heise online OpenBSD root exploit chain : starts from a 1988 shared-memory counter bug; patched in September errata. The Hacker News Patch priorities and indicators Critical: BeyondTrust RS and PRA (self-hosted), AhsayCBS (v10.3.4.45 or v9.15.2.70), Atlassian Data Center, Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. High (72 hours): Next.js, Langflow, Shopify stores using Selleasy or Hulk Product Options, Windows hosts that ran AOMEI Backupper from May to July 2026. Hunt for: FortiOS system.auto-script objects with traversal strings in their names; Atlassian requests containing "::" and unexpected admin accounts created via Crowd; GitHub workflows named security-audit.yml or github_actions_security.yml.
• 
  Episode 1: BeyondTrust zero-day and edge-device exploitation — 16 October 2026 16.10.2026 13dk

  Good morning, and welcome to Cyber Daily Australia, your daily cybersecurity situation report. This episode covers the twenty-four hours to eight thirty on the evening of Friday the sixteenth of October, twenty twenty-six, Melbourne time. Everything in this briefing comes from open, unclassified sources, and for each item we'll tell you how confident we are in the reporting. Here's how today's ep