Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
Paragraph 1 — Top Stories: The day's defining story is the active exploitation of a chain of three Ivanti Connect Secure zero-days for unauthenticated root-level remote code execution on fully patched VPN appliances. Volexity (tracks the actor as UTA0576) reports the attacker used the chain — an authentication bypass plus remote code execution (both CVE-2026-104935), and a privilege escalation that is *still unpatched* — to steal Active Directory credentials, LAPS passwords and BitLocker recovery keys, while stripping its own traces from Ivanti and Linux audit logs. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October; only two of the three flaws have fixes. Alongside it, a harsh supply-chain day: Docker confirmed a critical Hub flaw (CVE-2026-105445, "GhostPAT") that let a PAT re-assigned to a new organisation owner act as the target user and pull, push or delete container images; GitHub tightened npm Trusted Publishing after Bloom Security found 1,500+ packages left vulnerable to hijack; and a ~24-package RubyGems crypto/web3 supply-chain cluster was verified as malicious. Retail and healthcare both took operational hits: UK fashion group TFG London took systems offline across its Phase Eight, Hobbs and Whistles brands after a cyberattack, and three US healthcare entities disclosed data breaches involving ransomware claims (Photon Health, Healthcare Highways, Any-Time Home Care). Paragraph 2 — Australian & New Zealand Context: There is no new ACSC advisory or alert published within the 48-hour window — the newest Australian listing remains the 9 October ACSC advisory (jointly with the CISA "AA26-281A") on Chinese government-linked actors combining automated and hands-on hacking tools to steal sensitive data, which stands as the key standing guidance for Australian organisations. The Ivanti chain is materially relevant: Connect Secure is widely deployed across Australian government and enterprise, the to-be-patched privilege escalation means remediation is incomplete, and CISA's KEV addition should trigger immediate patch-first action under ASD guidance. On the thin-but-notable AI front, iTnews reports Defence is staying quiet on Australia's role and spend in Project Arcadia, the US-led Five Eyes AI-warfare data program Australia will host in Sydney in November. Finance- and retail-facing SAP Cloud SDK and Docker/PAT exposures touch Australian application and container estates. In New Zealand, there are no new Privacy Commissioner notifications (newest website listing is 5 October, an overseas-parented organisation and a law-firm email breach) and no fresh NZ Police cybercrime releases — the negative is evidenced by direct checks of the OPC and Police publication listings, with CERT NZ unreachable. The closest allied/regional angle is the Kimsuky campaign against Ukrainian foreign-policy experts, a reminder of Five Eyes current-threat exposure. Paragraph 3 — Geopolitical Context & Weekly Trends: For the week to 13 October (8–13 October, 74 stories ingested across 10 sectors), ransomware (21 stories) and breach/data leak (14) again dominated, with zero-day/vulnerability (13) and malware (8) close behind; the US was the largest geo category (42), followed by Australia (15) and Global (10). The week's clearest thread is a "patch-first CVSS-10 wave": GitLab's regex-compiler RCE, SonicWall SMA1000 and the Bricksforge WordPress flaw were all actively exploited zero-days, and the Ivanti chain extends that pattern to VPN security with a KEV flag within a day of public disclosure — and with a fourth, unpatched privilege escalation still live, follow-on exploitation is likely before the fix ships "in the coming weeks". A second thread is supply-chain architecture: Docker's PAT-reassignment design flaw, the npm Trusted Publishing validation gap, and the RubyGems crypto cluster all implicate how package registries handle identity and consent. A third is living-off-the-cloud espionage: Kimsuky's "Operation GitPower" is distributing malware and using GitHub, GitLab and Codeberg for command-and-control. Emerging risk for the week ahead: expect pressure on registry vendors to overhaul token/PAT and publisher-consent models, and heightened scrutiny of AI-agent sandboxes after AIR Security's Vercel "VerCellBreak" allowlist-bypass disclosure.
No new ACSC advisory, alert or dated publication within the 48-hour window — the newest listing (checked across all three ACSC surfaces: access-publications-and-alerts, alerts-and-advisories and news) is the 9 October advisory on Chinese government-linked threat actors combining automated and hands-on hacking tools to steal sensitive data, published jointly with CISA as advisory AA26-281A. That advisory stands as the primary current national guidance. The Ivanti Connect Secure chain is the immediate Australian concern: Connect Secure is a staple of government and enterprise perimeter stacks, the remediation is incomplete (the privilege-escalation component is unpatched), and CISA's KEV addition on 13 October makes Australian patch-first action urgent. The Docker Hub "GhostPAT" issue and the SAP Cloud SDK CVSS-10 OAuth2 SSRF are both configuration-adjacent vulnerabilities likely present in Australian application and banking/BTP estates. On AI: iTnews (13 October) reports Defence is not disclosing Australia's spend on Project Arcadia, the US-led effort to pool Five Eyes military data into an AI-ready battlefield picture that Australia will host in Sydney in November — a national-significance transparency story with direct REDSPICE adjacency.
Week to 13 October (8–13 October): 74 stories, 10 sectors, 46% vendor/enterprise-patch-heavy. Top threat types: Ransomware (21), Breach / Data Leak (14), Zero-day / Vulnerability (13), Malware (8). Top geographies: US (42), Australia (15), Global (10), APAC (6). The dominant trend is a sustained wave of actively exploited, maximum-severity zero-days — this week GitLab, SonicWall SMA1000, Bricksforge and now Ivanti Connect Secure — with CISA's KEV catalogue flagging Ivanti's CVE-2026-104935 within a day of disclosure. The supply chain absorbed a second straight day of registry identity/consent failures (Docker PAT reassignment, npm Trusted Publishing validation, RubyGems crypto cluster). Adversary tooling continues to "live off" legitimate developer platforms: Kimsuky's Operation GitPower runs C2 through GitHub/GitLab/Codeberg. AI-agent containment is a rising theme, from OpenAI/Hugging Face events earlier in the year to this week's Vercel "VerCellBreak" sandbox escape. Emerging risk for the week ahead: the unpatched Ivanti privilege escalation invites follow-on exploitation before Ivanti ships its fix; expect registry vendors to face pressure to redesign PAT and publisher-consent flows; and expect more disclosures of agent-sandbox bypasses as platforms run hardening bounties.
Incident Map
Geopolitical Context & Weekly Trends 7 stories
Attacker chains three Ivanti Connect Secure zero-days for root-level access — only two patched so far
A previously unknown threat actor (Volexity tracks it as UTA0576) has been actively exploiting a chain of three zero-days in Ivanti Connect Secure (ICS) VPN appliances since 3 October to achieve unauthenticated root-level remote code execution, including against the recent fully patched build 22.8R2.4. The chain combines an authentication bypass and a race-condition remote code execution (both tracked as CVE-2026-104935, fixed in the 13 October patches) with a privilege-escalation flaw in how the `dsinvoked` broker trusts DSCache configuration — the third component remains unpatched, with Ivanti targeting it for "the coming weeks". Post-exploitation focused on credential theft from Active Directory: Volexity observed a custom Kerberos tool for Kerberoasting, LAPS password and BitLocker recovery-key hunts via LDAP, password spraying and exfiltration of AD metadata. The actor used in-memory-only implants and deleted its own Ivanti debug and Linux audit log entries, defeating Ivanti's Integrity Checker Tool and making forensic discovery necessary. CISA added CVE-2026-104935 to the KEV catalogue on 13 October. Organisations running ICS should patch immediately, treat the unpatched privilege escalation as a live risk, and forensically investigate any instance where lateral movement from the VPN device is suspected.
Docker Hub 'GhostPAT' flaw (CVE-2026-105445) let attackers impersonate users and tamper with container images
Docker disclosed a critical vulnerability in Docker Hub that let an attacker reassign a personal access token (PAT) to a designated organisation owner without changing the secret or obtaining consent, thereby authenticating as the target user at registry level. Exploited by creating an account and PAT, converting the account into an organisation, and naming the victim as its owner, the flaw enabled the attacker to pull, push or delete images in the target's repositories and organisations they could access — a software supply-chain risk because images could be pushed under a legitimate name. Docker rated it critical, confirmed that the transferred PATs were deactivated on 8 October (except where owners opted to retain them) and reported no evidence of exploitation after reviewing 304,000 affected pushes. The registry no longer transfers PATs during conversion and now requests user consent before naming anyone an organisation owner. Organisations should rotate any Docker PATs tied to account-to-organisation conversions and audit image-tamper exposure.
~24 malicious RubyGems crypto/web3 packages verified as credential-stealing supply-chain cluster
The Open Source Malware (OSM) watch archive marked a coordinated cluster of roughly two dozen RubyGems packages (including `wallet-balance-scanner`, `xrp-ledger-utils`, `web3-signer-kit`, `hd-wallet-generator` and `seed-phrase-validator`) as 🆕 added to the local archive on 13 October, all rated critical. Analysis of representative gempackages found a declared native-extension build script (`extconf.rb`) that decodes and `eval()`s a Base64 payload — opening a TCP socket to a hardcoded remote host (45.138.12.177:8089) and piping `/bin/sh` over it for an interactive reverse shell, with heavy anti-sandbox evasion (CI checks, hostname/username filters, uptime and developer-signature paths). The packages present crypto/web3 seed-generation and wallet tooling, making them attractive to developers handling keys and recovery phrases. This is the latest echo of a persistent trend of blockchain-adjacent supply-chain malware. Users should audit any recently installed RubyGem in this naming space, rotate any credentials/seed material touched by affected tooling, and rely on verified package versions.
SAP discloses maximum-severity (CVSS 10.0) OAuth2 SSRF in Cloud SDK for Python allowing credential theft
SAP's October patch day (13 October) addressed 20 flaws including a maximum-severity OAuth2 server-side request forgery in the SAP Cloud SDK for Python (CVE-2026-89111, CVSS 10.0), affecting versions before 0.45.2. The SDK is SAP's official toolkit for building AI agents and Python applications on SAP Business Technology Platform (BTP) services. The vulnerability affects multi-tenant BTP applications: an attacker who controls the `tenant_subdomain` parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. SAP released 0.45.2 on 21 August with a strict check that tenant subdomains contain only letters, numbers and hyphens (up to 63 characters); passing URL delimiters now raises `ValueError` immediately instead of routing credentials to an attacker-controlled endpoint. Onapsis estimated over 10,000 internet-facing SAP systems use the vulnerable component. No evidence of in-the-wild exploitation has been reported. Financial-services organisations running SAP BTP should update the SDK to 0.45.2+ and monitor OAuth2 token requests for redirection to unexpected servers.
TFG London cyberattack takes Phase Eight, Hobbs and Whistles systems offline
South Africa's The Foschini Group (TFG) confirmed a cybersecurity incident at its UK subsidiary TFG London, first identified on Sunday 11 October, that affected "certain of its IT systems" supporting the Phase Eight, Hobbs and Whistles brands. Several systems remained unavailable two days on, some website functions were impaired, and customers were warned of order delays; stores remained open. TFG said it activated incident response and business continuity plans, engaged external specialists and notified the relevant UK authorities, while still working to establish whether any personal or sensitive information had been compromised. The incident is the second UK retailer cyberattack within a week, following ASOS, where an attacker impersonated a trusted contact to obtain login credentials for third-party platforms holding customer names and contact details; H&M separately said it was investigating reports it was targeted. No evidence currently links the three incidents, and TFG has neither confirmed any data compromise nor disclosed attribution. Customers of affected brands should monitor for phishing exploiting the disruption.
Photon Health, Healthcare Highways and Any-Time Home Care disclose data security incidents
Three US healthcare entities disclosed data breaches via the HIPAA Journal on 13 October. Photon Health (Brooklyn-based prescription network) confirmed a threat actor exploited a previously unknown zero-day in its self-hosted Metabase business-intelligence instance (learned 21 August), gaining access it said could have been exfiltrated; exposed data includes names, addresses, phone numbers, birth dates and prescription information, with notification letters mailed from 8 October. The Direwolf ransomware-and-extortion group claimed responsibility. Healthcare Highways (Frisco-based medical provider network and health plan administrator) confirmed unauthorised network access between 22–27 July; exposed data includes Social Security numbers, patient IDs, diagnoses, claims and payment information, with Chaos ransomware claiming responsibility and saying it exfiltrated 235 GB. Any-Time Home Care (New York home health agency) confirmed a ransomware attack traced to around 17 March that ultimately affected 30,017 individuals, including names, health information and Social Security numbers, with 24 months of credit monitoring offered. All three have confirmed breach status via notification or incident disclosure; affected-individual counts remain partially undisclosed pending OCR portal publication.
Indicators of compromise · Chaos — 4 shown
8cd11b6e3504363d2818cfa541698af18f80be3552e038dfa9369c0ba28c6817a1cdb7f8862d5ff9abd16757a60f4e1bbaa18a650de89904c94aa351174e405b4a94ce0d72ff3442ca640c28d4c5f7abd3c40fd36abebfaf9f5cdbee6ceae24e782815d50e36c4568378c81db487a01acef0fae9b9685881c03e60c2b39f2baa
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
North Korean Kimsuky hackers target Ukrainian experts in 'Operation GitPower' espionage campaign
South Korean firm Genians (report published Monday) said North Korean state-sponsored group Kimsuky has been targeting Ukrainian experts in diplomacy, security and international policy for intelligence on Russia's war with Ukraine, which North Korea has supported with troops and materiel since 2024. The campaign uses fake conference invitations, research-collaboration requests and weaponised documents — including a lured story posing as a cybersecurity-conference organiser in Seoul and a European policy researcher seeking feedback on Russia–North Korea cooperation — then delivers malicious archives, PDFs and Trojansed Zoom installers. The malware collects data, maintains access and exfiltrates to attacker infrastructure, with the cluster tracked as Operation GitPower for heavy use of legitimate developer platforms (GitHub, GitLab, Codeberg) to distribute files and communicate with compromised systems. Attacks are reported as largely unsuccessful, but the targeting of Ukrainian security experts and the questioning of North Korean POWs (two transferred to South Korea in September) underscores intelligence interest. Proofpoint characterises the operation as political/strategic intelligence collection, distinct from Russian tactical battlefield targeting.
Indicators of compromise · Kimsuky — 2 shown
inini[.]kesug[.]comhxxp://inini[.]kesug[.]com/uploads/payload[.]txt
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →