Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
Australia's seventh Annual Cyber Threat Report leads today, and it is a record of scale rather than of any single intrusion: the Australian Signals Directorate's ACSC logged more than 82,000 cybercrime reports in FY2025-26 — one every six minutes — responded to over 1,500 cyber security incidents, and sent more than 4,400 notifications to Australian entities about potentially malicious activity, an increase of almost 80% on the previous year. Artificial intelligence is the report's organising theme. In the United States, CISA published "CISA 2030: Defend, Harden, Prevail", a ten-page strategy that reaffirms its critical-infrastructure remit and starts a 60-day review of its own capabilities. Identity remained the week's softest surface: Huntress disclosed a Microsoft 365 "token spraying" campaign that replayed stolen sign-in tokens to compromise 97 accounts across 79 organisations out of more than 200,000 login attempts, and a separate Wiz investigation found more than 13,500 rogue branches planted in GitHub repositories to print repository secrets into Actions logs. And a web-skimming operation running since July 2025 has now infected 953 online stores, almost all on Magento, hiding scanner-evading JavaScript inside CMS blocks.
The Annual Cyber Threat Report is the day's substantive Australian story, and its detail matters more than its headline. Beyond the 82,000 reports, 1,500-plus incidents and 4,400-plus notifications, ASD's ACSC recorded that notifications now split across more than 2,200 individual notifications and collective notifications issued to more than 2,100 entities; that the 80% notification increase reflects a detection-tempo change as much as a threat change; that state-sponsored actors are increasingly seeking to pre-position inside Australian networks — including critical infrastructure, private business and individuals — for later intelligence collection or disruption; and that compromised accounts and credentials were among the most frequently reported incident categories across government, industry and critical infrastructure. On the same subject the ACSC's three public listings carry nothing newer than today's report release itself — the most recent alert remains 23 October's Fortinet advisory and the 21 October PHP alert, both already covered — and CISA's Known Exploited Vulnerabilities catalogue is unchanged since its 2026.10.23 update, so no new CISA KEV deadline fell due overnight. Two local items deserve attention alongside it. First, iTnews disclosed at Senate estimates that the Parliamentary Information and Cyber Resilience project carries a $40 million budget over four years across three streams — information assurance, cyber lift and PCN activation — a figure withheld from the budget papers. Second, the PHP project has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, the Brotli compression flaw rated 9.2 by Google, five days after the PHP2Shell releases; because the PHP version itself is unchanged, the only reliable way to identify the fixed build is the "-1" suffix and the published SHA-256 — and Guzzle's default cURL settings meet the condition for reaching the flaw, so Australian estates rebuilding Windows PHP images should verify the hash rather than trust `php -v`.
Across the seven days to 26 October (20–26 October) the corpus logged 100 stories, led by breach and data-leak coverage (29), zero-day and vulnerability reporting (23), malware (18) and ransomware (12), with phishing and BEC at 5, AI-security items at 5, APT/nation-state reporting at 4 and OT/ICS at 2. US-centred stories accounted for 51, global or cross-border items 32, Australian-relevant stories 11, Europe 4 and APAC 2. Four trends define the week. First, PHP2Shell has stopped being a story about PHP and become a story about everything that embeds it: Siemens ProductCERT published portfolio impact assessments for the two RCE flaws on 26 October, PHP rebuilt its Windows packages around the Brotli flaw five days after the original releases, Qualys published stopgap guidance for organisations that cannot patch yet, and the third flaw, CVE-2026-115560, remains unpatched — the divergence between vendor severity scores (Google rates CVE-2026-111497 9.2 Critical on CVSS 4.0; Red Hat rates it 8.1 Important on 3.1) shows how unstable the "critical" label has become as a triage input. Second, identity is consolidating as the primary attack surface: Huntress's Microsoft 365 token-replay campaign replayed stolen session tokens rather than cracking passwords and registered 48 rogue Entra devices; the ACSC's own report names compromised accounts and credentials as a leading incident category; and Fortinet's weekly advisory batch closed out a set of access-control and authentication flaws across its management interfaces. Third, the software supply chain stayed the fastest-moving front — Wiz's Gheist campaign, NuGet packages carrying MSBuild build hooks that execute PowerShell on every consumer build, and the LiteLLM master key that survived revocation — all point at build and release pipelines rather than endpoints. Fourth, AI-security work split cleanly into two registers: measurement (Anthropic's safeguards accounting for Claude Duet, Elastic's analysis of Microsoft's Windows Endpoint Security Platform driver) and litigation (Texas's consumer-protection suit against OpenAI and Sam Altman). Watch this week for a patch for CVE-2026-115560, whether the Collabora and VeloCloud KEV deadlines produce federal follow-on advisories, and whether the token-spraying technique spreads beyond Microsoft 365 into other federated identity providers.
Incident Map
Government 3 stories
ASD's seventh Annual Cyber Threat Report logs 82,000 cybercrime reports and an 80% surge in malicious-activity notifications
The Australian Signals Directorate released its seventh Annual Cyber Threat Report (ACTR) 2025-26 on 27 October, covering the 2025-26 financial year. ASD's ACSC received more than 82,000 cybercrime reports — averaging one every six minutes — responded to more than 1,500 cyber security incidents, a 20% increase on FY2024-25 and 36% above the level of five years ago, and notified entities more than 4,400 times about potentially malicious activity, almost an 80% increase, split across more than 2,200 individual notifications and collective notifications to more than 2,100 entities. AI is the report's organising theme: ASD states that AI has allowed malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication, and that in recent weeks new threats have emerged from the unintended actions of AI agents and model testing. State-sponsored actors are increasingly seeking to pre-position inside Australian networks for future intelligence collection or disruption, and compromised accounts and credentials were among the most frequently reported incident categories across government, industry and critical infrastructure. Deputy Prime Minister Richard Marles wrote the foreword.
CISA publishes "CISA 2030: Defend, Harden, Prevail" and starts a 60-day review of its own capabilities
CISA published a ten-page strategy on 26 October that largely reaffirms its existing role while committing the agency to a review of whether its core services and capabilities still meet its objectives. The document, "CISA 2030: Defend, Harden, Prevail", sets out three pillars — defend, harden, prevail — prioritises protection of critical infrastructure, and promises resilience as the foundation of the approach rather than prevention. The review of core services is to be completed within 60 days, followed by implementation over 180 days and a progress update after one year. Acting director Nick Andersen wrote in the foreword that "the threat landscape we face today is not static" and that "there is no guarantee that a strong defense will eliminate intrusions", adding that the agency must be able to detect, evict and keep operations running when adversaries gain a foothold. The strategy is framed as aligning with the administration's wider cyber strategy published in March and last year's executive order on state and local preparedness.
Australian Parliament's cyber resilience programme has a $40m, four-year budget
The Parliamentary Information and Cyber Resilience project carries a budget of $40 million over four years, a figure withheld from the budget papers and disclosed by Nicola Hinder at Senate estimates. The programme is divided into three funding streams: information assurance, cyber lift, and PCN activation. The disclosure puts a number on a body of work that has been visible mainly through its deliverables — the Department of Parliamentary Services has been rebuilding the parliamentary network's security posture since the 2024 uplift programme — and it makes the programme one of the larger identifiable Australian public-sector cyber investments currently running outside Defence. The three-stream structure also shows the split between assurance work on parliamentary information, capability uplift across the parliamentary network, and the activation of the Parliamentary Computing Network itself, which is the part most directly tied to the sitting calendar.
Financial Services 1 story
Japan tells banks to review their cyber policies after a wave of attacks
Japan's financial regulator has instructed banks to review their cyber-security policies following a sustained wave of attacks on Japanese financial institutions and their customers. The push follows a period in which Japanese companies have been compensating customers for losses arising from cyberattacks, with the incidents weighing on the wider economy — 2026 has seen repeated intrusions at Japanese retailers, logistics operators and financial services firms, and the response has increasingly shifted from disclosure to remediation and restitution. The instruction to review policies is a supervisory action rather than a new rule, so it lands on each institution's own risk framework; in practice that means boards must be able to show documented review of authentication, third-party access and incident-response arrangements rather than simply confirming that controls exist. It is a notable divergence from the Australian posture in the same week, where ASD's annual report emphasises detection tempo and pre-positioning rather than direct supervisory pressure on a single sector.
Healthcare 1 story
Denver Health Medical Plan notifies 238,000 members after a vendor access key sat on a public website for 14 months
Denver Health Medical Plan, a non-profit health plan affiliated with the Denver Health and Hospital Authority, has notified 238,083 current and former members that a vendor-related incident exposed protected health information. The vendor, SquareML, which supplies an AI and machine-learning analytics platform, added an access key to a public website on 27 June 2025; the key remained there for more than a year and was not deactivated until 18 August 2026, four days after the health plan was notified. Exposure covered full names, city/state/ZIP, demographics, dates of birth, health plan eligibility, provider names, admission, discharge and transfer information, and health metrics including BMI, HbA1c and eGFR; financial data and Social Security numbers were not included. Denver Health says the key was read-only and it has found no evidence of misuse. Separately, Johns Hopkins Bayview Medical Center and BASS Medical Group announced breaches. The same day, Kroll's Data Breach Outlook 2026 reported that 69% of individuals affected by a breach in the past year were caught in a third-party or vendor incident, with 79% of those reached via a technology-sector vendor.
Retail & Entertainment & Sport 1 story
Web-skimming campaign has infected 953 online stores, almost all running Magento
Sansec, the Dutch e-commerce security firm, has attributed a long-running web-skimming campaign to a single unknown threat actor that has infected 953 online stores, most of them running Magento. The operator plants a small piece of code in Magento CMS blocks — the database table that renders static content such as headers, footers and promotional banners — and the block then makes the shopper's browser request instructions from the attacker's server. That server performs a visitor check first, so security scanners and bots receive nothing. Five loader domains have been used in sequence: manulfie[.]click from July 2025, neswnsssn[.]click from December 2025, lanhd6549tdhse[.]top from March 2026, additionalver[.]com from June 2026, and deepveindrilling[.]com, registered on 6 October 2026 and found in the CMS blocks of 83 stores within three weeks. Two loader variants are in play; one caches the payload in browser localStorage so it re-executes on later visits even if the attacker's domain goes offline, and the other adds browser fingerprinting to filter out scanners. The final payload has not been identified, and early iterations used the Keitaro advertising tracker as a traffic-distribution system. Retailers should audit cms_block contents rather than only their theme files.
Defence 1 story
Ukraine's CERT-UA warns that attackers are taking control of Dahua cameras through the vendor's own cloud feature
Ukraine's computer emergency response team, CERT-UA, has warned that attackers are gaining unauthorised access to surveillance cameras and video recorders made by the Chinese manufacturer Dahua, changing settings and creating their own user accounts. The vector is Easy4IP, a feature that exposes Dahua devices remotely through the manufacturer's cloud service by connecting them using their serial numbers — which means devices stay reachable even when firewall-protected or not directly internet-exposed. CERT-UA says the serial numbers follow predictable patterns, so an attacker can enumerate candidate serials and identify cloud-connected cameras even where those serials were never published; from there, weak or default passwords and outdated firmware do the rest. The agency specifically flagged CVE-2021-33044 and CVE-2021-33045, both disclosed in 2021, as authentication bypasses still in use against certain models. CERT-UA did not state how many devices were affected, when the attacks occurred or who was responsible. The warning lands in a wartime context in which Ukraine's SBU has secured roughly 40,000 surveillance cameras since 2022, and Chinese-made equipment remains in wide use by Ukrainian government institutions and military units.
Legal Services 1 story
Texas sues OpenAI and Sam Altman personally over consumer-safety claims
Texas sued OpenAI and its chief executive Sam Altman on 23 October under the state's deceptive trade practices laws, alleging that the company markets ChatGPT as safe while its safeguards fail to protect consumers, including children. The suit seeks civil penalties of up to $10,000 per violation and injunctive relief that would bar minors from accessing ChatGPT, require third-party approval of new models by a court-appointed expert, and prohibit the chatbot from advising users on suicide, eating disorders or violence. Unusually, the attorney general is seeking to hold Altman personally liable for the alleged deception. The filing quotes Altman's past statement that AI will "probably most likely lead to the end of the world, but in the meantime, there'll be great companies", and cites OpenAI's valuation growth from about $17 billion to over $1.4 trillion in four years while asserting that "the rise of OpenAI is attributable to a web of deceit". OpenAI said it works with experts to improve safeguards and supports robust but industry-wide safety standards. The action is the first US state consumer-protection suit to target an AI vendor's safety marketing rather than its data practices.
Transport 1 story
Maritime coalition launches the first vulnerability database restricted to shipping-sector IT and OT flaws
A maritime industry coalition announced the Blue Initiative on 26 October, launching a vulnerability repository that will list only IT and operational-technology flaws relevant to shipping. The group comprises maritime cyber vendors Cydome and Rakuten Maritime alongside the inspection and certification firm Bureau Veritas, the ship classification society ClassNK, and the Maritime Transportation System Information Sharing and Analysis Center. The Maritime Vulnerabilities Repository will be reviewed before publication by researchers from Cydome and other partners, who will validate and refine entries; vulnerabilities are published only once a patch exists. Users will be able to browse CVE detail, filter by equipment or vendor, read expert impact analysis, and subscribe to alerting. The launch addresses a specific complaint — that general-purpose CVE feeds bury the small number of flaws that matter to a specialised fleet, where the same vulnerability may affect bridge, cargo-management or satcom systems sold under different product names. It arrives amid continuing scrutiny of maritime cyber risk following the Anubis-linked attack on an Adriatic port.
Energy & Utilities 1 story
Open-source industrial controller boneIO ships with authentication disabled by default and a root-escalation path
Four vulnerabilities published on 26 October affect boneIO Black, an open-source DIN-rail controller used for industrial and building automation, and one of them is critical. CVE-2026-77053 (CVSS 4.0 8.7) is the most consequential: the firmware ships with authentication disabled and its management web API listens on all network interfaces, so an unauthenticated attacker on the network can take full control of the device — causing denial of service, changing configuration and operating the physical circuits wired to it. CVE-2026-77055 is rated 9.3 Critical: the Debian image grants the boneio service account passwordless sudo and docker-group membership, so anything that compromises that account escalates straight to root. CVE-2026-77052 exposes a Node-RED instance without authentication through a Caddy reverse proxy, allowing an attacker to deploy a flow that executes arbitrary system commands, and CVE-2026-77059 is a TOCTOU race in the timezone sudoers helper where a predictable temporary file is validated and then installed with root privileges. All four are fixed in boneIO 1.6.0, and the maintainer notes devices already in the field have the sudoers rule and docker membership removed when the image is sealed. The pattern — consumer-grade defaults on a device that switches real-world circuits — is the recurring failure mode of low-cost OT kit.
Construction & Property 1 story
Johnson Controls Kantech Entrapass uses a hard-coded cryptographic key, enabling a padding-oracle attack
CVE-2026-71456, published on 26 October, describes a hard-coded cryptographic key in Johnson Controls' Kantech Entrapass, the software used to manage physical access control systems, including door controllers, badges and site permissions. The hard-coded key allows a padding-oracle cryptographic attack, which in practice gives an attacker a route to decrypt or forge protected data without knowing the key. The flaw affects Entrapass versions before 9.20. Because Entrapass is the management layer for physical access rather than a data-plane product, the material risk is to the integrity of access records and, depending on deployment, to the credentials that door controllers trust — a building- or estate-level issue rather than a single-site one. Operators should confirm whether their access controllers accept software updates independently of the Entrapass server, since patching the server alone does not necessarily re-key hardware that has already been issued a credential. Rated 8.5 on CVSS 4.0.
Global (Macro) 3 stories
Microsoft 365 "token spraying" campaign compromised 97 accounts across 79 organisations
Huntress has disclosed a Microsoft 365 campaign that used an adversary-in-the-middle relay to capture sign-in sessions and then replay the stolen tokens to reach corporate email. Across activity observed between 14 July and 22 September 2026, the firm detected 497 successful Microsoft 365 sign-ins at 79 organisations from more than 200,000 login attempts, with 97 accounts ultimately compromised and 48 rogue Entra devices registered. The attackers did not guess passwords: an AitM login page sat between the victim and the real Microsoft sign-in flow, capturing credentials and MFA codes, and the resulting access token — proof of a completed login — was replayed from the attacker's own infrastructure within minutes. Huntress calls this token spraying, because tokens are replayed at scale across organisations in the way passwords are in a traditional spray. Persistence came from adding the attacker's own authenticator app: in at least 19 organisations the victim's existing MFA methods were removed and a new method registered within three hours of the first sign-in, and in one case a new authenticator named "iPhone 13" was activated less than 51 minutes after the hijacked session. More than 200,000 failed attempts were traced to the 193.26.115[.]0/24 range.
Gheist campaign plants 13,500 rogue branches to print repository secrets into GitHub Actions logs
Wiz has documented an automated campaign, tracked since 15 September and named Gheist after the user agent its tool sends to the GitHub API, that uses stolen GitHub tokens to plant workflows which print a repository's secrets into its Actions logs; the attackers download those logs and then delete the runs. Each workflow is pushed to a new branch named ci-sync- followed by six random characters, and removing the branch or the run does not undo the exposure — every secret the repository could read must be rotated, and the pushing token revoked. Wiz has recovered more than 13,500 planted branches from over 850 compromised accounts, spanning personal projects and enterprise private repositories. A GitHub safeguard that pauses suspicious workflow runs stopped every public-repository run Wiz examined, but it does not cover private repositories or GitHub Enterprise Server. In enterprise environments the tool cycled through several users' and automation accounts' tokens within minutes and cloned private repositories before planting the workflow; hours later, cloud credentials from the same organisation were used to enumerate AWS Secrets Manager. As of 24 October the campaign was still running, and roughly two-thirds of the accounts involved had since disappeared from GitHub.
Two critical Wasmtime flaws let a malicious WebAssembly module escape its sandbox
The Bytecode Alliance has disclosed two critical flaws in Wasmtime, the WebAssembly runtime that can be embedded in other software, each rated 9.9 on the CVSS scale in advisories published on 19 October. Both bugs sit in Cranelift, the compiler Wasmtime uses by default to translate WebAssembly into machine code, and both would let a malicious module escape the sandbox meant to contain it — a module is only supposed to touch its own memory, the host functions it is given, and checked jump targets. CVE-2026-115889 affects every processor architecture; CVE-2026-115893 affects only ARM64. Exploitation requires the victim to compile a module the attacker controls, which makes the risk highest for services that run customer-supplied or third-party code — Fastly, for example, states that its Compute platform runs customer code on Wasmtime. Fixed versions were released on 19 and 20 October, with the remedy depending on the release line: 36.0.19 and 48.0.7 are clean, 37.0.0 through 42.x must move to 48.0.7, 49.0.4 or 50.0.0, and 43.0.0 through 47.x are affected by the ARM64 flaw only. The maintainers report no attacks, and neither flaw was in CISA's Known Exploited Vulnerabilities catalogue as of 26 October.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →