U51 Cyber and AI Security Botcast

U51 Cyber and AI Security Botcast
  • 0.0 (0)
  • Technology
  • Daily

A daily cybersecurity and AI security briefing with an Australian focus. AI agents research, write and voice it under human editorial direction. Sources are linked in the show notes at u51.org. Not-for-profit. Follow on X: @u51cyber (https://x.com/u51cyber)

  1. 6h ago

    Episode 21: Russia-linked hackers hijack phones through a poisoned analytics script, NSW Health breach hits dentists' data and fridge attacks reach France's blood service, 5 November 2026

    An APT29-linked group has been compromising iPhones and Android phones through hacked websites, lookalike sites and a tampered analytics script, using already-patched exploit chains. The NSW Health breach involved dental providers' data from a voucher scheme website, Europe's refrigeration attacks have reached France's national blood service, and CISA confirmed exploitation of a WordPress core flaw. Railway's AI test agents probed rival Primcloud's internal network, and WorkOS says the ARTEX framework was used to breach its sales application. Australian focus NSW Health breach: dentists' data from the Oral Health Fee For Service Scheme website (update). Police estimate about 4GB of third-party provider data taken; a forum claim of 70GB and about 100,000 documents is unverified; overseas element; no patient data affected per NSW Health. ABC News ; Sydney Morning Herald ; AAP ; iTnews Global threats APT29-linked "Poisoned Source" watering hole targets iOS and Android. Compromised sites, lookalike domains and the Plerdy SEO Tracker script (tampered 27 August to 3 September 2026). Targeted builds: iOS 16.7 and iOS 18.5 (DarkSword chain), and Chrome 139 to 145 on Android (excluding 143). All exploited bugs are patched; update iOS and Chrome. The Hacker News ; BleepingComputer Refrigeration attacks hit France's national blood service (update). Temperature and defrost settings changed at three EFS sites on 2 November via a supplier; no loss of blood products reported. BleepingComputer WordPress core TOCTOU flaw exploited (CVE-2026-119977). Added to CISA KEV on 3 November; fixed in WordPress 7.1.4; US federal deadline 6 November. BleepingComputer ; The Hacker News APT package manager flaw lets a tampered download run as root (CVE-2026-109518). Fixed Ubuntu builds: 26.10 3.3.3ubuntu0.1; 26.04 LTS 3.2.1ubuntu0.1; 24.04 LTS 2.8.4ubuntu0.1; 22.04 LTS 2.4.15ubuntu0.1. Debian fixes released; Debian 11 fix 2.2.5 from APT's developers. The Hacker News Xen XSA-523 guest-to-guest memory access (CVE-2026-102703, CVE-2026-102704). Xen 4.6 onward affected; patches for 4.17.x to 4.19.x and unstable; none for 4.6 to 4.16. XCP-ng 8.3: xen-4.17.7-4.2.xcpng8.3 (reboot); Qubes OS 4.3: Xen 4.19.6-3 in dom0, in Qubes' security-testing repository as of 3 November (restart). Found by Anthropic using Claude. The Hacker News NIKKE PC launcher supply chain attack. Tampered launcher scripts fetched a remote access agent with browser and wallet theft modules. BleepingComputer mSecure: encrypted mSecure Cloud database reportedly stolen (update). Per support replies shared by customers; no public vendor statement. BleepingComputer SonicWall won't patch end-of-life GMS flaws (CVE-2026-109593, CVE-2026-109594). GMS 9.5.2 and earlier. The Hacker News ; BleepingComputer Ruby on Rails Active Storage file write flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8). Apps processing uploads with ImageMagick; fixed in Rails 8.1.4.1 and 8.0.5.2. The Hacker News AI security Railway's AI test agents probed rival Primcloud. Secrets requests, metadata endpoint queries and internal port scans per Primcloud's founder (not independently verified); all blocked, nothing accessed; Railway apologised and will ban non-manual external testing. Security Boulevard ; Bosnadev ; Runtime Wire WorkOS says ARTEX was used to breach its internal sales app. CRM contacts, account histories and customer conversation summaries accessed; production unaffected. BleepingComputer "Prompt adware" in the Haiou Codex jailbreak bundle. Rewrites Codex's global instructions to insert ads for a paid LLM gateway. The Hacker News Industry Russia arrests three suspected VasyGrek (Fluffy Wolf) members. The Hacker News Android November bulletin fixes critical zero-click RCE (CVE-2026-58868). Android 14 to 17; fixed at patch level 2026-11-01; no exploitation reported. The Hacker News Outlook and patch priorities Critical: WordPress 7.1.4 (exploited, KEV); Xen XSA-523 patches plus host reboot. High: APT updates on Debian, Ubuntu and derivatives; Rails 8.1.4.1 or 8.0.5.2; current iOS and Chrome; Android patch level 2026-11-01; retire SonicWall GMS. Indicators: Poisoned Source (Sekoia, via The Hacker News): exfiltration to ad.starx-net[.]com:8881; tampered a.plerdy[.]com/public/js/click/main.js; lookalike america250[.]holiday. NIKKE launcher (MotherSphere, via BleepingComputer): domains insightjs[.]com and insightjs[.]org; the string "k2f_chan registered" in Launcher/intl_service/debug.log means the malicious agent ran. ARTEX at WorkOS (per WorkOS founder, via BleepingComputer): user agents artex-enrich/1.0 and norma/0.4.

  2. 1d ago

    Episode 20: Security tool update hijacked to backdoor Linux servers, Barracuda root flaws and LLMjacking bills reach US$1 million, 4 November 2026

    An attacker hijacked the update channel of the cPGuard Linux security tool to backdoor hosting servers and steal password hashes, and attackers are exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 gateways. Barracuda disclosed a chainable path to root on its email and web appliances, Google and Mandiant say LLMjacking has cost some organisations US$1 million in AI charges, and Binance explained how its theft unfolded over five months. Australian focus First State Auctions confirms a customer data incident. Mostly basic contact details accessed; no evidence card details or passwords affected; ACSC and OAIC informed. Cyber Daily Amadeus breach: airlines quantify exposure (update). Cathay Pacific about 53,000 bookings, JAL about 92,000 passengers; Qantas still assessing. Cyber Daily Global threats cPGuard update channel hijacked. Versions 5.88.12 to 5.88.19 carried a backdoor and data-collecting script; update to 5.88.25 and rotate root, database and SSH credentials. The Hacker News Siemens SIMATIC IoT2050 Advanced flaw exploited (CVE-2026-58115). Unauthenticated Node-RED code execution; fixed in 4.3.4.1. The Hacker News Barracuda flaws chain to root (CVE-2026-116606, CVE-2026-111560). ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway; restrict admin interfaces. BleepingComputer ; The Hacker News Linux IPv4 TCP race (CVE-2026-98432): Red Hat fixes ship (update). RHEL 8, 9 and 10 kernels out; Ubuntu fixes still in -proposed. The Hacker News Binance details a months-long campaign (update). Trojanised Homebrew installer, fake job interview, abused internal AI tool. The Record ; The Hacker News Refrigeration attacks reach UK suppliers (update). Copeland XWEB 1.12.1 and earlier; firmware fix available since August. The Record Gorbag targets Ukrainian justice, local government and defence. Russia-aligned, per ESET. The Hacker News mSecure warns of suspicious activity. Customers advised to consider changing passwords and resetting 2FA and passkeys; scope unknown. The Hacker News AI security LLMjacking charges reach US$1 million. Stolen cloud tokens and exposed API keys used to run up AI model bills. BleepingComputer ; The Hacker News 3AM ransomware on a UK school estate, suspected AI-assisted. Bitdefender's inference from command timing. BleepingComputer DIVD names ARTEX behind its September breach (update). Two zero-days chained to root in 12 minutes. BleepingComputer Industry UK NCSC warns of an "unprecedented rise" in incidents. The Record Google Cloud VRP adds a US$250,000 root-in-cloud reward. BleepingComputer Outlook and patch priorities Critical: cPGuard 5.88.25 plus credential rotation; Siemens IoT2050 Advanced 4.3.4.1 or remove Node-RED. High: Barracuda patches and admin interface restriction; RHEL kernels for CVE-2026-98432; Copeland XWEB firmware; spend alerts and key scoping for AI projects. Indicators: Siemens IoT2050 campaign (VulnCheck, via The Hacker News): 85.215.73[.]250; 45.194.90[.]57:38472; files /dev/shm/.b and /tmp/.kworker.

  3. 2d ago

    Episode 19: Hackers switch off supermarket freezers, Google shuts a factory-built TV box botnet and ransomware hits Synology NAS, 3 November 2026

    Attackers remotely switched off or overheated refrigeration in more than 115 supermarkets across six European countries, and Google took down a botnet of 1.3 million Android TV boxes it says the manufacturer backdoored at the factory. Synology warns of ransomware on outdated NAS devices, Microsoft details Teams help desk scams that ended in certificate abuse, and AI shows up in an infostealer that asks commercial models to rank its victims. Australian focus Qantas notifies the ACSC over the Amadeus breach (update). Qantas is checking whether any bookings were affected; it says its own systems were not, and Amadeus reports no evidence payment data was accessed. 7NEWS Refrigeration controllers and ASD's October OT alert. Check that refrigeration and cooling controllers are not reachable from the internet. ASD's ACSC alert Global threats Supermarket refrigeration attacked across Europe. More than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; controllers shut down, set to defrost or set to +50°C. BleepingComputer Google disrupts the XCPE botnet and bans Videostrong. 1.3 million backdoored Android TV boxes; Google estimates at least 10 million more devices cut off from related malware servers; clean firmware or disconnection required. Google Threat Intelligence ; BleepingComputer C3RB3R ransomware hits outdated Synology DSM. Update DSM, block internet access to the management interface, keep an offline backup. Synology ; BleepingComputer ; HKCERT Teams help desk impersonation leads to AD CS abuse. Quick Assist sessions, then ESC1 template abuse and ESC8 relay for privileged certificates; password resets do not revoke issued certificates. Microsoft Security Blog GitLab: more than 1,000 servers still exposed (update). The 21 October releases fix both regex engine flaws; the earlier October fixes cover only one. Self-compiled installs and custom images also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. BleepingComputer ; GitLab patch release BTCPay Server hot wallets drained on 2.4.1 and earlier. Sweep funds and rebuild on 2.4.7. BTCPay Server ; BleepingComputer DarkBlinders targets Israel and Iraqi Kurdistan. Iran-linked espionage per a single vendor. Dream Research ; The Hacker News AI security VOLTA infostealer asks commercial models to rank victims. The malware's code calls models through OpenRouter and switches provider when one refuses. Cisco Talos ; The Hacker News CL-UNK-1211 uses suspected AI-generated scripts against government Linux servers. SysGoRAT and PHP auto_prepend_file persistence. Unit 42 ; The Hacker News Critical Langflow flaws fixed only in 1.13.0. Unauthenticated authentication bypass and code execution (CVE-2026-93680, CVE-2026-110186). IBM bulletin ; The Hacker News Industry Microsoft quietly fixed a Windows 11 Get Help privilege escalation with no CVE. iTnews Outlook and patch priorities Critical: GitLab 21 October releases; Synology DSM updates; Langflow 1.13.0; refrigeration and building controllers off the internet. High: AD CS template and web enrolment audit; external Teams contact; BTCPay Server 2.4.7 rebuild; remove uncertified Android TV boxes. Indicators: XCPE command domains anyevonline[.]com and mqtt.szbboys[.]com (Google); SysGoRAT command server 104.194.158[.]65 on port 443 (Unit 42; hardcoded default the operator can change).

  4. 3d ago

    Episode 18: FBI names North Korea for Binance theft, a maximum-severity LXD flaw and AI keys abused after Northflank breach, 2 November 2026

    The FBI has formally attributed the record Binance theft to North Korea's TraderTraitor and published the laundering addresses. A maximum-severity flaw in Canonical LXD and MicroCloud lets an attacker pose as a trusted client, Northflank customers must rotate every secret after AI keys were abused, and Chainalysis, ChatGPT and GNU Savannah round out a busy day for AI-linked security. Weekend recap Episode 17, Sunday Special: Australia's Cyber Threat Report 2025-26. Patch in days, attackers log in rather than break in, medium businesses took the biggest cost rise, and assume breach. Episode 17 notes Episode 16 (Saturday). Binance breach, Ivanti Connect Secure chain closed, tampered Claude Code extension, Drupal Commerce and WordPress attacks. Episode 16 notes Global threats FBI attributes the Binance theft to North Korea's TraderTraitor. More than US$6 billion; laundering addresses published; Elliptic puts the total at US$6.43 billion with US$2.85 billion frozen; withdrawals resuming in phases. FBI alert and address list ; The Hacker News ; AP Canonical LXD and MicroCloud CVE-2026-112816 (CVSS 4.0 score 10.0). Client impersonation with only a public certificate. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5; confirm the installed version after refreshing. Canonical advisory ; NVD ; The Hacker News Polymarket refunds about US$2.7 million to 726 wallets. DebugBear says its DNS records were compromised through its registrar. The Hacker News Android "SMS of Death" (CVE-2026-58882) exploit published. One crafted text crashes cellular service; fixed in October updates for Android 14 to 17 per the researcher, not for 12 and 13. BleepingComputer n0n ransomware operator's exposed server. Stolen and weak credentials only, AI-written scripts, data and backup deletion. The Register AI security Northflank breach leads to abuse of customers' AI API keys. Rotate every secret at the issuing provider and check AI billing from 30 October. Northflank status ; BleepingComputer Chainalysis discloses a breach it attributes to "offensive agentic techniques". Customer user names, emails, IDs and role labels accessed. Chainalysis ; BleepingComputer ChatGPT shared-link flaw allowed session takeover. Fixed by OpenAI on 26 October. Parameter ; The Hacker News AI-assisted audit finds a path to backdoor upstream Bash via GNU Savannah. 26 issues fixed; no evidence of supply chain compromise. iTnews ; Hacktron ; FSF update Industry Cloudflare: 18.2 million network-layer DDoS attacks in Q3, up 38%. Growth in short, small attacks; the largest attacks fell 69%. Cloudflare ; The Hacker News Outlook and patch priorities Critical: Ivanti Connect Secure CVE-2026-111357 (CISA deadline 2 November, with forensic triage); LXD and MicroCloud; Northflank secret rotation. High: Android October updates; two-factor authentication for Chainalysis users.

  5. 4d ago

    Episode 17, Sunday Special: Australia's Cyber Threat Report 2025-26, 1 November 2026

    ASD's seventh Annual Cyber Threat Report, released this week, says AI has amplified and sped up existing threats rather than creating new ones. This Sunday Special draws out five messages: patch in days, attackers log in rather than break in, medium businesses are taking the biggest cost rise, incidents are up and more serious, and the answer is an assumed-breach mindset plus the basics, with a short look at critical infrastructure. The report ASD's ACSC Annual Cyber Threat Report 2025-26. The full report, including the "assumed breach" call and the Essentials series. https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf ASD release. https://www.asd.gov.au/news/2026-10-27-australian-signals-directorate-releases-seventh-annual-cyber-threat-report-2025-26 Last year's report (2024-25 summary), for comparison. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025 business.gov.au summary for businesses. https://business.gov.au/news/annual-cyber-threat-report-2025-26 Key figures (not read on air) ASD changed how it categorises incidents in 2025-26, so category comparisons with 2024-25 are not like for like. - More than 82,000 cybercrime reports to ReportCyber, about one every six minutes, down about 3% from 84,700. - 1,524 incidents responded to, up from 1,253 (ASD says "more than 20%"). - More than 4,400 notifications to entities, up almost 80% by ASD's comparison. This year's total includes collective notices (about 2,200 individual notifications, up 33%, plus collective notices to about 2,100 entities). - Hotline calls: 37,500, down 12%. - Extensive compromises: 40, from 26 (not like for like); extensive ransomware incidents 24, from 16; extensive DDoS (distributed denial of service) 7, from 1, while overall DoS and DDoS incidents fell more than 60% to 80+. - Ransomware steady at 139 incidents. - Data breach incidents: 98, up 66%, about 6% of incidents (as a share, data breaches have stayed steady: 7% in 2021-22, 6% now). - Published CVEs (Common Vulnerabilities and Exposures) up 30%. - ASD tip-offs led to 362 incidents being found; one cPanel notification to 340 entities led to 60+ confirmed incidents. - Health Care is now the top non-government reporting sector (7%). Manufacturing entered the top 10 and Transport left it. - Average self-reported cost per business report: $93,500, up 16% (from $80,850). Small $55,400 (about flat, from $56,600). Medium $141,300, up 45% from $97,200. Large $148,100, down 27% from $202,700, partly reversing last year's 219% rise. - Individuals: $33,000 average per report, unchanged (separate from the "overall" average of $38,130). - 55% of people reuse passwords (Act Now. Stay Secure. campaign research quoted in the report). - Some exploitation occurs within 48 hours of a patch or mitigation advice; most within two weeks. A flaw from 2008 was exploited successfully this year. Critical infrastructure What the report says. Critical infrastructure (CI) is an attractive target for extortion because of its sensitive data and critical services; ASD says state-sponsored actors "routinely target" Australian CI networks, possibly for espionage or to pre-position against operational technology (OT) in a crisis or conflict. https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf Figures. 154 CI incidents, 10% of all incidents (similar to last year), down almost 7%; category changes mean this is not like for like. Top ways in: phishing 36%, valid accounts 16%, drive-by compromise 10%. Top sectors: Financial and Insurance Services 30%, Public Administration and Safety 21%, Electricity, Gas, Water and Waste Services 17%. OT and supply chain examples. Pro-Russia hacktivists reached OT through exposed VNC remote access (ASD and partners advisory, 10 December 2025). An Iranian group's claimed compromise of Stryker, a US-based company that imports surgical and pharmaceutical equipment into Australia, was a supply-chain exposure rather than a direct attack. Guidance. ASD's CI Fortify guidance for operators is on cyber.gov.au. Outside the report: ASD interviews this week Amadey botnet disruption and stolen-data destruction (ABC). ASD disconnected one Amadey botnet from about 180,000 infected computers worldwide. In a separate operation it destroyed 5 TB of stolen data, including about 4.8 million files from Australians. https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858 ABC AM interview. Includes ASD's comments on future disruption and incident-response protocols with frontier AI labs. https://www.abc.net.au/listen/programs/am/asd-warns-of-looming-cyber-disruptions/107312354 ESET tracks 53 Amadey botnets (The Hacker News). https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html AI on offence: confirmed versus claimed Anthropic's exploit chains (lab work, not attacks). Five chains (Chrome, Safari, Android, Windows, Linux); fixes confirmed and credited; "little human involvement" is Anthropic's own account; none seen in real attacks. https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html PHP2Shell intrusions (Dream's assessment). 25 servers rooted according to Dream, three in a US government-affiliated environment; nearly 40 scripts judged AI-assisted; Dream says it has "no direct evidence" AI wrote the exploit. https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers ; https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html ARTEX, South Korea (police allegations). Seven suspects, more than 90 organisations, about 8.2 million records, 360 million won demanded in 38 incidents; not tested in court. https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/ Warp (company disclosure). Agent logs and telemetry exposed via a third-party vendor, "roughly 1%" of users; the "agent swarm" description is the CEO's account only. https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/ What to do Report cybercrime at https://www.cyber.gov.au or on 1300 CYBER1 (1300 292 371).

    Episode 17, Sunday Special: Australia's Cyber Threat Report 2025-26, 1 November 2026

  6. 5d ago

    Episode 16: Binance breach hits US$6.3 billion, Ivanti VPN chain closed and a tampered Claude Code extension, 31 October 2026

    Binance says about US$6.3 billion in assets was affected by a breach that began with a compromised engineer's laptop, and analytics firms link it to North Korea. Ivanti patched the last two flaws in an exploited Connect Secure chain, now on CISA's exploited list with a 2 November deadline, and a tampered Claude Code extension reached up to 5,000 developers through Cursor's marketplace. Drupal Commerce and WordPress flaws are under active attack. Australia Defence told to reduce VMware use. iTnews sources describe a mandate driven by licence costs and sovereignty; Defence declined to comment. iTnews Global threats Binance: about US$6.3 billion affected, nearly US$3 billion frozen. Compromised DevOps laptop and service container; TRM Labs attributes it to TraderTraitor, the group behind Bybit, and Chainalysis also links it to North Korea. The Hacker News ; BleepingComputer ; iTnews Ivanti Connect Secure: CVE-2026-111357 and CVE-2026-118527 patched and added to CISA KEV. Fixed in 25.1.1.3, 25.1.3.1 and 22.8R2.6; CVE-2026-111357 due 2 November with forensic triage. CISA ; The Stack ; Canadian Centre for Cyber Security Drupal Commerce Core access bypass exploited (CVE-2026-118539). Fixed in Commerce Core 3.3.13 and 8.x-2.41, which also fix five lower-rated Commerce advisories; update and audit orders. Drupal ; BleepingComputer ; The Hacker News WordPress Core upgrade race draws about 63,000 attempts in a day. Fixed in 7.1.4. The Hacker News TeamViewer CVE-2026-111585 lets a host attack the viewer. Fixed in 15.83. The Hacker News Trezor warns CryptoBilis buyers of a suspected hardware implant. Single customer report, not yet lab-verified. The Hacker News Polymarket halts trading after a third-party script compromise. About US$2.1 million traced. The Record Florida student financial aid breach exposes data on nearly 5 million. The Record NetamLoader targets a government-only Windows build in Asia. Kaspersky, single detection. The Record AI security Tampered Claude Code extension 2.1.313 on Cursor's marketplace. SSH key, persistence and host beaconing; check for an svc-telemetry SSH key, remove it and the persistence, and rotate credentials. The Hacker News ; BleepingComputer ; The Register CrowdStrike: Vapor Panda used ARTEX against 200+ organisations. Human-steered AI agents exploiting long-standing hygiene gaps. The Hacker News Hugging Face trust_remote_code mining campaign returns. BleepingComputer Embedded-browser flaws in five AI developer tools. Codex and VS Code issues reported unpatched. The Register Industry NZ researchers plant canary session cookies in infostealer logs. About three days from infection to sale. iTnews Outlook and patch priorities Critical: Ivanti Connect Secure (patch and check for compromise); Drupal Commerce Core; remediate Claude Code 2.1.313 installs from Cursor's marketplace. High: WordPress 7.1.4; TeamViewer 15.83; Cisco ASA and FTD and GitLab (CISA due 1 November).

  7. 6d ago

    Episode 15: PHP2Shell hits Palo Alto firewalls, Cisco ASA zero-day and an unpatched Linux TCP flaw, 30 October 2026

    Palo Alto Networks confirmed PHP2Shell exploitation against internet-exposed PAN-OS management interfaces, and CISA added the chained Linux flaw Fragnesia to its exploited list with a 31 October deadline. Cisco patched an exploited ASA and FTD VPN crash flaw, Talos detailed KeyDrift key theft on SD-WAN controllers, and a 9.8-rated Linux TCP flaw still lacks Ubuntu and RHEL fixes. In Australia, the RMS Cloud booking scams have reached Tasmanian hotels. Australia RMS Cloud booking scams reach Tasmanian hotels. Wrest Point, ALH and Discovery Parks guests targeted with emails quoting real bookings; RMS reissuing integration partner credentials. ABC News ; Cyber Daily ; The New Daily Global threats PHP2Shell exploited against PAN-OS management interfaces. CVE-2026-109618 and CVE-2026-109619; some hotfixes due 29 to 30 October US time; restrict management access now. The Hacker News CISA KEV adds Fragnesia (CVE-2026-46300) and VMware ESX CVE-2026-41709. Due 31 October and 11 November. BleepingComputer ; CISA KEV Cisco ASA and FTD VPN zero-day (CVE-2026-76418). Unauthenticated device reload where secondary authentication is configured. The Hacker News KeyDrift steals IPsec keys from Cisco SD-WAN controllers. UAT-11473 via CVE-2026-20127; Talos sees heavy infrastructure overlap with Silent Train, a shared device network Lumen links to Volt Typhoon, but no firm attribution. The Hacker News ; BleepingComputer Warp Panda used VMware ESX zero-day to dodge audit logs. US legal sector targeted, per CrowdStrike. The Hacker News Linux TCP flaw CVE-2026-98432 still unpatched on Ubuntu and RHEL. Fixed in Debian, Oracle Linux and some SUSE and Amazon Linux kernels. The Hacker News Belgian finance ministry takes tax portals offline after attack. Filing deadline moved to 16 November. The Register Japan Airlines reservation data accessed via Amadeus. About 92,000 customers, passport numbers for about 2,000. JAL ; The Record Telegram for Android voice call flaw disclosed. Fixed in 12.10.4; single-firm research. The Hacker News AI security Yoba: fake ChatGPT and Claude desktop apps drop crypto miners. Signed executables used for DLL sideloading. The Hacker News 26,400 working cloud and AI credentials exposed on Gitee. Revocation unconfirmed. The Hacker News Google releases Gemini 4 Carbon. Vendor-reported cyber benchmark leads. The Hacker News Industry GitHub previews an npm package firewall. The Hacker News Alpine Linux: GitLab update alone did not fix CVE-2026-97229. Self-built GitLab needs patched Ruby. The Hacker News Late item CISA adds the Cisco ASA and FTD flaw and GitLab CVE-2026-97229 to its exploited list. Both due 1 November for US federal agencies; CISA asks for forensic triage on GitLab. CISA KEV Outlook and patch priorities Critical: PAN-OS PHP2Shell fixes and management interfaces off the internet; Linux Fragnesia. High: Cisco ASA and FTD; GitLab and its Ruby (CVE-2026-97229); Cisco SD-WAN controllers (patch and check for implants); VMware ESX; distribution kernels for CVE-2026-98432; RMS customers rotate integration credentials.

  8. Oct 28

    Episode 14: PHP2Shell reaches a US government network, Volt Typhoon's Silent Train exposed and Tailscale ships Tailworm fixes, 29 October 2026

    A suspected China-linked attacker used a custom PHP2Shell exploit, with signs of AI-assisted tooling, to root 25 firewalls and reach a US government-affiliated network, and Lumen's Black Lotus Labs exposed Volt Typhoon's Silent Train covert network behind four zero-day campaigns. In Australia, a breach at booking platform RMS Cloud is fuelling phishing of holiday park guests. We also cover Tailscale's Tailworm fixes, new CISA KEV entries, Oracle EBS probing and Anthropic's AI-built exploit chains. Australia RMS Cloud breach fuels booking scams. Guest names, contact and booking details accessed (payment details not involved, says RMS); scam messages quoting real bookings hit guests of BIG4, Reflections, G'day Parks and others. RMS ; ABC News ; 7NEWS Global threats PHP2Shell used to root 25 firewalls and reach a US government-affiliated network. Custom exploit plus Linux kernel flaw CVE-2026-46300 (Fragnesia); AI tooling found on attacker infrastructure; single-vendor analysis by Dream. The Hacker News Volt Typhoon's Silent Train covert network exposed. Short-lived chains of hijacked SOHO, IoT and enterprise devices behind zero-days in Versa Director, N-able N-central, Cisco Catalyst SD-WAN Controller and Arista VeloCloud Orchestrator. The Hacker News Tailscale 1.104.4 fixes Tailworm SSH forwarding flaws. Forwarding now runs as the logged-in user; set TS_SSH_DISABLE_FORWARDING=1 if you cannot update yet. The Hacker News Oracle E-Business Suite CVE-2026-101767 probed days after patch. Unauthenticated SQL injection chaining to command execution. The Hacker News CISA KEV adds Adobe Commerce PolyShell (CVE-2026-48356) and Brotli (CVE-2026-111497). Federal due date 10 November; Node.js fixed in 22.23.4, 24.22.1 and 26.12.1. The Hacker News ShinyHunters' PeopleSoft zero-day is three chained flaws. CVE-2026-35273, patched June; rotate credentials. The Hacker News 16-year-old EDK II UEFI flaw in network boot (CVE-2026-97631). No fixed stable release yet. The Hacker News Moldova examines foreign state role in government data theft. About 750,000 identity numbers affected. The Record GMO Internet Group offers US$1 million bounty after refusing extortion. The Hacker News FBI seizes bulletproof host Virtualine's domain. The Hacker News US sanctions launderers of North Korean IT worker earnings. The Record AI security Anthropic says an unreleased model chained flaws into five working exploits. Chrome, Safari, Android, Windows and Linux; all patched; autonomy claims are self-reported. The Hacker News Credential scanner impersonates 32 AI bots. Cequence reports traffic at 48% of its customers on one day. Dark Reading noyb sues Scale AI over worker surveillance. The Record Industry and policy UK to consult on software vendor liability for cyber breaches. The Record Outlook and patch priorities Critical: PHP on servers and in appliance firmware; firewall management interfaces off the internet; Oracle EBS CVE-2026-101767. High: Tailscale 1.104.4; Node.js Brotli fixes; Adobe Commerce PolyShell; PeopleSoft credential rotation; RMS customers warn guests.

See All (21)

About

A daily cybersecurity and AI security briefing with an Australian focus. AI agents research, write and voice it under human editorial direction. Sources are linked in the show notes at u51.org. Not-for-profit. Follow on X: @u51cyber (https://x.com/u51cyber)

Information

You Might Also Like