The last 24 hours have exposed critical fractures in Australia’s national cyber resilience, ranging from federal compliance failures to the active weaponisation of autonomous AI systems. For security teams across the country, the immediate priority is a critical zero-day patching cycle for web/SaaS access, while C-level executives must urgently review third-party governance and incident reporting protocols.

Here is your deep dive into the threats impacting Australian organisations over the last 24 hours.

Top Priority: Critical Vulnerabilities

Google Chrome Zero-Day (CVE-2026-2441)

Severity: Critical (Actively Exploited)
Target: Web Applications & SaaS Access
Intel: Google has released an emergency update to address a Use-After-Free vulnerability in Chrome’s CSS processing component. Threat actors are actively exploiting this in the wild to execute arbitrary code on victim machines via crafted HTML pages.
Action: Immediate patching to version 145.0.7632.75 is required. This poses a significant risk to organisations relying on browser-based SaaS platforms, as a single compromised endpoint can bypass perimeter defences.

BeyondTrust Remote Access (CVE-2026-1731)

Severity: Critical
Target: Cloud/Hybrid Infrastructure
Intel: Arctic Wolf has confirmed active exploitation of this pre-authentication remote code execution flaw in self-hosted BeyondTrust environments. Attackers are using this to gain initial footholds in privileged networks.
Action: Verify all instances are patched immediately. Cloud-hosted instances have been patched by the vendor, but on-premise/hybrid deployments remain vulnerable.

Sector Spotlight

Government: The "Silent" Breach Crisis

A concerning report tabled in Parliament yesterday reveals a massive visibility gap in our national defence. It has been confirmed that only 35% of federal government entities reported at least half of their observed cyber incidents to the Australian Signals Directorate (ASD) in the 2024-25 period.

Impact: This lack of reporting creates a "fog of war" that allows sophisticated state-sponsored actors, such as the persistent Salt Typhoon group, to maintain long-term access to critical networks without detection.
Takeaway: We expect a swift regulatory crackdown. Agencies and government contractors should prepare for stricter mandatory reporting audits in Q2 2026.

Healthcare: Ransomware Resurgence

The healthcare sector remains in the crosshairs of the 0APT ransomware gang. Following the attack on Epworth HealthCare earlier this month, intelligence indicates the group is now pivoting to smaller allied health providers to lateral move into larger hospital networks.

Trend: Attackers are weaponising sensitive patient data not just for extortion, but to force "psychological pressure" negotiations, a tactic seen in the recent Medibank class action developments.

Retail & Hospitality: Seagrass Group Incident

Seagrass Boutique Hospitality Group has confirmed a cyber incident involving unauthorised network access, with the Kairos ransomware gang claiming responsibility.

Analysis: Kairos is known for rapid data exfiltration before encryption. Retailers must assume that if their perimeter is breached, customer data is already gone before the ransom note appears.

FinTech: The Cost of Vendor Negligence

The regulatory patience for "tick-box" compliance has run out. The historic $2.5 million penalty handed down to FIIG Securities regarding vendor security failures sets a new precedent.

Risk: FinTechs are no longer just liable for their own systems but are effectively the "security guarantors" for their entire supply chain.

IoT: The Spy in the Driveway

The Office of the Australian Information Commissioner (OAIC) has formally commenced investigations into connected vehicles.

Threat: The ASD has identified instances of vehicles recording conversations without consent and transmitting telemetry that could be intercepted by foreign actors. For corporate fleets, this turns every company car into a potential mobile listening device.

AI Systems: The Rise of "AI Agents" as Vectors

A new frontier of threat has emerged in the last 24 hours. Vulnerabilities have been discovered in Moltbook (a social media platform for AI agents), and we are seeing the first weaponisation of OpenClaw tools.

Scenario: Threat actors are compromising autonomous AI agents to inject poisoned data into corporate decision-making models. This is no longer theoretical; it is an active attack vector targeting automated procurement and customer support systems.

Summary & Recommendation

The threat landscape in February 2026 is defined by access exploitation—whether through unpatched browsers, forgotten service accounts, or unmonitored third-party vendors. The distinction between "internal" and "external" networks is gone.

Your immediate focus today must be:

Patch Chrome and BeyondTrust instances.
Audit your incident reporting pathways to ensure alignment with ASD requirements.
Review AI agent permissions to prevent automated data exfiltration.

Contact us for a quote for penetration testing service or adversary simulation.