Daily Threat Briefing: Australia – 06 December 2025

Executive Summary

The Australian cyber threat landscape has seen a critical escalation over the last 24 hours. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued urgent alerts regarding a maximum-severity vulnerability in widely used web frameworks, while ransomware groups continue to aggressively target the nation’s supply chains. Today's briefing analyses the immediate risks to Healthcare, FinTech, and Government sectors, alongside critical vulnerabilities in AI and cloud infrastructure.

Critical Web & SaaS Vulnerability: The "React" Crisis

Vulnerability: CVE-2025-55182 (React Server Components) & Next.js RCE Severity: Critical (CVSS 10.0) Sector Impact: SaaS, eCommerce, EdTech

In what is shaping up to be the most significant web security event of late 2025, a critical Remote Code Execution (RCE) vulnerability has been disclosed in React Server Components and Next.js (versions 15.x/16.x).

• The Threat: Unauthenticated attackers can execute arbitrary code on servers processing specific "Flight" requests (a protocol used for streaming data).
• SaaS Implication: Modern SaaS platforms built on these frameworks are immediately vulnerable to complete server takeover.
• Action: Verify if your application uses react-server-dom-webpack or related packages. Google Cloud and Cloudflare have released WAF rules to mitigate exploitation, but patching to React 19.2.1+ is mandatory.

AI & Cloud Security: Agents Under Fire

Vulnerability: CVE-2025-34291 (Langflow AI Agent Platform) Severity: Critical (CVSS 9.4)

As Australian organisations race to integrate AI, security gaps are widening. Researchers have identified a critical flaw in Langflow, a popular open-source AI workflow platform.

• The Exploit: A chain of vulnerabilities involving overly permissive CORS and missing CSRF protections allows attackers to achieve Account Takeover and RCE simply by tricking a user into visiting a malicious webpage.
• Strategic Risk: Successful exploitation exposes all API keys (AWS, OpenAI, Azure) stored within the AI agent, potentially granting attackers lateral movement into your cloud environment.

Sector-Specific Threat Intelligence

Government & Defence

Supply chain risks have manifested severely with the breach of IKAD Engineering. The J Group ransomware gang claims to have exfiltrated 800GB of sensitive data, including naval contract details for the Hunter Class frigate program. Additionally, Muswellbrook Shire Council is dealing with the fallout of a SafePay ransomware attack, with 175GB of data reportedly leaked after ransom negotiations failed.

Healthcare

The sector remains under siege. The Morpheus ransomware group has claimed responsibility for a significant breach at DBG Health (including Arrotex Pharmaceuticals). Threat actors have released proofs containing employee passport scans and business plans. This incident highlights the persistent threat of "double extortion" where data theft precedes encryption.

FinTech

Two major incidents highlight the divergence in threat vectors:

1. Ransomware: Wealth management firm Austin’s Financial Solutions was hit by the Kairos group, with 147GB of payroll and client data compromised.
2. API Security: A critical API exposure was discovered in Vroom by YouX, a FinTech lender. A non-password-protected database left thousands of driver's licences and loan documents exposed to the public internet—a stark reminder that simple configuration errors remain as dangerous as sophisticated malware.

Critical Infrastructure & IoT

Following the release of joint guidance by CISA and the ACSC on Securely Integrating AI in Operational Technology (OT), nine new advisories were released yesterday for Industrial Control Systems (ICS), affecting vendors like Mitsubishi Electric and Johnson Controls. Operators must urgently review these to prevent AI-driven attacks on physical infrastructure.

Recommendations

1. Patch Immediately: Prioritise updating React and Next.js environments to mitigate CVE-2025-55182.
2. Review AI Permissions: Audit AI agents (like Langflow) for excessive API permissions and ensure internal tools are not exposed to the public web without strict access controls.
3. Validate Supply Chain Security: Defence and Government contractors must urgently assess the security posture of their third-party vendors in light of the IKAD breach.
4. Secure APIs: FinTechs should implement automated scanning for unauthenticated API endpoints to prevent data leaks.

Contact us for a quote for penetration testing service or adversary simulation.

React2Shell: A CISO’s Guide to CVE-2025-55182

Executive Summary

A new security flaw called React2Shell (CVE-2025-55182) puts Australian businesses at extreme risk. It has a severity score of CVSS 10.0, which is the highest possible rating. This flaw lets hackers take full control of your servers without needing a password. It affects the popular tools React and Next.js.

For Australian Chief Information Security Officers (CISOs), this is not just an IT problem. It is a legal risk. This flaw triggers strict reporting rules under the Security of Critical Infrastructure Act 2018 (SOCI). It also exposes you to massive fines under the Privacy Act. Hackers are already using this flaw. You must act now to secure your systems.

The Technical Threat: How It Works

React2Shell is a server-side prototype pollution flaw. It happens when the server processes data sent from a user. The server uses a tool called the "Flight" protocol to talk to the web browser. The flaw lets attackers send "poisoned" data that tricks the server.

The Failure Mechanism

When the server reads this poisoned data, it gets confused. It allows the attacker to change the basic rules of how the server software works. By changing these rules, the attacker can force the server to run malicious commands. This gives them a "shell," or full control over the machine.

Why This Is Dangerous

Most web flaws only trick the user's browser. React2Shell destroys the server itself. Compare it to other common threats:

Feature	Cross-Site Scripting (XSS)	SQL Injection (SQLi)	React2Shell (RCE)
Target	The User's Browser	The Database	The Application Server
Impact	Stolen logins	Stolen data	Total System Takeover
Access	Client-side	Data access	Full OS Control
Authentication	Often needs user action	Depends on the page	No Login Needed

Once inside, an attacker can steal sensitive information like API keys and cloud passwords. They can also install ransomware to lock your files.

The "Slop" Problem: Fake Attacks

A strange thing happened with this flaw. The internet was flooded with fake exploit code, often called "slop." These are broken scripts written by AI.

Don't Be Fooled

Security teams using vulnerability scanning tools might use these fake scripts to test their systems. When the script fails, they think they are safe. This is a dangerous mistake.

• False Security: Just because a public script fails does not mean you are safe.
• Malware Risk: Some of these fake scripts actually contain viruses that attack the security researcher.

Real Attackers Are Active

While people play with fake scripts, real hackers are working. Threat intelligence shows that groups like Earth Lamia and Jackpot Panda are already using real exploits. They are targeting the supply chain and critical sectors.

Australian Legal Risks

If you ignore this flaw, you face severe legal trouble in Australia.

SOCI Act Deadlines

If you run a critical asset, the law is strict.

• 12 Hours: You must report a "critical impact" (like a service outage) within 12 hours.
• 72 Hours: You must report a "relevant impact" (like unauthorized access) within 72 hours.

Hackers using React2Shell can hide their tracks. If you don't check your logs, you might miss the deadline and break the law.

Privacy Act Fines

A court recently ordered Australian Clinical Labs (ACL) to pay a $5.8 million penalty. The court said they failed to take "reasonable steps" to protect data. Leaving a known, critical flaw like React2Shell unpatched would likely be seen as a failure to take reasonable steps. This could lead to fines of over $50 million under new laws.

Remediation: Fix It Now

You cannot rely on firewalls alone. You must fix the code.

1. Patch Immediately

Update your software to the fixed versions. This is the only way to be safe.

Package	Vulnerable Versions	Patched Version
react-server-dom-webpack	19.0.0 - 19.2.0	19.2.1 or newer
Next.js	14.x, 15.x, 16.x	15.0.4+ / 16.0.7+

2. Harden Your Runtime

You can change how Node.js runs to stop these attacks. Use the --disable-proto=delete flag when starting your server. This removes the tool hackers use to pollute the server memory.

3. Watch Your Logs

Set up security controls to watch for attacks. Look for strange text in your logs like __proto__ or constructor. Remember, real attacks might look different from the fake "slop" scans.

Conclusion

React2Shell is a wake-up call. It shows how fragile the modern software supply chain can be. For Australian CISOs, the risk is high. The technical damage is bad, but the legal fines could be worse. Verify your systems. Patch your software. Prove you are taking reasonable steps to protect your data.

Daily Threat Briefing: Critical React RCE, Aussie Retailers Hit by Ransomware, and Android Zero-Days

Executive Summary

The last 24 hours have seen a significant escalation in web application threats with the disclosure of a critical Remote Code Execution (RCE) vulnerability in the React framework, dubbed "React2Shell". Australian organisations—particularly in the eCommerce and SaaS sectors—are also facing a renewed wave of ransomware activity, with prominent fashion retailers and logistics providers targeted by the INC Ransom and Qilin groups. Simultaneously, mobile security remains a priority as Google patches actively exploited zero-days affecting Android devices.

Here is your daily deep dive into the threat landscape affecting Australian businesses.

1. SaaS & Web Applications: The 'React2Shell' Critical RCE

Sector: SaaS, eCommerce, FinTech, Education
Threat: CVE-2025-55182 (CVSS 10.0)

The most critical development overnight is CVE-2025-55182, a maximum-severity vulnerability affecting React (versions 19.x), the popular JavaScript library used by millions of web applications globally.

• The Vulnerability: Dubbed "React2Shell", this flaw exists in React Server Components (RSC). It allows unauthenticated remote attackers to execute arbitrary code on the server by sending specially crafted HTTP requests.
• Impact: Any Australian SaaS provider, FinTech platform, or modern web app using affected versions of React/Next.js is at immediate risk of full server compromise.
• Status: Proof-of-concept (PoC) exploits are available, and active scanning has been detected. The Australian Cyber Security Centre (ACSC) and other agencies have issued urgent warnings.
• Action: Developers must upgrade to React versions 19.0.1, 19.1.2, or 19.2.1 immediately. Implement WAF rules to block malicious RSC payloads.

2. eCommerce & Logistics: Ransomware Groups Target Aussie Retail

Sector: Retail/eCommerce, Supply Chain
Threat Actors: INC Ransom, Qilin

A concerning spike in ransomware activity has hit the Australian retail supply chain in the last 24 hours.

• INC Ransom Claims: The group has listed Australian fashion retailers Oxford and textile supplier Instyle on their leak site, claiming to have exfiltrated sensitive customer and corporate data. This highlights the ongoing risk to the retail sector during the critical holiday trading period.
• Logistics Under Fire: B dynamic Logistics is currently investigating claims by the Qilin ransomware group regarding a significant breach. As a logistics provider, a disruption here could cascade through the supply chains of multiple Australian businesses relying on their services.
• Observation: These groups are increasingly employing "double extortion" tactics—encrypting systems and threatening to release stolen data to force payment.

3. Mobile & FinTech: Android Zero-Days Exploited in the Wild

Sector: FinTech, General Enterprise, Healthcare
Threat: CVE-2025-48572 & CVE-2025-48633

Google has released emergency patches for two high-severity zero-day vulnerabilities in the Android Framework that are being actively exploited in targeted attacks.

• The Flaws:
  • CVE-2025-48572: An Elevation of Privilege (EoP) vulnerability allowing attackers to gain system-level access.
  • CVE-2025-48633: An Information Disclosure flaw exposing sensitive user data.
• Australian Impact: FinTech apps, crypto wallets, and healthcare applications running on unpatched Android devices are vulnerable. Targeted attacks often focus on high-value individuals (executives, government officials) to steal credentials or financial data.
• Action: Organisations enforcing BYOD (Bring Your Own Device) policies should verify that employee devices are updated to the December 2025 security patch level immediately.

4. Education: University Systems Compromised

Sector: Education/EdTech
Threat: Business Email Compromise (BEC) / Account Takeover

Reports have emerged of a distressing cyber incident affecting an Australian university where compromised email systems were used to send fraudulent notifications to graduates claiming their degrees had been "revoked".

• Analysis: This incident demonstrates how attackers are moving beyond simple data theft to causing psychological distress and reputational chaos. It likely stems from a compromised administrative account or a lack of Multi-Factor Authentication (MFA) on critical communication channels.

5. Government & Critical Infrastructure: Governance and IoT Risks

Sector: Government, IoT, Critical Infrastructure
Threat: Regulatory Action & SCADA Vulnerabilities

• Regulatory Heat: The Office of the Australian Information Commissioner (OAIC) has initiated civil penalty proceedings against major entities (including Optus) for historical breaches, signalling a tougher stance on data governance failures.
• IoT/OT Warning: A new vulnerability in ScadaBR (an open-source SCADA software used in building automation and industrial control) has been added to the Known Exploited Vulnerabilities (KEV) catalog. Organisations using open-source OT tools must audit their exposure to prevent physical infrastructure manipulation.

Summary of Recommendations

1. Patch React: Prioritise updating React/Next.js environments to mitigate CVE-2025-55182.
2. Verify Third-Party Risk: Retailers should assess the security posture of their logistics and supply chain partners.
3. Mobile Hygiene: Enforce Android updates across corporate fleets.
4. Review Incident Response: Ensure your crisis communication plan is ready for "reputational sabotage" scenarios like the university email incident.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Ransomware Surge & Critical React Flaw Hits Australian Networks

Executive Summary

The last 24 hours have seen a significant escalation in cyber activity targeting Australian critical infrastructure and commercial sectors. The Australian Cyber Security Centre (ACSC) has issued a critical alert regarding a vulnerability in React Server Components, while ransomware groups have successfully breached targets across the Government, Defence, and FinTech sectors.

Today's briefing analyses these active threats, highlighting a disturbing trend of supply chain compromises and API misconfigurations that are leaving organisations exposed.

---

Sector-Specific Threat Intelligence

🏛️ Government & Defence: Supply Chain Under Siege

The defence supply chain faces renewed scrutiny today following confirmed breaches at IKAD Engineering, a key contractor for Australian naval projects. The J Group ransomware gang claims to have exfiltrated 800GB of sensitive data, including details related to the Hunter Class frigate program. This incident, combined with the Cyber Toufan group leaking data on the ADF’s Redback infantry vehicle, underscores the critical fragility of third-party vendors.

On the local government front, Muswellbrook Shire Council is dealing with the fallout of a SafePay ransomware attack. The threat actors have published 175GB of stolen data after negotiations reportedly stalled, a stark reminder of the "double extortion" tactic where data encryption is merely the opening move.

💸 FinTech: API Misconfigurations & Data Theft

Two significant incidents have rocked the financial sector in the last 24 hours:

1. Austin’s Financial Solutions: The Kairos ransomware group has claimed a major breach, allegedly stealing 147GB of data, including employee passports and payroll records.
2. Vroom by YouX: In a classic case of cloud negligence, a non-password-protected database was discovered exposing thousands of driver’s licences. This breach was not a sophisticated hack but a failure in basic cloud security posture management (CSPM), leaving APIs and data stores publicly accessible.

🏥 Healthcare & EdTech: Targeted Disruptions

The University of NSW (UNSW) has been targeted by hacktivist group RipperSec, which claimed responsibility for a DDoS attack and website defacement on the Physics Department's infrastructure. Meanwhile, in the healthcare sector, the Morpheus ransomware gang is pressuring DBG Health (pharmaceuticals), posting proof-of-compromise data including employee IDs.

---

Vulnerability Watch: Web, Cloud & Mobile

Security teams must prioritise the following vulnerabilities which are either being actively exploited or pose an imminent risk to Australian networks.

• React Server Components (CVE-2025-55182) - Critical Alert

  • Status: Active ACSC Alert (04 Dec 2025).
  • Impact: A critical flaw in React Server Components allows for potential remote code execution (RCE). Given the ubiquity of React in modern web applications, this is a high-priority patch for all SaaS providers and digital platforms.
  • Action: Audit all web applications using React Server Components immediately.

• Oracle WebLogic (CVE-2025-21535) - CVSS 9.8

  • Vector: Unauthenticated RCE via T3/IIOP protocols.
  • Risk: Attackers can take full control of servers without credentials. This is a favoured target for initial access brokers.
  • Mitigation: Block T3/IIOP access externally and apply the January 2025 critical patch update if not already done.

• Android Zero-Days (CVE-2025-48572 & CVE-2025-48633)

  • Status: Exploited in the wild.
  • Impact: Privilege escalation and information disclosure in the Android Framework.
  • Action: Mobile device management (MDM) administrators should enforce immediate OS updates for corporate fleets.

---

Emerging Threats: IoT and AI

• IoT Espionage Risks: Concerns have been raised regarding Chinese-made Yutong electric buses operating in Australian fleets. Reports suggest potential remote access capabilities that could be exploited for surveillance or sabotage, highlighting the need for rigorous IoT network segmentation.
• AI as a Threat Vector: A new report from CyberCX identifies AI not just as a tool for defence, but as a primary driver of threat acceleration. We are seeing "Shadow AI" adoption—where employees use unsanctioned AI tools—creating blind spots that bypass traditional data loss prevention (DLP) controls.

Recommendations

1. Review Third-Party Access: The IKAD Engineering breach demonstrates that your security is only as strong as your weakest vendor.
2. Lock Down Cloud APIs: The Vroom incident proves that basic misconfigurations are still causing massive data leaks. Automated scanning is essential.
3. Patch React & WebLogic: Do not delay on CVE-2025-55182 or CVE-2025-21535.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Defence Supply Chain Breach, AI RCEs & Critical Telco Fines

As we settle into December, the Australian cyber threat landscape is already heating up. In the last 24 hours, we’ve seen a major breach in the Defence supply chain, significant regulatory action against a local telco for anti-scam failures, and the discovery of a critical vulnerability in a widely used AI inference engine.

For security teams across Healthcare, FinTech, and Government, today’s briefing highlights the critical need for supply chain vigilance and rigorous identity verification.

Top Story: Defence Supply Chain Compromise

Target: IKAD Engineering Sector: Government / Defence Industry Breaking news indicates a significant cyber incident involving IKAD Engineering, a key contractor in the Australian Defence supply chain. Reports suggest that threat actors have breached the organisation's network, exposing potential risks to Australia’s weapons programs and sensitive defence projects.

• Impact: This incident underscores the "soft underbelly" of national security—third-party suppliers. While government agencies harden their own perimeters, adversaries are aggressively targeting smaller contractors with privileged access or sensitive technical data.
• Action: Defence contractors and sub-contractors must immediately review their external attack surface and strictly enforce the Essential Eight maturity levels, particularly regarding remote access and patch management.

Regulatory & FinTech: Southern Phone Fined $2.5m

Sector: Telecommunications / FinTech The Australian Communications and Media Authority (ACMA) has handed down a massive $2.5 million penalty to Southern Phone Company.

• The Issue: An investigation revealed that the telco failed to comply with anti-scam rules on over 160 occasions. Scammers successfully bypassed identity verification processes, allowing them to hijack customer mobile numbers (SIM swapping).
• Why it Matters: For FinTech and banking sectors, this is a critical alert. SIM swapping is a primary vector for defeating SMS-based Two-Factor Authentication (2FA). The failure of a telco to verify identities directly threatens the integrity of financial accounts protected by mobile 2FA.
• Action: FinTechs should accelerate the move away from SMS-based 2FA towards FIDO2 hardware keys or app-based authenticators to mitigate reliance on telco security.

Emerging Tech: Critical AI Remote Code Execution (RCE)

Target: AI Systems / SaaS Providers Vulnerability: vLLM Inference Engine (Versions 0.10.2+) A critical vulnerability has been disclosed in vLLM, a popular high-throughput and memory-efficient LLM serving engine used by many SaaS and AI providers.

• The Threat: Security researchers discovered that attackers can trigger Remote Code Execution (RCE) or crash servers simply by sending malicious prompt embeddings to the Completions API.
• Significance: As Australian organisations rush to deploy private AI models, the security of the underlying inference infrastructure is often overlooked. This flaw allows an attacker to break out of the model sandbox and compromise the host server.
• Action: AI engineering teams must update vLLM immediately and isolate inference servers from critical internal networks.

Infrastructure & Cloud Security

Sector: SaaS / Cloud Two other notable technical threats have emerged in the last 24 hours:

1. HashiCorp Vault Misconfiguration (CVE-2025-13357): A default setting in the Vault Terraform Provider could allow anonymous LDAP binds, potentially exposing secrets and encryption keys. DevOps teams using Terraform to manage Vault must verify their deny_null_bind configurations immediately.
2. GitLab Credential Leaks: New research released yesterday identified over 17,000 exposed credentials (including Google Cloud and OpenAI keys) in public GitLab repositories. Developers are urged to rotate keys and implement automated secret scanning in their CI/CD pipelines.

Sector Watch: Healthcare & IoT

• Healthcare: Following the Point Lonsdale Medical Group incident late last month, the sector remains on high alert. Ransomware groups are actively scanning for unpatched VPN concentrators and RDP endpoints in Australian medical centres.
• IoT: A new Mirai-based botnet, ShadowV2, has been observed exploiting unpatched routers and NAS devices. A critical authentication bypass in ASUS routers (CVE-2025-59366) is currently being weaponised; organisations with remote workforce fleets should ensure home office devices are patched.

Conclusion

Today's events serve as a stark reminder that compliance and configuration management are just as critical as advanced threat detection. Whether it's a misconfigured Terraform provider, a lapse in identity checks at a telco, or an unpatched AI engine, basic hygiene failures continue to offer adversaries the easiest path to compromise.

Contact us for a quote for penetration testing service or adversary simulation.