Daily Threat Briefing: React Critical RCE, Healthcare Under Fire, and New AI Risks

Executive Summary In the last 24 hours, the Australian cyber landscape has been dominated by urgent warnings regarding a maximum-severity vulnerability in the React framework, fresh ransomware concerns targeting Queensland healthcare providers, and significant developments in AI security governance. The Australian Cyber Security Centre (ACSC) and global partners continue to highlight the aggressive targeting of critical infrastructure by state-sponsored and opportunistic threat actors.

Top Critical Vulnerabilities

• React Server Components (CVE-2025-55182) – CVSS 10.0 The most pressing technical threat this week is the critical Remote Code Execution (RCE) vulnerability in React Server Components. Disclosed earlier this month, the ACSC has escalated its warning to an "Act Now" status as of yesterday. Exploitation requires minimal prerequisites, allowing attackers to execute arbitrary code on servers running unpatched versions (prior to 19.0.1).

  • Impact: Web Applications, SaaS Platforms.
  • Action: Immediate patching is non-negotiable. Developers using React for server-side rendering must audit their stacks immediately.

• Fortinet FortiCloud SSO (CVE-2025-59718 & CVE-2025-59719) Critical authentication bypass vulnerabilities have been identified in Fortinet's Single Sign-On (SSO) mechanism. These flaws allow attackers to bypass login procedures and gain administrative access to cloud-managed network appliances.

  • Impact: IoT, Network Infrastructure, Cloud Management.

• Microsoft Zero-Day (CVE-2025-62221) Microsoft’s final Patch Tuesday for 2025 addressed a zero-day elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys). This is currently being exploited in the wild to facilitate lateral movement after initial compromise.

Sector-Specific Updates

• Healthcare: The sector remains the primary target for ransomware in Australia. In the last 24 hours, reports have emerged of alleged cyber attacks impacting Harbour Town Doctors and the Hyperdome healthcare centre in Queensland. These incidents follow a disturbing trend of attackers exfiltrating sensitive patient data to leverage extortion demands. The ACSC notes that Australian healthcare providers currently face the highest ransomware rate globally.

• SaaS & Cloud: Beyond the React vulnerability, a new RCE flaw (CVE-2025-64671) has been discovered in the GitHub Copilot plugin for JetBrains IDEs. This highlights a growing attack surface: AI-assisted development tools. Malicious actors can potentially inject prompts to execute code on developers' machines ("IDEsaster"), compromising source code integrity.

• Government & Critical Infrastructure: The ACSC, in collaboration with CISA, has released the Principles for the Secure Integration of Artificial Intelligence in Operational Technology (OT). This guidance is a direct response to the increasing integration of AI agents into critical machinery and energy grids. Key risks identified include data poisoning and unauthorised control of physical systems.

  Additionally, a joint advisory warns of ongoing opportunistic attacks by pro-Russia hacktivists targeting critical infrastructure. These groups are utilising unsophisticated but disruptive DDoS and scanning techniques against Australian targets.

• FinTech: Commonwealth Bank (CommBank) has faced regulatory scrutiny with a $792k fine over breaches of Consumer Data Right rules. This serves as a reminder for FinTechs to ensure rigorous compliance with data sharing and privacy APIs.

• eCommerce: With the Christmas rush in full swing, a new wave of "fake delivery" scams purporting to be from Australia Post is utilising malicious QR codes to steal payment credentials. eCommerce platforms should proactively warn customers about these phishing vectors.

Emerging Trends: AI-Driven Identity Threats Research released this week indicates that 99% of Australian organisations are integrating AI agents into their identity infrastructure. However, security controls are lagging, with "identity-driven" attacks now ranked as the top concern for local CISOs. The speed at which AI agents can compromise systems necessitates a shift from human-speed monitoring to machine-speed automated defence.

Recommendations

1. Patch Immediately: Prioritise React (CVE-2025-55182) and Fortinet appliances.
2. Verify Suppliers: Review third-party access, particularly for healthcare patient management systems.
3. Secure Dev Environments: Audit AI coding assistants and ensure IDE plugins are updated to prevent supply chain compromise.

Contact us for a quote for penetration testing service or adversary simulation.

Urgent: Critical React & Fortinet Flaws Exploit Australian Networks

Executive Summary

The Australian cyber threat landscape has intensified significantly over the last 24 hours. The Australian Cyber Security Centre (ACSC) and global intelligence firms have issued urgent alerts regarding a perfect storm of critical vulnerabilities. Foremost among these is "React2Shell"—a CVSS 10.0 vulnerability in the React framework—and a severe authentication bypass in Fortinet appliances.

Simultaneously, ransomware groups are aggressively targeting Australian organisations, with confirmed breaches in the FinTech and Healthcare sectors. The Chaos and Qilin ransomware gangs have claimed responsibility for major data exfiltration events, highlighting the persistent threat to sensitive personally identifiable information (PII) and financial records.

Critical Vulnerabilities & Technical Deep Dive

1. "React2Shell" (CVE-2025-55182) – CVSS 10.0
This is the most critical threat currently facing Australian SaaS and web application providers. It is a pre-authentication Remote Code Execution (RCE) vulnerability affecting React Server Components, specifically within Next.js (versions 15.x and 16.x) using the App Router.

• The Exploit: Attackers are sending specially crafted HTTP requests to the Flight protocol endpoint. Due to insecure deserialisation, the server executes the malicious payload without requiring user login.
• Status: Active exploitation detected. China-nexus threat groups (e.g., Earth Lamia) and botnets like Mirai are actively scanning for vulnerable Australian servers.
• Action: Patch immediately to Next.js 15.1.0+ or 16.0.2+. If patching is not possible, implement strict WAF rules to block malicious Flight protocol requests.

2. Fortinet Auth Bypass (CVE-2025-59718 & CVE-2025-59719)
The ACSC has issued a critical alert regarding vulnerabilities in FortiOS, FortiProxy, and FortiWeb.

• The Vulnerability: Improper verification of cryptographic signatures allows an attacker to bypass FortiCloud Single Sign-On (SSO) authentication.
• Impact: A remote attacker can gain administrative access to the device management interface.
• Action: Upgrade to the latest firmware immediately. As a temporary mitigation, disable FortiCloud SSO login if not strictly required.

3. Microsoft Zero-Day (CVE-2025-62221)
Part of the December Patch Tuesday, this Local Privilege Escalation vulnerability in the Windows Cloud Files Mini Filter Driver is being exploited in the wild. Attackers with low-level access are using this to gain SYSTEM privileges on compromised endpoints.

Sector-Specific Threat Intelligence

FinTech & eCommerce

• ThinkMarkets Breach: The Melbourne-based brokerage firm has reportedly been hit by the Chaos ransomware group. Threat actors claim to have exfiltrated 512GB of data, including highly sensitive Know Your Customer (KYC) documents such as passport scans and driver's licences. This incident underscores the critical need for robust data segmentation in financial services.
• Austin’s Financial Solutions: Another victim of the Kairos ransomware gang, with 147GB of sensitive financial records allegedly stolen.
• API Security: Recent telemetry indicates Australia is experiencing the highest rate of API security incidents globally. FinTechs must audit all public-facing APIs for "Broken Object Level Authorization" (BOLA) vulnerabilities.

Healthcare

• Inotiv Incident: The pharmaceutical research organisation Inotiv has been compromised by the Qilin ransomware group. Data relating to clinical research and patient cohorts has likely been exfiltrated.
• DBG Health: The Morpheus ransomware gang has released data from a breach involving DBG Health, further pressuring the sector to move beyond basic compliance and towards resilience.

Government & Education

• Muswellbrook Shire Council: Following a ransomware incident, the SafePay gang has published 175GB of internal council data. This "double extortion" tactic—encrypting data and threatening to leak it—remains a primary lever for criminals targeting local government.
• University Sector: The KillSec and RipperSec groups continue to target educational institutions, with recent claims against private colleges and university sub-domains (e.g., UNSW Physics website).

IoT & Infrastructure

With the disclosure of the Fortinet vulnerabilities, IoT management networks are at extreme risk. "Edge devices" like firewalls and VPN concentrators are the new perimeter. If these are compromised, they serve as a bridge for attackers to pivot into Operational Technology (OT) environments.

Emerging Tactics: AI & Identity

A new report from Rubrik Zero Labs highlights that 98% of Australian security leaders are concerned about identity-driven threats. We are seeing a rise in "Shadow AI," where employees use unsanctioned AI tools to process corporate data, leading to accidental leakage. Furthermore, threat actors are leveraging AI to craft hyper-realistic phishing campaigns that bypass traditional email filters.

Strategic Recommendations

1. Patch React & Fortinet Now: These are not drill-level vulnerabilities; they are extinction-level events for digital assets.
2. Audit Your APIs: Ensure every API endpoint authenticates and authorises users correctly.
3. Assume Identity Compromise: With the volume of KYC data leaking from FinTechs, standard identity verification checks may no longer be sufficient. Implement hardware-backed MFA (e.g., YubiKeys) where possible.
4. Isolate Backups: Ransomware groups are specifically targeting backup servers. Ensure your backups are immutable and air-gapped.

Contact us for a quote for penetration testing service or adversary simulation.

Weekly Threat Briefing: Critical Fortinet Flaws, AI Vulnerabilities & Nation-State Shifts

The Australian cyber security landscape has experienced a turbulent week (7–14 December), dominated by a "Critical" alert from the Australian Cyber Security Centre (ACSC) regarding widespread vulnerabilities in edge devices and a worrying escalation in AI-assisted development flaws. As we approach the holiday shutdown period—a traditional window for heightened ransomware activity—organisations across Healthcare, Government, and FinTech must urgently prioritise patching and detection.

Here is your deep dive into the threats impacting Australian organisations this week.

Top Priority: The Fortinet Authentication Bypass (CVE-2025-59718)

Sectors Impacted: Government, Education, Healthcare, Enterprise

The most significant development this week is the disclosure of CVE-2025-59718, a critical authentication bypass vulnerability affecting FortiOS, FortiProxy, and FortiSwitchManager.

• The Threat: The vulnerability allows an unauthenticated, remote attacker to bypass FortiCloud Single Sign-On (SSO) mechanisms by forging SAML responses.
• Why it matters: Fortinet devices are ubiquitous in Australian Healthcare and University networks. Successful exploitation grants administrative access, allowing attackers to disable defences, intercept encrypted traffic, or deploy ransomware.
• Status: The ACSC and industry partners have observed active scanning for this vulnerability.
• Action: Patch immediately. If patching is not possible, disable FortiCloud admin login features.

Emerging Threat: AI Systems & SaaS Supply Chain

Sectors Impacted: SaaS Providers, FinTech, EdTech

For the first time in a major weekly briefing, a vulnerability in an AI-assisted development tool has taken centre stage.

• GitHub Copilot RCE (CVE-2025-64671): A Remote Code Execution flaw was discovered in the GitHub Copilot extension for VS Code. Threat actors can exploit this by hosting a malicious repository; when a developer opens it, the AI model's context processing triggers code execution on the developer's machine.
• Impact on SaaS: This represents a massive supply chain risk for SaaS providers and FinTech firms where developers have high-level access to production environments.
• React Server Components (CVE-2025-55182): A critical flaw in the React framework (widely used in eCommerce and EdTech platforms) allows for potential server-side request forgery (SSRF). Attackers can manipulate component rendering to access internal metadata services, a technique often used to steal cloud credentials.

Sector-Specific Threat Intelligence

Government & Critical Infrastructure

On 10 December, the ACSC released a joint advisory regarding Pro-Russia hacktivist groups targeting critical infrastructure. Unlike sophisticated state actors, these groups (such as NoName057) are focusing on "opportunistic" DDoS attacks and website defacements to disrupt public services and erode trust. While the technical sophistication is low, the operational disruption to public-facing government portals has been significant.

Healthcare

With the Fortinet vulnerability actively targeted, hospitals are at high risk. Medical IoT devices often reside on network segments protected by these very firewalls. A breach at the perimeter could expose patient data and connected life-support systems to ransomware gangs like LockBit or BianLian, who have recently ramped up activity in the APAC region.

eCommerce & Retail

As the holiday shopping season peaks, the React (CVE-2025-55182) vulnerability poses a severe threat to online retailers. Attackers are actively scanning for unpatched React server implementations to inject credit card skimmers or steal customer databases.

Summary of Actions

1. Patch Fortinet Appliances: Prioritise CVE-2025-59718 immediately.
2. Review AI Tooling: SaaS and FinTech CISOs should audit the use of AI coding assistants and ensure developers are running the latest extension versions.
3. Harden Web Apps: Update React frameworks to the latest patched version to prevent SSRF attacks.
4. Prepare for Holidays: Ensure 24/7 monitoring is in place for the upcoming break, as hacktivist activity is expected to spike.

Contact us for a quote for penetration testing service or adversary simulation.

Urgent: 'React2Shell' RCE Exploited by State Actors & New Healthcare Supply Chain Risks

Executive Summary

The Australian cyber threat landscape has reached a critical juncture in the last 24 hours. The primary focus for all security teams today is the rapid weaponisation of the ‘React2Shell’ vulnerability (CVE-2025-55182), which is actively being exploited by Chinese state-sponsored actors and cybercriminal syndicates to compromise web applications across the SaaS, FinTech, and Government sectors. Simultaneously, the healthcare sector faces a renewed supply chain crisis following a breach at a major IT services provider.

Here is your daily threat briefing for 13 December 2025.

Critical Vulnerability Alert: 'React2Shell' (CVE-2025-55182)

Sectors Impacted: SaaS, FinTech, Government, eCommerce

The Australian Cyber Security Centre (ACSC) has issued an "Act Now" alert regarding a critical Remote Code Execution (RCE) vulnerability in React Server Components, affecting versions 19.0 through 19.2.0.

• The Threat: Dubbed "React2Shell," this flaw allows unauthenticated attackers to execute arbitrary code on the server by manipulating the deserialisation logic of the Flight protocol.
• Current Activity: Intelligence indicates that multiple Advanced Persistent Threat (APT) groups, including those nexus to China, are operationalising this exploit to install web shells and exfiltrate sensitive customer data from Australian organisations.
• Why It Matters: With over 500 Australian organisations estimated to be vulnerable, this represents a "perfect 10" severity risk. FinTech platforms and SaaS providers using Next.js (App Router) are particularly exposed.
• Action: Patch immediately to the latest safe version. If patching is not feasible today, implement strict WAF rules to block malformed serialisation requests.

Sector Spotlight: Healthcare & Education

Threat Actor: KillSec Trend: Supply Chain Compromise & Extortion-Only Attacks

A significant supply chain attack has been identified targeting the Australian healthcare sector. Hexicor, a prominent IT services provider, has reportedly been compromised by the KillSec ransomware gang.

• Impact: This breach has potentially exposed credentials and sensitive patient data for dozens of downstream healthcare and aged-care clients.
• Tactical Shift: This incident aligns with a broader trend observed in the last 24 hours: a 40% rise in "extortion-only" attacks against Australian healthcare providers. Attackers are increasingly skipping the encryption phase to avoid automated detection, focusing instead on stealthy data theft to demand silence fees.
• Education Sector: KillSec has also claimed responsibility for an attack on the Albright Institute, highlighting their aggressive targeting of sectors holding personally identifiable information (PII).

Emerging Tech Risks: AI & Cloud Systems

Vulnerabilities: CVE-2025-64671 & CVE-2025-34291

As Australian enterprises rush to adopt Agentic AI, new attack surfaces are opening up:

• GitHub Copilot RCE (CVE-2025-64671): A new remote code execution vulnerability has been discovered in the GitHub Copilot plugin for JetBrains IDEs. This poses a severe risk to software supply chains, potentially allowing attackers to inject malicious code directly into developer environments.
• Langflow AI (CVE-2025-34291): A critical vulnerability in the popular Langflow AI agent platform allows for complete account takeover and RCE. Exploitation could expose API keys for integrated cloud services (AWS, Azure) and SaaS tools.

IoT & Operational Technology (OT)

Sectors: Manufacturing, Smart Infrastructure

• ScadaBR Vulnerability: A new vulnerability in ScadaBR automation software, widely used in Australian manufacturing and building management systems, has been added to the Known Exploited Vulnerabilities (KEV) catalogue. Attackers are using this entry point to pivot into Operational Technology (OT) networks.
• Smart Vehicle Warning: The eSafety Commissioner has issued a warning regarding the weaponisation of smart car telemetry. Features allowing remote tracking and locking are being exploited in domestic abuse scenarios, urging manufacturers to implement stricter access governance.

Recommendations

1. Prioritise React Patching: Treat CVE-2025-55182 as an emergency change request.
2. Review Third-Party Access: Healthcare organisations should immediately audit access logs for any connections from MSPs or third-party IT providers like Hexicor.
3. Secure AI Workflows: Ensure developers using AI coding assistants have updated their plugins and that AI agent platforms are behind strict authentication layers.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 12 December 2025

Executive Summary

The Australian cyber threat landscape for the last 24 hours has been dominated by the critical "React2Shell" vulnerability and the fallout from December’s "Patch Tuesday". State-sponsored actors and ransomware groups are moving with speed to exploit these new vectors. Additionally, a new report highlights a disturbing rise in data leakage through enterprise AI tools, impacting Australian SaaS and FinTech sectors heavily.

Top Critical Vulnerabilities: Immediate Action Required

• "React2Shell" (CVE-2025-55182) – CVSS 10.0

  • The Threat: A pre-authentication Remote Code Execution (RCE) vulnerability affecting React Server Components (React 19.x and Next.js 15.x/16.x).
  • Status: Active Exploitation. China-nexus threat groups (Earth Lamia, Jackpot Panda) and botnets (Mirai) are actively scanning for and exploiting this flaw across Australian web assets.
  • Action: Immediate patching or WAF rule deployment is mandatory for any organisation using Next.js App Router.

• Microsoft Zero-Day (CVE-2025-62221) – CVSS 7.8

  • The Threat: A use-after-free Elevation of Privilege vulnerability in the Windows Cloud Files Mini Filter Driver.
  • Status: Confirmed exploitation in the wild. Attackers are using this to gain SYSTEM privileges on compromised endpoints.
  • Action: Apply the December 2025 Patch Tuesday updates immediately.

• Google Chrome Zero-Day

  • Google has issued an emergency update (Dec 11) for a new zero-day actively used in attacks. Ensure all browser instances are updated to the latest stable channel.

Sector-Specific Updates

Healthcare & Pharma

• Inotiv Ransomware Incident: The pharmaceutical research firm Inotiv has confirmed a significant breach by the Qilin ransomware group. Data relating to clinical research and potentially sensitive patient cohorts has been exfiltrated. This follows the broader trend where healthcare remains the most breached sector in Australia for 2025.
• Guidance: Isolate backup servers and review third-party vendor connections, as supply chain compromises are the primary vector for Qilin.

SaaS & AI Providers

• AI Data Leakage Surge: A new report released yesterday indicates that 1 in 35 enterprise prompts sent to Generative AI tools now contain sensitive data (PII, source code, or internal credentials).
• SaaS Impact: Australian SaaS providers are urged to implement strict "AI DLP" (Data Loss Prevention) policies. Unmonitored use of AI copilots is currently the fastest-growing shadow IT risk.

Government & Education

• Services Australia Data Governance: Following a spike in data breaches involving Medicare and Centrelink credentials, the Federal Government is reviewing new powers to force rapid disclosure from third-party providers. Agencies should prepare for stricter compliance reporting requirements.
• Education Sector Targeting: Australian universities continue to face high volumes of brute-force attacks targeting authentication gateways, with recent incidents at UWA highlighting the fragility of password-only defences.

FinTech & eCommerce

• API Security Crisis: With 95% of Australian organisations reporting API security incidents this year, FinTechs are the prime target. Recent attacks have shifted from simple injection to Broken Object Level Authorization (BOLA), allowing attackers to scrape customer financial data by manipulating API calls.
• Threat Actor Watch: The Kairos ransomware group is actively targeting mid-tier Australian financial services, leveraging misconfigured cloud APIs for initial access.

IoT & Critical Infrastructure

• Satellite Supply Chain: New vulnerabilities in satellite ground control software have prompted the release of specialized defence tools by South Australian researchers. Operators in the space and defence supply chain (such as those connected to the REDBACK program) must heighten vigilance against espionage-focused groups like Cyber Toufan.

Threat Actor Focus: Qilin & Earth Lamia

• Qilin: Currently aggressive in the healthcare space, utilising double-extortion tactics. They are known to weaponise stolen data quickly if ransoms are not paid.
• Earth Lamia: A state-sponsored group rapidly operationalising the React2Shell vulnerability to establish persistence in critical networks before patches can be applied.

Recommendation Organisations must pivot from reactive patching to proactive threat hunting. With vulnerabilities like React2Shell allowing pre-auth RCE, perimeter defences are being bypassed in minutes. Ensure your EDR is tuned to detect post-exploitation behaviour, particularly "living-off-the-land" techniques using PowerShell (relevant to the new CVE-2025-54100).

Contact us for a quote for penetration testing service or adversary simulation.