Australian Cyber Threat Briefing: MongoBleed, Prosura Breach, and AI Supply Chain Risks

The first week of 2026 has delivered a sharp wake-up call to Australian organisations, with critical vulnerabilities exposing the fragility of our digital supply chains and AI infrastructure. Over the last 24 hours, the threat landscape has been dominated by a high-profile insurer breach, a critical database flaw dubbed "MongoBleed", and urgent alerts for government and AI systems.

For security teams across Healthcare, FinTech, and Government, the message is clear: the attack surface is expanding, and authentication mechanisms are under siege. Here is your deep dive into the threats shaping today's security posture.

FinTech: Prosura Insurer Breach

Status: Active Incident Just hours ago, Australian insurance provider Prosura confirmed a significant cyber security incident. Unauthorised actors gained access to the insurer's systems, forcing the company to take its self-service portal offline.

• Impact: The breach has exposed sensitive customer data, including names, contact details, policy information, and driving licences. While Prosura states that payment data appears unaffected, the theft of government-issued IDs significantly elevates the risk of identity fraud for affected customers.
• Assessment: This incident highlights the persistent targeting of the insurance sector, where rich data aggregations make for lucrative targets. FinTechs must urgently review access controls on customer-facing portals.

Healthcare & eCommerce: The "MongoBleed" Crisis (CVE-2025-14847)

Status: Critical / Active Exploitation A critical unauthenticated memory leak vulnerability, dubbed "MongoBleed" (CVE-2025-14847), is actively being exploited in the wild. This flaw affects MongoDB servers—a staple in modern Healthcare patient record systems and eCommerce inventory platforms.

• The Threat: Attackers can read fragments of the server's memory without credentials. For healthcare providers, this risks the exposure of unstructured patient data (PII/PHI). For eCommerce retailers, it threatens to leak customer session tokens and payment fragments.
• Action: Immediate patching is required. If patching is not possible, ensure the database is not exposed to the public internet.

SaaS & EdTech: AI Supply Chain Compromise (CVE-2025-3248)

Status: Critical As Australian enterprises race to integrate AI agents, a dangerous flaw has been exploited in Langflow, a popular open-source UI for building AI applications. The vulnerability (CVE-2025-3248) permits unauthorised code injection via Python decorators in an API endpoint.

• Risk: Attackers are using this to compromise AI infrastructure and enterprise data pipelines. For EdTech and SaaS companies building LLM-wrapper applications, this highlights the urgent need to secure the "AI supply chain" just as rigorously as traditional software components.

Government: DFAT Vulnerability & Ethical Hacking Win

Status: Remediated A significant security gap within the Department of Foreign Affairs and Trade (DFAT) was brought to light this week. In a rare positive turn for government cybersecurity, the "critical vulnerability" was responsibly disclosed by a British ethical hacker, Jacob Riggs, rather than exploited by nation-state actors.

• Analysis: The flaw could have potentially exposed sensitive diplomatic data. This incident underscores the value of Vulnerability Disclosure Programs (VDPs) in the public sector.
• Action: Government agencies must accelerate the adoption of VDPs and ensure rapid remediation cycles for external reports.

IoT & Infrastructure: WatchGuard Under Attack

Status: Active Exploitation A critical vulnerability in WatchGuard Firebox devices (CVE-2025-14733) is currently being exploited to gain unauthenticated remote access to corporate networks. With IoT devices often sitting behind these perimeter defences, a breach here exposes the "soft underbelly" of connected operational technology (OT) environments.

Summary of Actionable Intelligence

1. Patch MongoDB immediately: CVE-2025-14847 is a "drop everything" patch event.
2. Review AI Integrations: Audit any usage of Langflow or similar low-code AI builders for CVE-2025-3248.
3. Harden Customer Portals: FinTechs should enforce MFA and rate-limiting on all self-service endpoints to prevent the type of access seen in the Prosura incident.
4. Monitor Identity Usage: With driving licences exposed in the Prosura breach, expect an uptick in identity fraud attempts across financial services.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: MongoBleed Crisis Deepens & WatchGuard Exploits Targeting Australian Networks

The last 24 hours have seen a critical escalation in attacks targeting Australian infrastructure, with a particular focus on database integrity and network perimeter devices. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) and AusCERT have issued urgent alerts regarding active exploitation of MongoDB and WatchGuard vulnerabilities.

Here is your daily deep dive into the threat landscape affecting Australian organisations.

Top Story: "MongoBleed" (CVE-2025-14847) Active Exploitation

The most significant threat observed in the last 24 hours is the rapid weaponisation of CVE-2025-14847, dubbed "MongoBleed". This critical vulnerability affects MongoDB servers and is caused by an improper handling of length parameter inconsistency in the zlib compression logic.

• The Threat: Unauthenticated attackers can repeatedly probe the server to leak uninitialized heap memory. This "bleeding" of data can expose sensitive credentials, session keys, and internal state data without requiring a login.
• Australian Impact: Security telemetry indicates over 87,000 instances globally are exposed, with a significant cluster in the Australian SaaS and FinTech sectors.
• Immediate Action: Assess all cloud-hosted and on-premise MongoDB instances. If immediate patching is not feasible, disable zlib compression to mitigate the leak vector.

Network Security: WatchGuard Firebox Under Siege

Threat actors are actively scanning for and exploiting CVE-2025-14733 in WatchGuard Firebox devices. This critical vulnerability allows for authentication bypass, granting attackers administrative access to the network perimeter.

• Sector Risk: This is particularly dangerous for Retail and IoT deployments where Firebox devices are often used as edge gateways.
• Observed Behaviour: Attackers are using this access to deploy webshells and establish persistence within corporate networks, often moving laterally to target internal file servers.

Sector-Specific Briefing

Healthcare & FinTech

The "MongoBleed" vulnerability poses a catastrophic risk to Healthcare and FinTech organisations. With patient records and financial transaction logs often stored in NoSQL databases like MongoDB, the potential for silent data exfiltration is high. We strongly advise detailed log analysis to detect anomalous memory read operations.

Government & Education

The ASD has renewed warnings regarding the React2Shell (CVE-2025-55182) vulnerability. Despite patches being available, over 500 Australian organisations, including several in the Education/EdTech sector, remain vulnerable. State-sponsored actors, notably linked to China, have been observed automating the exploitation of this flaw to compromise web servers.

eCommerce & SaaS

API Security Warning: A new wave of automated attacks targeting "Shadow APIs" (undocumented API endpoints) has been detected. Attackers are leveraging AI-driven fuzzing tools to identify weak authentication points in eCommerce platforms. Ensure all API endpoints are catalogued and behind a WAF (Web Application Firewall).

Emerging Threat: AI System Poisoning

As Australian enterprises rush to deploy internal Large Language Models (LLMs), we are seeing early indicators of Prompt Injection attacks targeting customer service AI agents. In the last 24 hours, reports have surfaced of attackers manipulating AI chatbots in the Banking sector to bypass identity verification workflows.

Vulnerability Watchlist (Last 24 Hours)

• MongoDB: CVE-2025-14847 (Critical - Memory Leak)
• WatchGuard: CVE-2025-14733 (Critical - Auth Bypass)
• React2Shell: CVE-2025-55182 (High - RCE, actively targeted)
• Mozilla Firefox/Thunderbird: Multiple vulnerabilities patched in yesterday's AusCERT bulletin (ESB-2026.0059). Immediate updates required for corporate endpoints.

Recommendations

1. Patch Immediately: Prioritise MongoDB and WatchGuard appliances.
2. Hunt for Indicators: Check logs for abnormal zlib compression errors (MongoDB) and unexpected administrative logins (WatchGuard).
3. Review AI Logic: If you are running customer-facing AI, test for prompt injection vulnerabilities that could disclose backend logic.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Cyber Threat Briefing: 06 January 2026

The first week of 2026 has delivered a sharp wake-up call to Australian organisations, with critical vulnerabilities exposing the fragility of our digital supply chains. Over the last 24 hours, the threat landscape has been dominated by a high-profile disclosure involving the Department of Foreign Affairs and Trade (DFAT), alongside urgent alerts for widely used database and API management systems.

For security teams across Healthcare, FinTech, and Government, the message is clear: the attack surface is expanding, and authentication mechanisms are under siege. Here is your deep dive into the threats shaping today's security posture.

Government: DFAT Vulnerability & Ethical Hacking Win

A significant security gap within the Department of Foreign Affairs and Trade (DFAT) was brought to light this week. In a rare positive turn for government cybersecurity, the "critical vulnerability" was responsibly disclosed by a British ethical hacker, Jacob Riggs, rather than exploited by nation-state actors. The flaw could have potentially exposed sensitive diplomatic data. This incident underscores the value of Vulnerability Disclosure Programs (VDPs) in the public sector.

• Action: Government agencies must accelerate the adoption of VDPs and ensure rapid remediation cycles for external reports.

Healthcare & eCommerce: The "MongoBleed" Crisis (CVE-2025-14847)

A critical unauthenticated memory leak vulnerability, dubbed "MongoBleed" (CVE-2025-14847), is actively being exploited in the wild. This flaw affects MongoDB servers—a staple in modern Healthcare patient record systems and eCommerce inventory platforms.

• The Threat: Attackers can read fragments of the server's memory without credentials. For healthcare providers, this risks the exposure of unstructured patient data (PII/PHI). For eCommerce retailers, it threatens to leak customer session tokens and payment fragments.
• Status: Active exploitation observed. Immediate patching is required.

FinTech & SaaS: IBM API Connect Auth Bypass (CVE-2025-13915)

Australian FinTechs and SaaS providers relying on IBM API Connect for Open Banking and API governance are facing a "drop everything and patch" scenario. A severe authentication bypass vulnerability (CVE-2025-13915) allows remote attackers to circumvent the API gateway’s security mechanisms.

• Impact: This effectively nullifies the gateway's role as a security checkpoint, potentially exposing backend financial ledgers and proprietary SaaS logic directly to the public internet.
• Recommendation: Audit API access logs for anomalous unauthenticated traffic from the last 72 hours.

AI Systems: Langflow Code Injection (CVE-2025-3248)

As Australian enterprises race to integrate AI agents, a dangerous flaw has been exploited in Langflow, a popular open-source UI for building AI applications. The vulnerability (CVE-2025-3248) permits unauthorised code injection via Python decorators in an API endpoint.

• Risk: Attackers are using this to compromise AI infrastructure and enterprise data pipelines. For EdTech and SaaS companies building LLM-wrapper applications, this highlights the urgent need to secure the "AI supply chain" just as rigorously as traditional software components.

IoT & Infrastructure: WatchGuard Firebox Under Attack

The IoT and network infrastructure sector is grappling with the active exploitation of CVE-2025-14733 in WatchGuard Firebox devices. Threat actors are leveraging this to gain initial access to corporate networks, often serving as a beachhead for ransomware deployment.

• Defence: Administrators should verify their firmware levels immediately and restrict management interface access to trusted internal subnets.

Summary of Actionable Intelligence

1. Patch MongoDB immediately to prevent memory leakage.
2. Verify API Gateways, specifically IBM API Connect, for bypass attempts.
3. Audit AI Pipelines using Langflow for unauthorised code changes.
4. Review VDP submissions if you are a government entity; the next report could save your network.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: MongoBleed Crisis & Critical Infrastructure Under Siege

Executive Summary

As we commence the first working week of 2026, the Australian cyber threat landscape is dominated by the fallout from the 'MongoBleed' vulnerability and a surge in attacks targeting critical edge infrastructure. Over the last 24 hours, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has observed intensified scanning activity targeting unpatched database and firewall systems. Threat actors are actively weaponising these flaws to infiltrate sectors ranging from FinTech to Education.

Priority Vulnerabilities & Exploits

1. The 'MongoBleed' Crisis (CVE-2025-14847)

Severity: Critical | Status: Active Global Exploitation The most pressing threat this morning is CVE-2025-14847, dubbed "MongoBleed". This vulnerability affects MongoDB servers and allows unauthenticated attackers to read server memory, potentially leaking session tokens, passwords, and sensitive PII without logging in—reminiscent of the 2014 Heartbleed bug.

• Impact: Massive risk for SaaS, FinTech, and Healthcare organisations relying on NoSQL databases for handling large datasets.
• Observation: Automated exploitation scripts are actively harvesting data from exposed Australian instances. If you run MongoDB, ensure patches released in late December are applied immediately or restrict network access.

2. Fortinet & WatchGuard Edge Exploitation

CVE-2025-59718 / CVE-2025-59719 (Fortinet) & CVE-2025-14733 (WatchGuard) Threat actors are aggressively targeting network perimeter devices.

• Fortinet: The authentication bypass in FortiOS and FortiWeb is being used to gain "God-mode" access to corporate networks. Attackers are authenticating as administrators and downloading configuration files.
• WatchGuard: Active exploitation of the Firebox vulnerability continues, with reports of ransomware groups using this as an initial access vector into Government and Critical Infrastructure networks.

3. 'React2Shell' Targeting Web Applications (CVE-2025-55182)

For eCommerce and EdTech platforms, the 'React2Shell' vulnerability in the React library remains a high-priority risk. It allows Remote Code Execution (RCE) via manipulated serialised objects. Botnets associated with Chinese threat clusters have been observed pivoting from scanning to payload delivery in the last 24 hours.

Sector-Specific Threat Intelligence

• Education / EdTech: Following the major breach at the University of Sydney late last month (impacting 13,000 staff and students), threat actors are now targeting downstream educational support vendors. We are seeing a spike in phishing campaigns impersonating university IT support to exploit the chaos.
• Healthcare: With the electronic prescription ecosystem still recovering from the MediSecure fallout, attackers are leveraging MongoBleed to target smaller clinics and SaaS providers managing patient records. The primary goal appears to be data extortion rather than encryption.
• FinTech: Credential stuffing attacks have spiked overnight, likely fuelled by fresh credential dumps from recent retail breaches. FinTechs should enforce strict MFA and monitor for anomalous session tokens potentially stolen via MongoBleed.
• IoT & Infrastructure: Shadowserver Foundation reports over 70,000 Australian IP addresses associated with vulnerable IoT devices are being beaconed by the Mirai botnet variants, likely preparing for a DDoS campaign.

Recommendations

1. Patch Immediately: Prioritise MongoDB (CVE-2025-14847) and perimeter devices (Fortinet/WatchGuard).
2. Hunt for Indicators: Check logs for unauthenticated memory read attempts on database ports and anomalous admin logins on firewalls.
3. Review Third-Party Risk: With EdTech and SaaS supply chains under fire, verify the security posture of your vendors.

Contact us for a quote for penetration testing service or adversary simulation.

Weekly Threat Briefing: Australia’s Cyber Landscape (29 Dec 2025 – 4 Jan 2026)

Introduction

As we settle into 2026, the Australian cyber threat landscape shows no signs of slowing down. The transition from December 2025 to January 2026 has been characterised by a volatile mix of critical infrastructure vulnerabilities and aggressive ransomware campaigns targeting the "edge" of corporate networks. This week, we have observed a sharp escalation in the exploitation of database and API vulnerabilities, alongside targeted attacks on the healthcare and education sectors.

This briefing provides a deep dive into the most significant cyber threats, incidents, and vulnerabilities impacting Australian organisations over the last 7 days.

Sector-Specific Threat Intelligence

• Healthcare: A Critical Target The healthcare sector remains under immense pressure. Following a challenging December, we have seen reports of a cyber attack affecting the Point Lonsdale Medical Group in Victoria, resulting in unauthorised access to sensitive patient information. This incident follows a major audit released in late 2025 which revealed systemic security bypasses within NSW Health districts, highlighting a culture of non-compliance that continues to leave patient data exposed. Threat actors are increasingly weaponising these gaps to extort providers.

• SaaS & Cloud Providers: The "MongoBleed" Crisis The most critical technical threat of the week is the "MongoBleed" vulnerability (CVE-2025-14847) affecting MongoDB servers. Despite a patch being available since late December, reports indicate that nearly 95% of exposed instances remain unpatched. Attackers are actively exploiting this to dump server memory and harvest credentials. Additionally, the supply chain risk to SaaS providers was underscored by the Hexicor breach. The KillSec ransomware gang targeted the IT services provider, exfiltrating client folders and hashed passwords, demonstrating how attackers use SaaS platforms as a pivot point to compromise downstream clients.

• FinTech: Ransomware and API Risks The financial sector faces dual threats from extortion and infrastructure flaws. Austin's Financial Solutions has fallen victim to the Kairos ransomware group, which allegedly stole and published 147GB of data, including employee passports and payroll records. Simultaneously, a critical vulnerability in IBM API Connect (CVE-2025-13915)—widely used by FinTechs to manage APIs for AI services—has been disclosed. This flaw allows authentication bypass, potentially giving attackers unauthorised access to sensitive banking APIs without valid credentials.

• Education / EdTech: Universities in the Crosshairs Australian universities continue to be prime targets. The University of New South Wales (UNSW) Physics Department was recently targeted by the hacktivist group RipperSec, causing service disruptions. Meanwhile, a breach at the University of Sydney involving an online IT code repository has exposed the fragility of development environments. The KillSec gang has also been observed pivoting to EdTech platforms, exploiting the high value of student data for extortion.

• Government & Critical Infrastructure Local government is not immune, with Muswellbrook Shire Council suffering a severe ransomware attack by the SafePay gang, leading to the publication of 175GB of internal data. At the network edge, critical vulnerabilities in WatchGuard Firebox (CVE-2025-14733) and Fortinet devices are being actively exploited to gain initial access to government and infrastructure networks.

• eCommerce & Retail As the festive season wraps up, scammers have ramped up activity targeting Australian consumers. A wave of fake Australia Post delivery messages and QR code scams has been intercepted, designed to steal personal and financial information. On the corporate side, Australian jeweller BECKS confirmed a cyber incident following claims by the SafePay ransomware group.

Vulnerability Spotlight: Web, API, and AI

• MongoBleed (CVE-2025-14847): A high-severity information disclosure flaw in MongoDB.

  • Risk: Allows unauthenticated attackers to read server memory, potentially exposing cleartext credentials and tokens.
  • Action: Patch immediately to the latest version (v8.0.17+).

• IBM API Connect (CVE-2025-13915): CVSS 9.8 (Critical).

  • Risk: Authentication bypass in the API gateway. This is particularly dangerous for organisations rushing to deploy AI services, as it breaks the assumption that the gateway enforces identity.
  • Action: Apply the patch for versions 10.0.8.x and 10.0.11.0 immediately.

• AI Weaponisation: We are observing a trend where threat actors use AI to "hyper-personalise" phishing campaigns and create "polymorphic" malware that changes its code to evade detection. Defenders must look beyond static signatures and focus on behavioural analysis.

Conclusion

The first week of 2026 serves as a stark reminder that basic hygiene—patching databases like MongoDB and securing network edges—remains the most effective defence against sophisticated adversaries. Organisations must also rigorously audit their third-party SaaS and API dependencies to mitigate supply chain risks.

Contact us for a quote for penetration testing service or adversary simulation.