Daily Threat Briefing: Australia – 14 January 2026

Executive Summary

The Australian cyber threat landscape for 14 January 2026 is dominated by a critical zero-day vulnerability in Microsoft Windows, actively exploited in the wild, and a confirmed breach of a major ASX-listed resource producer. The Australian Cyber Security Centre (ASD’s ACSC) has also issued fresh guidance on AI security following a surge in attacks targeting workflow automation platforms.

For security teams across Government, Healthcare, and SaaS, the priority today is patching the new Microsoft Desktop Window Manager flaw and auditing exposed automation tools.

---

Sector-Specific Threat Intelligence

Government & Critical Infrastructure

• Microsoft Zero-Day (CVE-2026-20805): In the last 24 hours, Microsoft’s January Patch Tuesday release has highlighted CVE-2026-20805, a privilege escalation vulnerability in the Desktop Window Manager (DWM). CISA and the ACSC have confirmed this is being actively exploited. Attackers are using this to gain ‘SYSTEM’ privileges on compromised government and enterprise workstations.
• Regis Resources Breach: Major Australian gold producer Regis Resources has confirmed a significant cyber incident. While details are emerging, this underscores the continued targeting of Australia’s critical resource sector by financially motivated ransomware groups.
• DFAT Vulnerability: On a positive note, a critical vulnerability in the Department of Foreign Affairs and Trade (DFAT) was responsibly disclosed by ethical hackers rather than exploited by nation-states, highlighting the value of robust Vulnerability Disclosure Programmes (VDPs).

Healthcare & eCommerce

• The "MongoBleed" Aftershocks (CVE-2025-14847): Security teams are still battling the fallout from the "MongoBleed" memory leak vulnerability. Threat actors are actively scanning for unpatched MongoDB instances in Australian healthcare providers to exfiltrate unstructured patient data (PII/PHI).
• eCommerce Session Hijacking: Retailers using MongoDB for session storage are at high risk. We have observed scripts in the wild attempting to scrape active session tokens via this flaw, potentially allowing account takeovers without credentials.

SaaS & FinTech

• n8n Workflow Automation RCE (CVE-2026-21858): A Critical (CVSS 9.8) Remote Code Execution vulnerability in the popular n8n workflow automation platform was flagged this week. SaaS providers and FinTechs using n8n for backend integrations (e.g., connecting CRMs to banking APIs) must isolate these instances immediately. Exploitation allows unauthenticated attackers to execute arbitrary code on the hosting server.
• IBM API Connect Auth Bypass: FinTechs relying on IBM API Connect for open banking implementations should review CVE-2025-13915. This authentication bypass flaw is being weaponised to skip API gateway security checks.

Education & EdTech

• University Data Retention Risks: Following the massive data breaches at the University of Sydney and Western Sydney University in late 2025, threat actors are now targeting alumni databases in EdTech platforms. The focus has shifted to extracting long-term historical data for identity theft.

IoT & AI Systems

• AI Security Alert: The ACSC released a new publication today (14 Jan 2026) regarding AI risks for small to medium businesses. This coincides with reports of Prompt Injection attacks targeting customer service chatbots, tricking them into revealing backend API keys.
• WatchGuard Firebox Exploits: Organisations using WatchGuard Firebox devices for edge security (common in distributed IoT networks) must patch CVE-2025-14733 immediately. Active exploitation is providing attackers with initial access to OT (Operational Technology) networks.

---

Vulnerability Watchlist: Top 3 to Patch Now

1. Microsoft Windows DWM (CVE-2026-20805):

   • Type: Privilege Escalation.
   • Status: Actively Exploited.
   • Action: Apply the January 2026 Patch Tuesday update immediately.

2. n8n Workflow Automation (CVE-2026-21858):

   • Type: Unauthenticated Remote Code Execution.
   • Status: PoC publicly available.
   • Action: Update to the latest stable release or restrict internet access to the instance.

3. MongoDB Server (CVE-2025-14847):

   • Type: Information Disclosure (Memory Leak).
   • Status: Targeted by ransomware groups.
   • Action: Upgrade to the latest patched version and audit log files for suspicious read operations.

---

Recommendations

Organisations should prioritise the patching of public-facing infrastructure, particularly the n8n and WatchGuard vulnerabilities. For internal networks, the Microsoft DWM flaw represents a critical risk for lateral movement if an endpoint is compromised.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Anubis Targets Healthcare & Critical RCE in n8n Automation

Executive Summary

In the last 24 hours, the Australian cyber threat landscape has been dominated by a resurgence of targeted ransomware campaigns against the healthcare sector and critical vulnerability disclosures affecting widely used SaaS automation tools. The Anubis ransomware gang has claimed responsibility for breaching a Queensland medical practice, while a Critical-rated Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform poses an immediate risk to SaaS providers and tech-driven enterprises.

Sector-Specific Threat Intelligence

Healthcare: Anubis Ransomware Aggression

The most concerning development overnight is the alleged compromise of Laidley Family Doctors in Queensland by the Anubis ransomware group.

• The Incident: Anubis has listed the clinic on its dark web leak site, claiming to have exfiltrated sensitive patient data, including Medicare numbers, medical histories, and personal contact details.
• The Actor: Anubis is employing a unique psychological pressure tactic. Their spokesperson, using the alias "Tobias Keller," poses as a journalist to "interview" victims and regulatory bodies, effectively weaponising media attention to force ransom payments.
• Impact: This follows a pattern of Anubis targeting smaller Australian healthcare providers (such as the previous Pound Road Medical Centre incident), exploiting the often limited cyber resilience of regional medical practices.

SaaS & Cloud: Critical n8n RCE (CVE-2026-21858)

For SaaS providers and organisations relying on low-code automation, a new critical alert has been issued.

• The Vulnerability: A Critical Unauthenticated Remote Code Execution (RCE) vulnerability (tracked as CVE-2026-21858) has been discovered in the n8n workflow automation platform.
• The Risk: This flaw allows attackers to execute arbitrary code on the server without logging in. given n8n's role in connecting disparate APIs and databases, a compromise here could act as a supply-chain bridge into deeper corporate networks.
• Action: Immediate patching or isolating n8n instances from the public internet is mandatory.

Education: Fallout from "Fog" Ransomware

The tertiary education sector continues to face headwinds. Following the University of Notre Dame Australia incident claimed by the Fog ransomware gang, chatter on underground forums indicates that Initial Access Brokers (IABs) are actively selling credentials for other Australian educational institutions. The market for ".edu.au" access remains lucrative due to the vast amounts of PII and research data held by these entities.

IoT & Infrastructure: WatchGuard & MongoDB Exploits

• WatchGuard Firebox: The ASD’s ACSC has flagged active exploitation of CVE-2025-14733, a critical vulnerability in WatchGuard Firebox devices. This is being leveraged to gain initial access to corporate networks.
• Database Leaks: Automated scanning for CVE-2025-14847 (a MongoDB server vulnerability) is spiking. Threat actors are using this to mass-exfiltrate data from misconfigured or unpatched cloud databases.

Emerging Trends & Threat Actor Behaviour

• API Insecurity: A new industry report highlights that Australian enterprises currently face the highest frequency of API-related security incidents in the Asia-Pacific region. With FinTech and eCommerce relying heavily on API ecosystems, "Zombie APIs" (forgotten, unmonitored endpoints) are becoming the primary vector for data breaches.
• Pro-Russia Hacktivism: The ASD has reiterated warnings regarding pro-Russia hacktivist groups shifting focus towards Australian critical infrastructure, likely in response to geopolitical stances. These attacks are typically DDoS or defacement but can mask more sophisticated intrusion attempts.

Recommendations

1. Healthcare: Review third-party remote access policies and ensure immutable backups are in place to counter ransomware encryption.
2. SaaS/DevOps: Audit all n8n instances immediately for CVE-2026-21858.
3. General: Prioritise patching of edge devices (firewalls, VPNs) and conduct a discovery audit to identify and decommission unused APIs.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia - 12 January 2026

Executive Summary

The Australian cyber threat landscape for Monday, 12 January 2026, is dominated by the fallout from the "MongoBleed" vulnerability and a coordinated surge in attacks targeting the healthcare and SaaS sectors. Over the weekend, threat actors have accelerated the weaponisation of critical flaws in workflow automation tools and API gateways. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has observed intensified scanning activity, and several high-profile domestic breaches have been confirmed.

Sector-Specific Threat Analysis

1. Healthcare: Under Siege from Ransomware and API Flaws The healthcare sector remains the primary target this week.

• Manage My Health (MMH) Update: Following the initial breach notification, the "Kazu" ransomware gang has escalated their extortion attempts, threatening to leak 400,000 patient files if a $60k ransom is not paid. Approximately 6-7% of the platform's 1.8 million users are affected, with stolen data including medical correspondence and discharge summaries.
• Laidley Family Doctors: In a separate incident, the Queensland-based clinic has been listed on the dark web leak site of the "Anubis" ransomware gang. The group claims to have exfiltrated sensitive patient history and Medicare details.
• IoMT Vulnerability: We are tracking active exploitation of Broken Object Level Authorization (BOLA) flaws in HL7 interface engines used to connect Internet of Medical Things (IoMT) devices. Attackers are attempting to intercept patient telemetry data directly from bedside monitors.

2. SaaS Providers: "Critical" n8n RCE & MongoBleed SaaS platforms are facing a dual threat from infrastructure and application-level vulnerabilities.

• n8n Workflow Automation: A maximum-severity vulnerability (CVE-2026-21858, CVSS 10.0) allows unauthenticated remote code execution (RCE) in self-hosted n8n instances. Attackers are exploiting this to take full control of automation servers. A secondary authenticated RCE (CVE-2026-21877) is also being leveraged against compromised accounts.
• "MongoBleed" (CVE-2025-14847): This unauthenticated memory leak in MongoDB servers continues to be a major vector. Threat actors are scraping server memory to extract session tokens and PII from SaaS backends without requiring login credentials.

3. FinTech: AI-Driven Vishing & Insurer Breach

• Prosura Data Breach: Australian insurer Prosura has taken its self-service portal offline following a breach exposing customer driving licences and policy data. This incident highlights the risk of "identity aggregation" targets.
• "DeepVoice" Campaign: A sophisticated social engineering campaign is targeting Australian neo-banks. Attackers are utilising AI-generated voice clones of C-suite executives to bypass voice biometric authentication and authorise fraudulent high-value transfers.

4. Education / EdTech: AI Supply Chain Risk

• Langflow Exploitation: EdTech platforms utilising the Langflow AI orchestration tool are being targeted via CVE-2025-3248. This vulnerability allows unauthorised Python code injection, effectively poisoning the "AI supply chain" and granting attackers access to underlying Large Language Model (LLM) data pipelines.
• LMS Ransomware: A new ransomware strain is targeting third-party plugins in Learning Management Systems (LMS), disrupting summer semester coursework for several tertiary institutions.

5. Government: Supply Chain & Perimeter Defence

• DFAT Disclosure: A critical vulnerability within the Department of Foreign Affairs and Trade (DFAT) was responsibly disclosed by an ethical hacker, preventing potential diplomatic data exposure.
• WatchGuard Firebox: Government networks remain on high alert regarding CVE-2025-14733. Active exploitation of this perimeter vulnerability is being used as a beachhead for lateral movement into secure zones.

6. IoT: Telematics Targeted

• Netstar Australia: The telematics provider has been listed by the "Black Shrantac" ransomware group. The alleged theft of GPS fleet tracking data poses significant operational risks to logistics and transport organisations relying on real-time monitoring.

Critical Vulnerabilities to Patch Immediately

• CVE-2026-21858: n8n Workflow Automation (Unauthenticated RCE) - CVSS 10.0
• CVE-2025-14847: MongoDB Server ("MongoBleed") - Memory Leak
• CVE-2025-3248: Langflow AI (Code Injection)
• CVE-2025-14733: WatchGuard Firebox (Auth Bypass)

Recommendations Organisations are urged to prioritise patching internet-facing automation tools and databases immediately. For FinTech and Healthcare entities, reviewing API gateway configurations for BOLA vulnerabilities and implementing phishing-resistant MFA (such as FIDO2 keys) is critical to countering the current wave of AI-enhanced attacks.

Contact us for a quote for penetration testing service or adversary simulation.

The ToolShell Crisis: Why Your SharePoint Server Is a Ticking Time Bomb

The ToolShell Crisis: Why Your SharePoint Server Is a Ticking Time Bomb

Executive Summary: The Australian Cyber Security Centre has issued urgent warnings about actively exploited vulnerabilities in Microsoft SharePoint Server (CVE-2025-53770) that enable unauthenticated remote code execution. With state-aligned actors and ransomware groups already compromising Australian organisations, this threat represents an immediate and severe risk to business-critical data and infrastructure.

What Is the ToolShell Vulnerability?

The cybersecurity community is confronting one of the most severe Microsoft SharePoint vulnerabilities in recent memory. Tracked as CVE-2025-53770 and colloquially known as “ToolShell”, this critical flaw enables unauthenticated attackers to execute arbitrary code on vulnerable on-premises SharePoint servers, with a CVSS severity score of 9.8.

The vulnerability stems from insecure deserialisation of untrusted data within SharePoint’s authentication mechanisms. When an attacker sends a specially crafted request to the /_layouts/15/ToolPane.aspx endpoint, the server processes malicious serialised objects, effectively bypassing authentication controls and executing commands with system-level privileges.

Key Technical Characteristics

• Attack Vector: Network-based, requires no user interaction
• Authentication: None required (unauthenticated exploitation)
• Impact: Complete system compromise and data breach
• Affected Versions: SharePoint Server 2016, 2019, and Subscription Edition
• Not Affected: SharePoint Online (Microsoft 365 cloud version)

Microsoft confirmed active exploitation in July 2025, and the ACSC immediately issued an “act now” alert to Australian organisations. The vulnerability is part of a broader attack chain that includes multiple SharePoint flaws, collectively creating an exploitation pathway that can even bypass partially applied patches.

Why Australian Organisations Are at High Risk

Australian businesses face disproportionate exposure to this threat due to several local factors that amplify both the likelihood of attack and the potential consequences of compromise.

Widespread On-Premises Deployment

Many Australian enterprises, particularly in government, healthcare, finance, and critical infrastructure, maintain on-premises SharePoint installations for compliance, data sovereignty, or legacy integration reasons. The ACSC has identified these sectors as primary targets, with a significant proportion of critical incidents now involving enterprise collaboration platforms.

Active Targeting by Sophisticated Actors

Exploitation has been linked to multiple nation-state groups alongside criminal ransomware operations. These actors are using ToolShell to gain initial footholds before deploying ransomware and conducting long-term espionage. The same techniques observed against overseas governments and Fortune 500 entities are now being applied to Australian organisations.

Regulatory and Compliance Pressure

With strengthened Privacy Act reforms and higher penalty regimes in force, organisations now face enhanced regulatory scrutiny and potential civil action for serious data breaches. A successful SharePoint compromise exposing customer or employee data can trigger:

• Regulatory investigations under privacy and sector-specific regimes
• Class actions and civil litigation for privacy harms
• Reputational damage impacting customer and investor confidence

The Business Impact of SharePoint Compromise

The consequences extend far beyond the initial server breach. SharePoint’s deep integration with the Microsoft ecosystem turns compromise into an enterprise-wide crisis.

Data Exfiltration and Intellectual Property Theft

Attackers gain immediate access to:

• Confidential business documents and strategic plans
• Financial records, contracts, and payroll data
• Customer databases and personally identifiable information
• Intellectual property and proprietary research

Lateral Movement and Network Propagation

Once inside, threat actors use SharePoint as a beachhead to:

• Harvest credentials and tokens from memory and configuration stores
• Move laterally to domain controllers and line-of-business applications
• Deploy ransomware across file servers and endpoints
• Establish persistent backdoors for long-term access

Operational Disruption and Financial Loss

SharePoint underpins internal collaboration and document workflows. Its compromise can disrupt:

• Day-to-day operations and project delivery
• Customer and supplier communications
• Regulatory reporting and board reporting cycles
• Finance, HR, and procurement processes

For large Australian organisations, the direct financial cost per serious cyber incident typically reaches six figures, excluding long-term brand and trust erosion.

How Attackers Are Exploiting This Flaw

Understanding the attack methodology is critical to appreciating why traditional controls often fail and why penetration testing services wide must simulate this specific threat.

Phase 1: Reconnaissance and Targeting

Attackers conduct wide-scale internet scanning to identify exposed SharePoint endpoints. Target lists are curated to include government, financial services, healthcare, education, and critical infrastructure entities across Australia and the broader region.

Phase 2: Initial Exploitation

The attacker sends a crafted POST request to ToolPane.aspx containing a malicious serialised payload generated with off-the-shelf tooling. This exploits the deserialisation flaw, allowing code execution within the SharePoint worker process—no credentials required.

Phase 3: Web Shell Deployment

Upon successful exploitation, the attacker deploys a web shell (often named similarly to spinstall0.aspx) into the SharePoint layouts directory. This provides persistent, remote command execution over HTTPS, blending into normal traffic.

Phase 4: Credential and Key Theft

From the compromised server, the web shell is used to extract:

• ASP.NET MachineKeys used to sign authentication cookies
• Service account credentials and cached tokens
• Configuration secrets and connection strings

With MachineKeys, attackers can forge valid authentication cookies and maintain access even after passwords are changed.

Phase 5: Post-Exploitation and Ransomware

Finally, actors deploy ransomware, exfiltrate data for double extortion, and pivot into Microsoft 365, Teams, and OneDrive environments where trust relationships are weakly segmented.

Detection Challenges for Internal Security Teams

Many Australian organisations lack the depth of logging, telemetry, and expertise needed to spot ToolShell exploitation in time. This is where targeted external penetration testing and internal penetration testing become critical validation tools.

Evasion Techniques

Attackers deliberately design payloads to evade:

• Signature-based antivirus solutions
• Generic intrusion detection systems
• Baseline log analysis without SharePoint-specific rules

Limited Visibility in Application Layer

Malicious activity executes inside legitimate SharePoint worker processes (w3wp.exe), making it appear as standard application behaviour. Without an application security assessment capability, subtle indicators such as odd PowerShell child processes or unusual file writes are easily missed.

Patch Bypass Capabilities

Perhaps most concerning, ToolShell can bypass earlier security updates when configuration and key rotation steps are mishandled. Organisations that rely solely on patch status reports may believe they are protected while remaining critically exposed.

Why Traditional Security Measures Are Insufficient

The ToolShell crisis exposes fundamental gaps in many organisations’ defensive assumptions.

Vulnerability Scanning vs. Penetration Testing

Standard vulnerability scanners report missing patches but cannot reliably validate exploitability, detect patch bypasses, or assess the end-to-end kill chain. This is the core limitation in the vulnerability assessment vs pen test debate.

Key takeaway: A “green” vulnerability scan report does not mean your SharePoint environment is safe from ToolShell-style attacks.

Limitations of Patch Management Alone

Microsoft’s emergency updates require careful, multi-step implementation:

• Timely installation across all SharePoint instances
• Rotation of cryptographic keys and secrets
• Validation that exploitation attempts are effectively blocked
• Coordination with change management and outage windows

Perimeter Defence Failure

Firewalls, web application firewalls, and IPS often cannot block this attack because it:

• Uses legitimate HTTPS traffic over standard ports
• Targets normal SharePoint endpoints and paths
• Involves encrypted and obfuscated payloads

Key takeaway: Perimeter controls alone are insufficient. Validation via realistic attack simulation is required.

The Critical Role of Penetration Testing

This threat landscape makes it abundantly clear why penetration testing is important. Only adversarial simulation can confirm whether your SharePoint deployment withstands real-world attack techniques.

External Penetration Testing

External penetration testing focused on SharePoint should:

• Identify all internet-exposed SharePoint instances and versions
• Attempt ToolShell exploitation chains in a controlled, safe manner
• Validate patch effectiveness and identify bypass conditions
• Assess how far an attacker can move from SharePoint into the broader network

Internal Penetration Testing

Internal penetration testing then assesses post-exploitation risk, including:

• Privilege escalation paths from SharePoint service accounts
• Detection of credential theft and lateral movement
• Ransomware deployment scenarios
• Effectiveness of monitoring and incident response processes

Red Team Assessment Services

Red team assessment services provide full kill-chain validation by:

• Emulating ToolShell tactics, techniques, and procedures (TTPs)
• Testing SOC detection, triage, and escalation
• Validating containment and eradication procedures
• Delivering board-ready reporting that translates technical findings into business risk

Immediate Actions for Australian Businesses

Organisations should treat this as a 24–48 hour response window. The following checklist can support rapid mitigation.

Emergency Mitigation Checklist

Action	Priority	Timeline
Identify all on-premises SharePoint servers	Critical	Within 4 hours
Disconnect internet-facing SharePoint servers (where feasible)	Critical	Immediately
Apply latest SharePoint security updates	Critical	Within 24 hours
Rotate ASP.NET MachineKeys and relevant credentials	High	Within 48 hours
Hunt for spinstall*.aspx or other suspicious web shells	Critical	Within 4 hours
Review SharePoint IIS logs for exploitation indicators	High	Within 24 hours

Compromise Assessment

If exploitation is suspected, organisations should:

• Engage incident response specialists immediately
• Preserve forensic images of affected systems
• Analyse web, security, and endpoint logs for anomalous activity
• Assess potential data exfiltration and regulatory notification obligations

Weekly Threat Briefing: Automation Platforms Under Siege & The Rise of AI Jailbreaks (11 Jan 2026)

Welcome to this week's threat briefing. As we settle into 2026, the Australian cyber landscape is already heating up with critical exploits targeting the very automation tools that drive our efficiency. From unauthenticated remote code execution in popular workflow platforms to the industrialisation of AI jailbreaking, this week has highlighted that "set and forget" is no longer a viable security strategy.

Here is your deep dive into the threats shaping the last 7 days.

Critical Vulnerability Spotlight: The n8n RCE

The most alarming development this week (8 Jan 2026) is the discovery of a critical unauthenticated Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform (tracked as CVE-2026-21858).

• The Risk: n8n is widely used by SaaS providers and tech-forward organisations to glue together APIs and services. This vulnerability allows an attacker to execute arbitrary code on the host server without needing to log in.
• Impact: For organisations using n8n to orchestrate sensitive data flows (e.g., connecting CRM data to billing systems), a compromise here effectively hands over the keys to your entire API ecosystem.
• Action: If you run self-hosted instances of n8n, patch immediately. Isolate these instances from the public internet where possible.

Sector-Specific Threat Analysis

SaaS & APIs: The Gateway Under Fire

Following the n8n disclosure, the IBM API Connect platform also came under scrutiny this week. On 6 January, warnings were issued regarding a critical vulnerability (CVE-2025-13915) that is now being actively probed.

• Observation: We are seeing a shift where attackers are moving away from brute-forcing front doors and instead targeting the "middleware" and API gateways that manage trust.
• Advice: Review your API gateway logs for anomalous traffic patterns, specifically inspecting for injection attempts in header fields.

Retail & FinTech: The Initial Access Bazaar

A new report released this week by Cyble on the ANZ Threat Landscape has revealed a disturbing trend for 2026: Retail organisations now account for 34% of all Initial Access Broker (IAB) sales, followed closely by the Banking, Financial Services, and Insurance (BFSI) sector.

• The Threat: Cybercriminals are not just stealing credit cards; they are selling "footholds" into corporate networks.
• Actor Profile: The threat group "Warlock" has been identified as a key player, leveraging unpatched on-premises SharePoint vulnerabilities to establish persistence before selling access to ransomware affiliates.

Healthcare: Data Rich, Security Poor

While no massive new breach was declared this specific week, intelligence indicates that the Morpheus ransomware group is actively re-tooling to target healthcare interoperability standards (like FHIR APIs). The digitisation of patient records remains a double-edged sword; ensure your third-party integrations are strictly scoped.

Government: The Scam Relocation

The Australian Cyber Security Centre (ACSC) and regional partners have tracked a significant movement of organised scam syndicates. As of 5 January, intelligence suggests these groups are relocating operations from Myanmar to Cambodia (specifically Malai province).

• Relevance: Expect a new wave of highly sophisticated, socially engineered "pig butchering" scams targeting Australian government employees and contractors. These often begin via innocuous messages on encrypted messaging apps.

Emerging Tech: AI Systems & The "Storm"

The intersection of AI and cybersecurity is no longer theoretical. The threat actor tracked as Storm-2139 continues to demonstrate capability in "AI Jailbreaking".

• Method: By compromising Azure OpenAI accounts via stolen credentials, they are modifying guardrails to generate illicit content and bypass safety filters.
• Corporate Risk: If your organisation relies on "wrapper" applications around LLMs, be aware that attackers are actively looking for prompt injection vulnerabilities to manipulate your AI's output or exfiltrate data.

IoT & Infrastructure: WatchGuard Exploitation

Finally, reports from late December into this week confirm active exploitation of WatchGuard Firebox devices (CVE-2025-14733). These edge devices are often the first line of defence; if unpatched, they become the attacker's beachhead.

Summary & Recommendations

The theme for January 2026 is clear: Interconnectivity is the vulnerability. Whether it is an automation tool like n8n, an API gateway, or a third-party vendor access point, the "glue" holding your stack together is under attack.

Immediate Priorities:

1. Patch n8n and IBM API Connect instances immediately.
2. Audit specific egress traffic from your automation servers—they should only talk to known endpoints.
3. Refresh anti-phishing training for staff regarding "relationship" scams (pig butchering), particularly in government and defence sectors.

Contact us for a quote for penetration testing service or adversary simulation.