Weekly Threat Briefing: Zero-Days Hit Apple & SolarWinds, NSW Health Under Pressure

Executive Summary

This week in Australian cyber security, the threat landscape is dominated by critical zero-day exploitations affecting widely used infrastructure. Federal agencies and private sector organisations are on high alert following CISA’s inclusion of new vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalogue. Locally, the healthcare sector remains under intense scrutiny following the release of a concerning audit of NSW Health’s cyber posture, while SaaS and AI-driven threats continue to evolve.

Sector Spotlight

Healthcare: Systemic Risks Exposed

The Australian healthcare sector is facing a "sustained cyber risk" environment. Following the recent audit tabled in NSW Parliament, which identified systemic non-compliance with cyber security controls across NSW Health, industry experts are warning that the sector remains critically exposed.

• Key Insight: A January 2026 report by Gallagher highlighted that Australian health service providers lodged over 200 data breach notifications in the past 12 months.
• Threat Vector: The convergence of IT and OT (Operational Technology) in hospitals, combined with legacy systems, makes clinical operations a prime target for ransomware. The audit revealed that many Local Health Districts (LHDs) are struggling to meet the NSW Government’s mandatory Cyber Security Policy (CSP) requirements.

Government & Critical Infrastructure

Federal agencies are urged to prioritise patching immediately following the detection of active exploitation of SolarWinds and Apple vulnerabilities.

• SolarWinds Web Help Desk (WHD): The US cyber security agency (CISA) has warned that CVE-2025-40536 (CVSS 8.1), a security control bypass, is being exploited in the wild. This flaw allows unauthenticated attackers to access restricted functionality, potentially leading to Remote Code Execution (RCE). Australian government bodies using WHD for IT service management must assume compromise if unpatched.
• Supply Chain Risks: The "PolarEdge" botnet, which compromised thousands of Cisco routers globally earlier this year, remains a persistent threat to critical infrastructure edge devices.

SaaS & Tech Providers

The SaaS landscape is grappling with "Shadow AI" and API vulnerabilities.

• Apple Zero-Day: A new buffer overflow vulnerability in Apple systems, tracked as CVE-2026-20700, has been patched after being exploited in highly sophisticated attacks. This serves as a reminder that even the most secure ecosystems are vulnerable to targeted zero-day campaigns.
• Shadow AI: With the rapid adoption of AI agents in the enterprise, organisations are struggling to govern "Shadow AI"—unauthorised AI tools used by employees. Vendors like Okta have released new governance tools this week to help CISOs detect these hidden risks, which often bypass traditional DLP (Data Loss Prevention) controls.

Vulnerability Watch: The "Must-Patch" List

Our penetration testing team has identified the following vulnerabilities as high-priority for Australian organisations this week:

1. Apple Core Systems (CVE-2026-20700)

   • Type: Buffer Overflow
   • Status: Exploited in the wild.
   • Impact: Arbitrary code execution on iOS and macOS devices.
   • Action: Update to the latest OS versions immediately.

2. SolarWinds Web Help Desk (CVE-2025-40536)

   • Type: Authentication Bypass
   • Status: Exploited in the wild (Zero-day).
   • Impact: Allows attackers to create internal proxy users and pivot to RCE.
   • Action: Apply the latest hotfix or isolate the WHD instance from the internet.

3. Notepad++ (CVE-2025-15556)

   • Type: Update Integrity Verification
   • Status: Active exploitation attempts observed.
   • Impact: Attackers can compromise the update mechanism to deliver malware.
   • Action: Verify the authenticity of all open-source tool updates.

Emerging Threat: The AI Attack Surface

As we move further into 2026, "AI-driven ransomware" is becoming a tangible reality. Reports this week suggest that threat actors are increasingly using LLMs to automate the generation of phishing campaigns that are indistinguishable from legitimate internal communications. For the Education and FinTech sectors, this means the "human firewall" is being tested like never before.

Recommendation: Review your email security gateways and conduct fresh adversary simulation exercises that mimic these AI-enhanced social engineering tactics.

---

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Critical SaaS RCEs & Healthcare Under Siege

Executive Summary

In the last 24 hours, the Australian cybersecurity landscape has been dominated by urgent warnings regarding remote access tools and a fresh wave of attacks targeting the healthcare sector. Of particular concern is the active exploitation of a critical vulnerability in BeyondTrust Remote Support, a tool widely used by Australian enterprises and managed service providers (MSPs). Additionally, new reports from the Australian Signals Directorate (ASD) and global bodies highlight the weaponisation of AI agents, reshaping the threat horizon for 2026.

---

1. SaaS & Remote Access: The BeyondTrust Critical RCE

Sector: SaaS, MSPs, Government
Threat Level: Critical (Active Exploitation)

The most significant development overnight is the discovery of a critical pre-authentication command injection vulnerability (CVE-2026-1731) in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) appliances.

• The Threat: Attackers are exploiting this flaw to inject malicious commands without needing credentials. This allows them to gain SYSTEM level access to the appliance, effectively hijacking the "keys to the kingdom" for remote management.
• Australian Impact: Given the heavy reliance on BeyondTrust by Australian MSPs and government agencies for secure remote access, this vulnerability presents a massive supply chain risk.
• Observed Activity: Security researchers have observed threat actors—likely state-sponsored—using this flaw to deploy lateral movement tools like AdsiSearcher and SimpleHelp binaries, renamed to blend in with legitimate processes.
• Action: Organisations must patch immediately. If patching is not possible, restrict access to the management interface to trusted internal IPs only.

2. Healthcare Sector: Diabetes WA & The Data Hemorrhage

Sector: Healthcare
Threat Level: High

The assault on Australia’s healthcare sector continues, with Diabetes WA confirmed as the latest casualty in a string of high-profile breaches.

• The Incident: While details are still emerging, initial reports indicate a significant data exfiltration event. This follows a worrying trend in early 2026 where attackers are aggressively targeting patient management systems and third-party SaaS providers used by clinics.
• Context: This incident comes off the back of the massive MediSecure fallout, reinforcing that health data remains a premium commodity on the dark web. The attackers are not just encrypting data; they are leveraging sensitive health information for double-extortion schemes.
• Emerging Trend: We are seeing a shift from "smash-and-grab" ransomware to "dwell-and-leak" operations, where attackers silently exfiltrate terabytes of data over weeks before triggering alarms.

3. IoT & OT: Critical Infrastructure on High Alert

Sector: Energy, Utilities, IoT
Threat Level: High

Following a disruptive cyber attack on Poland’s energy grid earlier this week, the CISA and ACSC have issued joint warnings regarding Operational Technology (OT) vulnerabilities.

• The Vulnerability: The alert focuses on vulnerabilities in legacy Remote Terminal Units (RTUs) and Human-Machine Interfaces (HMIs) that are common in Australian water and energy utilities.
• The Attack Vector: Threat actors are utilising "living off the land" techniques—using pre-installed, legitimate administration tools—to manipulate OT controls, making detection by standard IT security tools incredibly difficult.
• Local Relevance: Australian critical infrastructure operators are urged to segregate OT networks from IT environments and enforce strict read-only access where possible.

4. AI & Emerging Tech: The Rise of Autonomous Attack Agents

Sector: All Sectors (focus on EdTech/FinTech)
Threat Level: Emerging

As discussions from Safer Internet Day 2026 conclude, a new reality is setting in: AI is no longer just a tool for drafting emails; it is an autonomous threat actor.

• AI Agents: Security firms have reported the first wild instances of "autonomous AI attack agents." These are AI-driven scripts capable of self-healing and pivoting. If an attack path is blocked, the AI agent autonomously rewrites its code or tries a different exploit chain without human intervention.
• Target: EdTech and FinTech platforms are seeing the highest volume of these attacks, likely due to the rich datasets they hold and the complex API ecosystems they rely on.
• Defence: Traditional static rules (WAFs) are failing against these adaptive threats. Behavioural analysis and "identity-first" security models are now the baseline requirement.

---

Actionable Intelligence for Australian CISOs

1. Audit Remote Access: Immediately verify the version of any BeyondTrust appliances in your environment. Treat unpatched internet-facing instances as compromised.
2. Review Third-Party Risk: For healthcare providers, demand immediate assurance from SaaS vendors regarding their data handling and breach notification processes.
3. Segregate OT/IoT: Ensure your operational technology is air-gapped or strictly firewalled from your corporate network.
4. Monitor for Anomalies: With AI agents in the wild, look for "impossible travel" or erratic behaviour in API traffic that standard signature-based detection might miss.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 13 February 2026

Executive Summary

The last 24 hours in the Australian cyber threat landscape have been dominated by the escalating weaponisation of Generative AI, significant regulatory enforcement in the financial sector, and critical vulnerabilities in widely used SaaS automation tools. Nation-state actors, particularly the group identified as Salt Typhoon, continue to persistently target critical infrastructure, while the healthcare and education sectors face a fresh wave of data extortion campaigns.

Sector-Specific Updates

• Healthcare The sector remains under heavy fire. Diabetes WA has been identified as the latest victim of a cyber attack, with reports emerging of sensitive patient data exfiltration. This incident follows closely on the heels of the attack on an Adelaide women’s health clinic earlier this year. Furthermore, security researchers have flagged a disturbing trend of AI-generated deepfake advertisements impersonating leading Australian medical specialists to promote fraudulent supplements, posing a significant public health and trust risk.

• FinTech & Financial Services A landmark regulatory precedent has been set. The Federal Court has ordered Fiig Securities to pay a $2.5 million penalty for cybersecurity failures that left client data exposed. This is a clear signal to the FinTech sector that inadequate cyber resilience will incur severe financial and reputational costs. Additionally, CommBank research released this week highlights that while 89% of Australians feel confident spotting scams, only 42% can actually distinguish AI-generated banking fraud, signalling a need for stronger biometric anti-spoofing measures in banking apps.

• Education / EdTech The education sector is currently a primary target for ransomware groups. The Albright Institute of Language and Business has been hit by a cyber attack claimed by the threat actor KillSec, who allege to have stolen personal and business data. This incident compounds the ongoing fallout from the massive Victorian Department of Education data breach confirmed late last month, which impacted all 1,700 government schools.

• Government & Critical Infrastructure A new report reveals a critical visibility gap: only 35% of federal entities fully reported cyber incidents to the Australian Signals Directorate (ASD) in the last financial year. This underreporting hampers national situational awareness. Meanwhile, intelligence reports confirm that Salt Typhoon, a sophisticated China-linked threat actor, has been actively compromising Australian critical networks by exploiting vulnerabilities in edge devices (routers and firewalls) to maintain long-term stealthy persistence.

• SaaS Providers A Critical severity vulnerability (CVE-2026-21858) in the n8n workflow automation platform is being actively exploited. This Unauthenticated Remote Code Execution (RCE) flaw allows attackers to take full control of automation servers. SaaS providers and users utilising n8n for backend workflows must patch immediately. Additionally, unsecure MongoDB instances continue to be a vector for data leaks, with a new wave of automated attacks identifying exposed databases globally.

• eCommerce With Valentine's Day approaching, the Australian Federal Police (AFP) and KnowBe4 have issued urgent warnings regarding "industrial-scale" romance scams powered by deepfake video and voice technology. These AI agents can hold real-time video calls, bypassing traditional "proof of life" checks used by dating and eCommerce platforms to verify user identity.

• IoT (Internet of Things) The threat surface for IoT is expanding through "agentic AI". New analysis suggests that AI agents, capable of autonomous decision-making and interacting with IoT devices, are being weaponised to launch attacks at machine speed. Attackers are moving away from simple malware to "living off the land" techniques on compromised IoT edge devices to evade detection.

Technical Deep Dive: Exploited Vulnerabilities

• CVE-2026-21858 (n8n RCE): Exploitation is trivial and unauthenticated. Attackers are using this to inject malicious workflows that execute system commands, effectively turning automation servers into botnet nodes or crypto miners.
• Edge Device Compromise: Threat actors like Salt Typhoon are exploiting legacy vulnerabilities in Cisco and Fortinet edge devices to deploy custom rootkits. These rootkits survive firmware upgrades and allow traffic mirroring, enabling espionage without touching the internal endpoints.

Strategic Recommendations

Organisations must urgently pivot from passive defence to active validation. The rise of deepfakes renders standard identity verification obsolete; consider implementing challenge-response authentication for high-value transactions. For SaaS and Cloud environments, immediate patching of automation tools like n8n and rigorous review of MongoDB access controls are mandatory. Finally, government agencies must improve incident reporting pipelines to the ASD to ensure a coordinated national defence.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 12 February 2026

Executive Summary

The Australian cyber threat landscape for the last 24 hours has been dominated by a concerning breach of the national Early Warning Network (EWN) and a historic regulatory penalty in the FinTech sector. These events signal a shift from pure data theft to systemic disruption and regulatory accountability. Simultaneously, technical teams must urgently address critical vulnerabilities in AI agents and workflow automation tools that are being actively exploited in the wild.

Here is your deep dive into the threats impacting Australian organisations over the last 24 hours.

Sector Spotlight

Government & Critical Infrastructure: Trust Under Fire In a disturbing development confirmed yesterday (11 February), the Early Warning Network (EWN)—used by councils and emergency services to alert Australians to disasters—suffered a security breach. Threat actors gained unauthorised access to the broadcasting portal, sending false alerts to a subset of subscribers. While EWN officials state that only "white page" data (names and addresses) was accessed, the incident highlights a critical vulnerability in our national notification infrastructure. The ability for adversaries to hijack trusted communication channels poses a severe risk to public safety and trust.

FinTech: A $2.5 Million Warning The Federal Court has handed down a landmark penalty against fixed-income specialist FIIG Securities, ordering them to pay $2.5 million for cybersecurity failures related to a 2023 breach. This is the first time civil penalties have been applied purely for cyber resilience failures under Australian Financial Services (AFS) licence obligations. The court cited a lack of multi-factor authentication (MFA) and inadequate incident response testing. Key Takeaway: For Australian FinTechs, "tick-box" compliance is dead. The ASIC 2026 Outlook, released last week, explicitly flags "Agentic AI" fraud as the next frontier, warning that autonomous AI agents could be manipulated to authorise fraudulent transactions.

Healthcare: Psychological Warfare Epworth HealthCare remains in a standoff with the 0APT ransomware gang, which claims to have exfiltrated 920GB of sensitive surgical and billing records. As of today, Epworth maintains there is "no verified evidence" of the breach, suggesting this may be a "phantom" extortion attempt—a growing tactic where gangs bluff to force a payout. This follows the MediSecure fallout, reinforcing the immense pressure on the sector.

Education: The Long Tail of Breach The Victorian Department of Education is managing the escalating fallout of a massive breach confirmed in January, now known to impact all 1,700 government schools. Additionally, Loyola College is dealing with a confirmed ransomware attack by the Interlock gang, who have leaked nearly 600GB of data, including student passports, to the dark web.

Vulnerability Watch: What to Patch Now

1. AI Systems: OpenClaw 1-Click RCE (CVE-2026-25253) A critical vulnerability has been disclosed in OpenClaw (formerly Moltbot), a popular open-source AI agent used by developers. The flaw allows unauthenticated remote code execution (RCE) via a single malicious link.

• Risk: Attackers can steal authentication tokens and hijack the AI agent to execute commands on the host machine.
• Status: Active exploitation observed. Patch immediately to version 2026.1.29 or later.

2. SaaS & Cloud: Microsoft Office Zero-Day (CVE-2026-21509) Microsoft has issued an out-of-band patch for a "Security Feature Bypass" vulnerability in Office 365 and Office 2019/2021.

• Risk: Allows attackers to bypass the "Mark of the Web" and Protected View, enabling malicious macros to run without user warning.
• Intel: This is being actively exploited by state-sponsored actor APT28 (Fancy Bear) in campaigns targeting government and critical sectors.

3. Workflow Automation: n8n RCE (CVE-2026-21858) A critical RCE vulnerability in n8n, a workflow automation tool used to glue together SaaS apps, is being targeted. If you self-host n8n, ensure it is behind a VPN or strictly authenticated, as it often holds API keys for your entire SaaS stack (Salesforce, Slack, Google Workspace).

Strategic Outlook

The events of the last 24 hours confirm that we are entering an era of "Cyberthuggery"—where disruption and psychological pressure (as seen with Epworth and EWN) are becoming as valuable to attackers as data theft. With the launch of the Essential Eight Certification service yesterday, organisations have a new mechanism to prove their resilience, but compliance must be backed by genuine defensive depth.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: National Alert System Compromised, Landmark FinTech Penalty & New AI Workflow RCE

Executive Summary

In the last 24 hours, the Australian cyber security landscape has been dominated by a concerning breach of the national Early Warning Network and a historic regulatory penalty in the FinTech sector. Simultaneously, technical teams must urgently address critical vulnerabilities in workflow automation tools that power many modern SaaS and AI integrations.

---

Government & Critical Infrastructure: Early Warning Network Breach

Sector: Government / Critical Infrastructure Threat: System Compromise / Social Engineering

Yesterday, the Early Warning Network (EWN)—a critical system used by local councils and government agencies to alert Australians of natural disasters—was compromised. Unauthorised messages were broadcast to subscribers, falsely warning that their data was unsafe.

While EWN officials have stated that only "white page" data (names and addresses) may have been accessed, the incident highlights a severe vulnerability in IoT and notification infrastructure. The ability for threat actors to hijack a trusted emergency communication channel causes confusion and erodes public trust.

• Key Takeaway: Agencies must enforce stricter access controls (MFA) on broadcasting portals and audit third-party integrators who have API access to alert systems.

FinTech: A $2.5 Million Warning Shot

Sector: FinTech / Financial Services Impact: Regulatory Enforcement

In a landmark decision handed down yesterday, the Federal Court ordered FIIG Securities to pay a $2.5 million penalty for cyber security failures. This is the first time civil penalties have been applied for such failures under Australian Financial Services (AFS) licence obligations.

The penalty stems from a breach where FIIG failed to implement adequate controls, allowing threat actors to access sensitive client data.

• Key Takeaway: For FinTechs, security is no longer just an IT issue; it is a regulatory compliance mandate. The "reasonable steps" defence now requires demonstrable, mature security frameworks, not just policies on paper.

Education: Fallout from Victorian Schools Breach

Sector: Education / EdTech Threat: Third-Party Risk

The sector continues to reel from the Victorian Department of Education breach confirmed late last month, where third-party access compromised student data across 1,700 schools. New reports indicate that the initial entry point was a trusted vendor account with excessive privileges.

• Key Takeaway: EdTech providers must adopt "least privilege" access models. Schools should urgently review all external vendor accounts and revoke access for inactive or non-essential third parties.

Technical Focus: Web Apps, APIs & AI Systems

Critical RCE in n8n (CVE-2026-21858)

Target: SaaS / AI Automation Severity: Critical (CVSS 10.0)

A critical Unauthenticated Remote Code Execution (RCE) vulnerability has been identified in n8n, a popular workflow automation tool used extensively to glue together SaaS platforms and AI agents.

• The Risk: Threat actors can exploit this to execute arbitrary code on the server hosting the n8n instance. given n8n's role in handling API keys for services like OpenAI, Slack, and Salesforce, a compromise here is equivalent to handing over the keys to your entire SaaS estate.
• Action: Patch immediately. If you are using self-hosted n8n instances, ensure they are not exposed to the public internet without strict VPN/Auth layers.

Legacy Edge Devices Under Siege

Target: IoT / Network Infrastructure

The ASD and CISA have issued a joint warning regarding the active exploitation of End-of-Support (EOS) edge devices (routers, firewalls, and load balancers). Nation-state actors are using these unpatchable devices to maintain persistent access to Australian networks.

• Action: Audit your network perimeter. If you are running hardware that no longer receives firmware updates, it must be decommissioned or isolated behind a secure gateway immediately.

---

Conclusion

The events of the last 24 hours reinforce a clear message: trusted systems—whether they are emergency alerts, third-party vendors, or legacy hardware—are prime targets. Organisations must move beyond perimeter defence and assume that trusted channels can be subverted.

Contact us for a quote for penetration testing service or adversary simulation.