Urgent: Chrome Zero-Day, Government Blind Spots & The AI Agent Threat

The last 24 hours have exposed critical fractures in Australia’s national cyber resilience, ranging from federal compliance failures to the active weaponisation of autonomous AI systems. For security teams across the country, the immediate priority is a critical zero-day patching cycle for web/SaaS access, while C-level executives must urgently review third-party governance and incident reporting protocols.

Here is your deep dive into the threats impacting Australian organisations over the last 24 hours.

Top Priority: Critical Vulnerabilities

Google Chrome Zero-Day (CVE-2026-2441)

• Severity: Critical (Actively Exploited)
• Target: Web Applications & SaaS Access
• Intel: Google has released an emergency update to address a Use-After-Free vulnerability in Chrome’s CSS processing component. Threat actors are actively exploiting this in the wild to execute arbitrary code on victim machines via crafted HTML pages.
• Action: Immediate patching to version 145.0.7632.75 is required. This poses a significant risk to organisations relying on browser-based SaaS platforms, as a single compromised endpoint can bypass perimeter defences.

BeyondTrust Remote Access (CVE-2026-1731)

• Severity: Critical
• Target: Cloud/Hybrid Infrastructure
• Intel: Arctic Wolf has confirmed active exploitation of this pre-authentication remote code execution flaw in self-hosted BeyondTrust environments. Attackers are using this to gain initial footholds in privileged networks.
• Action: Verify all instances are patched immediately. Cloud-hosted instances have been patched by the vendor, but on-premise/hybrid deployments remain vulnerable.

---

Sector Spotlight

Government: The "Silent" Breach Crisis

A concerning report tabled in Parliament yesterday reveals a massive visibility gap in our national defence. It has been confirmed that only 35% of federal government entities reported at least half of their observed cyber incidents to the Australian Signals Directorate (ASD) in the 2024-25 period.

• Impact: This lack of reporting creates a "fog of war" that allows sophisticated state-sponsored actors, such as the persistent Salt Typhoon group, to maintain long-term access to critical networks without detection.
• Takeaway: We expect a swift regulatory crackdown. Agencies and government contractors should prepare for stricter mandatory reporting audits in Q2 2026.

Healthcare: Ransomware Resurgence

The healthcare sector remains in the crosshairs of the 0APT ransomware gang. Following the attack on Epworth HealthCare earlier this month, intelligence indicates the group is now pivoting to smaller allied health providers to lateral move into larger hospital networks.

• Trend: Attackers are weaponising sensitive patient data not just for extortion, but to force "psychological pressure" negotiations, a tactic seen in the recent Medibank class action developments.

Retail & Hospitality: Seagrass Group Incident

Seagrass Boutique Hospitality Group has confirmed a cyber incident involving unauthorised network access, with the Kairos ransomware gang claiming responsibility.

• Analysis: Kairos is known for rapid data exfiltration before encryption. Retailers must assume that if their perimeter is breached, customer data is already gone before the ransom note appears.

FinTech: The Cost of Vendor Negligence

The regulatory patience for "tick-box" compliance has run out. The historic $2.5 million penalty handed down to FIIG Securities regarding vendor security failures sets a new precedent.

• Risk: FinTechs are no longer just liable for their own systems but are effectively the "security guarantors" for their entire supply chain.

IoT: The Spy in the Driveway

The Office of the Australian Information Commissioner (OAIC) has formally commenced investigations into connected vehicles.

• Threat: The ASD has identified instances of vehicles recording conversations without consent and transmitting telemetry that could be intercepted by foreign actors. For corporate fleets, this turns every company car into a potential mobile listening device.

AI Systems: The Rise of "AI Agents" as Vectors

A new frontier of threat has emerged in the last 24 hours. Vulnerabilities have been discovered in Moltbook (a social media platform for AI agents), and we are seeing the first weaponisation of OpenClaw tools.

• Scenario: Threat actors are compromising autonomous AI agents to inject poisoned data into corporate decision-making models. This is no longer theoretical; it is an active attack vector targeting automated procurement and customer support systems.

Summary & Recommendation

The threat landscape in February 2026 is defined by access exploitation—whether through unpatched browsers, forgotten service accounts, or unmonitored third-party vendors. The distinction between "internal" and "external" networks is gone.

Your immediate focus today must be:

1. Patch Chrome and BeyondTrust instances.
2. Audit your incident reporting pathways to ensure alignment with ASD requirements.
3. Review AI agent permissions to prevent automated data exfiltration.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Threat Intelligence Briefing: Chrome Zero-Days, Government Gaps & AI Agent Risks

Executive Summary

In the last 24 hours, the Australian cyber threat landscape has been dominated by the discovery of an actively exploited Zero-Day in Google Chrome and the release of concerning data regarding government incident reporting. Critical vulnerabilities in SaaS platforms and the escalating weaponisation of AI agents continue to pose significant risks to local organisations.

Critical Vulnerability Alert: Google Chrome Zero-Day (CVE-2026-2441)

Sectors Impacted: All (SaaS, Education, Government, FinTech) Google has released an emergency security update to address a high-severity Zero-Day vulnerability (CVE-2026-2441) in the Chrome browser.

• The Flaw: A Use-After-Free vulnerability within the CSS processing component.
• The Risk: Threat actors are actively exploiting this in the wild to execute arbitrary code on victim machines via crafted HTML pages.
• Action Required: Security teams must ensure all instances of Chrome are updated to version 145.0.7632.75 immediately. This also affects Chromium-based browsers used in many enterprise SaaS environments.

Government & Critical Infrastructure: The "Silent" Risk

Sectors Impacted: Government, Critical Infrastructure New data released yesterday highlights a concerning gap in our national cyber resilience. A report tabled in Parliament reveals that a significant number of Federal Government entities are failing to report cyber incidents to the Australian Signals Directorate (ASD).

• Key Insight: Despite 92% of entities claiming "Effective" compliance with the Protective Security Policy Framework (PSPF), actual technology security controls remains a weak point.
• The Threat: The lack of visibility into these "silent" breaches allows state-sponsored actors (such as the persistent Salt Typhoon group) to maintain long-term access to critical networks without detection.

Supply Chain & Third-Party Risk

Sectors Impacted: FinTech, Healthcare, eCommerce New research from BlueVoyant released on 16 February indicates that 99% of Australian organisations have been negatively impacted by a third-party or supply chain breach in the past year.

• The Trend: Attackers are bypassing hardened perimeter defences by targeting smaller, less secure vendors.
• FinTech Warning: This comes in the wake of the historic $2.5 million penalty handed down to FIIG Securities, setting a precedent that governance failures and "tick-box compliance" regarding vendor security will no longer be tolerated by regulators.

Sector-Specific Updates

• Healthcare: The sector remains on high alert following the 0APT gang's claimed attack on Epworth HealthCare. With ransomware groups increasingly using psychological pressure and data exfiltration (surgical records, billing details), data segregation is critical.
• Education/EdTech: The fallout from the Victorian Department of Education breach (impacting 665,000 students) continues to widen. We are observing an increase in phishing campaigns targeting the exposed credentials of students and staff.
• AI Systems: A new frontier of threat has emerged with "AI Agents." Vulnerabilities in platforms like Moltbook (a social media site for AI agents) and the weaponisation of tools like OpenClaw demonstrate that autonomous AI systems are becoming both targets and vectors for attack.
• SaaS & Cloud: BeyondTrust administrators should verify they have patched CVE-2026-1731, a critical pre-authentication remote code execution flaw that has seen rapid exploitation since its disclosure.

Conclusion

The events of the last 24 hours reinforce the need for "assumed breach" mentalities. From unpatched browsers to silent supply chain compromises, the perimeter is porous. Australian organisations must pivot from passive defence to active validation of their security controls.

Contact us for a quote for penetration testing service or adversary simulation.

Threat Briefing: BeyondTrust Critical RCE, Healthcare Under Siege & The $2.5M FinTech Warning

Executive Summary

The Australian cybersecurity landscape has shifted dramatically in the last 24 hours. Security teams across the country must urgently prioritise the remediation of a critical remote code execution (RCE) vulnerability in BeyondTrust appliances, which is currently seeing active exploitation. Simultaneously, the healthcare sector faces a fresh wave of extortion attempts from the '0APT' group, and the Federal Court has handed down a landmark $2.5 million penalty to a financial services firm, setting a new precedent for board-level accountability.

Here is your deep dive into the threats impacting Australian organisations over the last 24 hours.

---

Critical Vulnerability Alert: SaaS & Remote Access

BeyondTrust Remote Support RCE (CVE-2026-1731)

• Threat Level: Critical (Active Exploitation)
• Impact: System Takeover
• Target Sectors: Government, MSPs, Enterprise

A critical pre-authentication command injection vulnerability has been discovered in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) appliances. This flaw allows unauthenticated attackers to inject malicious commands and gain SYSTEM-level access, effectively handing them the keys to the kingdom.

Intelligence: Threat actors—suspected to be state-sponsored—are actively exploiting this to deploy lateral movement tools like AdsiSearcher disguised as legitimate binaries. Given the heavy reliance on BeyondTrust by Australian Managed Service Providers (MSPs) and government agencies, the supply chain risk is severe.

Recommendation: Patch immediately. If patching is not feasible, restrict management interface access to trusted internal IPs only.

Cisco Meeting Management (CVE-2026-20098)

• Threat Level: High
• Impact: Privilege Escalation

Organisations using on-premise collaboration hardware must address a high-severity flaw in Cisco Meeting Management. Disclosed earlier this month and now seeing proof-of-concept circulation, this vulnerability allows authenticated remote attackers to elevate privileges to root.

---

Sector Intelligence

Healthcare: The '0APT' Ransomware Siege

The assault on Australia’s healthcare sector has intensified. Diabetes WA has been confirmed as the latest casualty, with reports indicating a significant data exfiltration event involving patient records.

This incident follows the 5 February claims by the emerging 0APT ransomware gang, who allege they have stolen 920GB of sensitive data—including surgical records—from the Epworth HealthCare group. While investigations are ongoing, these incidents highlight a ruthlessly effective pivot by adversaries towards psychological pressure tactics, leveraging sensitive health data to force rapid settlement.

FinTech: A $2.5 Million Governance Warning

In a move that should send shockwaves through Australian boardrooms, the Federal Court has ordered FIIG Securities to pay a $2.5 million penalty for failing to adequately protect client data.

This ruling, stemming from a breach that exposed client data to the dark web, reinforces that cybersecurity is no longer just an IT issue—it is a non-negotiable governance obligation. The court found FIIG’s risk management practices insufficient, a verdict that mirrors the Australian Securities and Investments Commission's (ASIC) aggressive new stance on cyber resilience.

Emerging Risk: ASIC has also flagged "Agentic AI" as a key risk for 2026. FinTechs deploying autonomous AI agents for transaction monitoring must guard against manipulation attacks where agents are tricked into authorising fraudulent transfers.

Government & Education: Access Control Failures

The Victorian Department of Education continues to manage the fallout of a significant breach affecting 1,700 schools. Intelligence suggests the initial entry point was not a zero-day exploit, but rather "ghost credentials"—valid accounts that should have been revoked. This aligns with recent ACSC data showing that identity-based attacks now outpace malware infections as the primary vector for public sector compromises.

IoT & Automotive: Privacy Probe Launched

The Australian Privacy Commissioner has launched an investigation into two major automotive manufacturers regarding "spying cars". The inquiry focuses on the unauthorised collection of driver behaviour data—including voice recordings and location history—which is allegedly being sold to third-party advertisers and insurers.

---

Emerging Threat Landscape

• API Security: Australia is now the region's most targeted nation for API breaches. A new report indicates that 95% of Australian organisations have experienced an API security incident in the last 12 months, with unmanaged "Shadow APIs" providing a backdoor for attackers to bypass perimeter defences.
• n8n Workflow Automation: Users of the n8n automation platform must patch CVE-2026-21858, a critical unauthenticated RCE that allows attackers to execute arbitrary code via crafted workflows.

Action Plan for CISOs

1. Patch BeyondTrust and n8n appliances immediately; treat these as emergency changes.
2. Review Off-Boarding Processes: The Education breach highlights the danger of dormant accounts. Audit your Active Directory for "ghost credentials" today.
3. Brief the Board: Use the FIIG Securities ruling to justify budget requests for governance, risk, and compliance (GRC) tooling.

---

Contact us for a quote for penetration testing service or adversary simulation.

Weekly Threat Briefing: Zero-Days Hit Apple & SolarWinds, NSW Health Under Pressure

Executive Summary

This week in Australian cyber security, the threat landscape is dominated by critical zero-day exploitations affecting widely used infrastructure. Federal agencies and private sector organisations are on high alert following CISA’s inclusion of new vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalogue. Locally, the healthcare sector remains under intense scrutiny following the release of a concerning audit of NSW Health’s cyber posture, while SaaS and AI-driven threats continue to evolve.

Sector Spotlight

Healthcare: Systemic Risks Exposed

The Australian healthcare sector is facing a "sustained cyber risk" environment. Following the recent audit tabled in NSW Parliament, which identified systemic non-compliance with cyber security controls across NSW Health, industry experts are warning that the sector remains critically exposed.

• Key Insight: A January 2026 report by Gallagher highlighted that Australian health service providers lodged over 200 data breach notifications in the past 12 months.
• Threat Vector: The convergence of IT and OT (Operational Technology) in hospitals, combined with legacy systems, makes clinical operations a prime target for ransomware. The audit revealed that many Local Health Districts (LHDs) are struggling to meet the NSW Government’s mandatory Cyber Security Policy (CSP) requirements.

Government & Critical Infrastructure

Federal agencies are urged to prioritise patching immediately following the detection of active exploitation of SolarWinds and Apple vulnerabilities.

• SolarWinds Web Help Desk (WHD): The US cyber security agency (CISA) has warned that CVE-2025-40536 (CVSS 8.1), a security control bypass, is being exploited in the wild. This flaw allows unauthenticated attackers to access restricted functionality, potentially leading to Remote Code Execution (RCE). Australian government bodies using WHD for IT service management must assume compromise if unpatched.
• Supply Chain Risks: The "PolarEdge" botnet, which compromised thousands of Cisco routers globally earlier this year, remains a persistent threat to critical infrastructure edge devices.

SaaS & Tech Providers

The SaaS landscape is grappling with "Shadow AI" and API vulnerabilities.

• Apple Zero-Day: A new buffer overflow vulnerability in Apple systems, tracked as CVE-2026-20700, has been patched after being exploited in highly sophisticated attacks. This serves as a reminder that even the most secure ecosystems are vulnerable to targeted zero-day campaigns.
• Shadow AI: With the rapid adoption of AI agents in the enterprise, organisations are struggling to govern "Shadow AI"—unauthorised AI tools used by employees. Vendors like Okta have released new governance tools this week to help CISOs detect these hidden risks, which often bypass traditional DLP (Data Loss Prevention) controls.

Vulnerability Watch: The "Must-Patch" List

Our penetration testing team has identified the following vulnerabilities as high-priority for Australian organisations this week:

1. Apple Core Systems (CVE-2026-20700)

   • Type: Buffer Overflow
   • Status: Exploited in the wild.
   • Impact: Arbitrary code execution on iOS and macOS devices.
   • Action: Update to the latest OS versions immediately.

2. SolarWinds Web Help Desk (CVE-2025-40536)

   • Type: Authentication Bypass
   • Status: Exploited in the wild (Zero-day).
   • Impact: Allows attackers to create internal proxy users and pivot to RCE.
   • Action: Apply the latest hotfix or isolate the WHD instance from the internet.

3. Notepad++ (CVE-2025-15556)

   • Type: Update Integrity Verification
   • Status: Active exploitation attempts observed.
   • Impact: Attackers can compromise the update mechanism to deliver malware.
   • Action: Verify the authenticity of all open-source tool updates.

Emerging Threat: The AI Attack Surface

As we move further into 2026, "AI-driven ransomware" is becoming a tangible reality. Reports this week suggest that threat actors are increasingly using LLMs to automate the generation of phishing campaigns that are indistinguishable from legitimate internal communications. For the Education and FinTech sectors, this means the "human firewall" is being tested like never before.

Recommendation: Review your email security gateways and conduct fresh adversary simulation exercises that mimic these AI-enhanced social engineering tactics.

---

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Critical SaaS RCEs & Healthcare Under Siege

Executive Summary

In the last 24 hours, the Australian cybersecurity landscape has been dominated by urgent warnings regarding remote access tools and a fresh wave of attacks targeting the healthcare sector. Of particular concern is the active exploitation of a critical vulnerability in BeyondTrust Remote Support, a tool widely used by Australian enterprises and managed service providers (MSPs). Additionally, new reports from the Australian Signals Directorate (ASD) and global bodies highlight the weaponisation of AI agents, reshaping the threat horizon for 2026.

---

1. SaaS & Remote Access: The BeyondTrust Critical RCE

Sector: SaaS, MSPs, Government
Threat Level: Critical (Active Exploitation)

The most significant development overnight is the discovery of a critical pre-authentication command injection vulnerability (CVE-2026-1731) in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) appliances.

• The Threat: Attackers are exploiting this flaw to inject malicious commands without needing credentials. This allows them to gain SYSTEM level access to the appliance, effectively hijacking the "keys to the kingdom" for remote management.
• Australian Impact: Given the heavy reliance on BeyondTrust by Australian MSPs and government agencies for secure remote access, this vulnerability presents a massive supply chain risk.
• Observed Activity: Security researchers have observed threat actors—likely state-sponsored—using this flaw to deploy lateral movement tools like AdsiSearcher and SimpleHelp binaries, renamed to blend in with legitimate processes.
• Action: Organisations must patch immediately. If patching is not possible, restrict access to the management interface to trusted internal IPs only.

2. Healthcare Sector: Diabetes WA & The Data Hemorrhage

Sector: Healthcare
Threat Level: High

The assault on Australia’s healthcare sector continues, with Diabetes WA confirmed as the latest casualty in a string of high-profile breaches.

• The Incident: While details are still emerging, initial reports indicate a significant data exfiltration event. This follows a worrying trend in early 2026 where attackers are aggressively targeting patient management systems and third-party SaaS providers used by clinics.
• Context: This incident comes off the back of the massive MediSecure fallout, reinforcing that health data remains a premium commodity on the dark web. The attackers are not just encrypting data; they are leveraging sensitive health information for double-extortion schemes.
• Emerging Trend: We are seeing a shift from "smash-and-grab" ransomware to "dwell-and-leak" operations, where attackers silently exfiltrate terabytes of data over weeks before triggering alarms.

3. IoT & OT: Critical Infrastructure on High Alert

Sector: Energy, Utilities, IoT
Threat Level: High

Following a disruptive cyber attack on Poland’s energy grid earlier this week, the CISA and ACSC have issued joint warnings regarding Operational Technology (OT) vulnerabilities.

• The Vulnerability: The alert focuses on vulnerabilities in legacy Remote Terminal Units (RTUs) and Human-Machine Interfaces (HMIs) that are common in Australian water and energy utilities.
• The Attack Vector: Threat actors are utilising "living off the land" techniques—using pre-installed, legitimate administration tools—to manipulate OT controls, making detection by standard IT security tools incredibly difficult.
• Local Relevance: Australian critical infrastructure operators are urged to segregate OT networks from IT environments and enforce strict read-only access where possible.

4. AI & Emerging Tech: The Rise of Autonomous Attack Agents

Sector: All Sectors (focus on EdTech/FinTech)
Threat Level: Emerging

As discussions from Safer Internet Day 2026 conclude, a new reality is setting in: AI is no longer just a tool for drafting emails; it is an autonomous threat actor.

• AI Agents: Security firms have reported the first wild instances of "autonomous AI attack agents." These are AI-driven scripts capable of self-healing and pivoting. If an attack path is blocked, the AI agent autonomously rewrites its code or tries a different exploit chain without human intervention.
• Target: EdTech and FinTech platforms are seeing the highest volume of these attacks, likely due to the rich datasets they hold and the complex API ecosystems they rely on.
• Defence: Traditional static rules (WAFs) are failing against these adaptive threats. Behavioural analysis and "identity-first" security models are now the baseline requirement.

---

Actionable Intelligence for Australian CISOs

1. Audit Remote Access: Immediately verify the version of any BeyondTrust appliances in your environment. Treat unpatched internet-facing instances as compromised.
2. Review Third-Party Risk: For healthcare providers, demand immediate assurance from SaaS vendors regarding their data handling and breach notification processes.
3. Segregate OT/IoT: Ensure your operational technology is air-gapped or strictly firewalled from your corporate network.
4. Monitor for Anomalies: With AI agents in the wild, look for "impossible travel" or erratic behaviour in API traffic that standard signature-based detection might miss.

Contact us for a quote for penetration testing service or adversary simulation.