Daily Threat Briefing: Critical Cisco Zero-Day & AI Fraud Surge – 26 February 2026

The Australian cyber threat landscape has escalated sharply in the last 24 hours. The Australian Signals Directorate (ASD) and global Five Eyes partners have issued an emergency directive regarding a critical zero-day vulnerability in widespread network infrastructure, while the financial sector faces a reported surge in AI-driven fraud. Below is our deep dive into the threats impacting Australian organisations today.

Top Priority: Critical Infrastructure & Government

The Cisco SD-WAN Emergency (CVE-2026-20127) The most significant development in the last 24 hours is the disclosure of CVE-2026-20127, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controllers.

• Severity: CVSS 10.0 (Critical).
• Impact: Successful exploitation allows unauthenticated attackers to bypass peering authentication, add a rogue peer, and eventually gain root access to the system.
• Threat Context: The ASD’s Australian Cyber Security Centre (ACSC) warns that a sophisticated threat actor, tracked as UAT-8616, has been exploiting this flaw. Evidence suggests this actor has been active since 2023, using this vulnerability to establish long-term persistence in critical networks.
• Action Required: All Australian organisations using Cisco SD-WAN must review the emergency directive and apply patches immediately.

FinTech & eCommerce

GenAI: The New Frontier of Fraud A new report released yesterday by Experian and Forrester Consulting reveals a disturbing trend for the Australian financial and retail sectors.

• The Threat: 65% of Australian organisations have recorded a year-on-year increase in fraud losses.
• AI Weaponisation: Generative AI is now considered the single biggest fraud threat by 61% of local respondents. Threat actors are leveraging AI to create sophisticated phishing campaigns and synthetic identities that bypass traditional verification tools.
• Gap Analysis: 73% of Australian fraud decision-makers admit their current technology cannot keep pace with these AI-powered attacks, leaving eCommerce platforms and FinTech providers highly exposed.

Healthcare

Sustained Ransomware Pressure The healthcare sector remains under siege. New data indicates that Australian health service providers have lodged over 200 data breach notifications in the last 12 months.

• Tactics: Attackers are double-extorting providers—encrypting critical clinical operations and threatening to release sensitive patient data.
• Recent Activity: We are seeing a trend where threat actors are demanding ransom payments in cryptocurrency (e.g., Bitcoin) to prevent the leak of medical records. Despite government advice against paying ransoms, the operational pressure to restore life-critical systems continues to drive victim compliance.

Education / EdTech

Fallout from Victorian Schools Breach The education sector is still reeling from the massive data breach affecting the Victorian Department of Education.

• Status: Investigations continue into the "unauthorised third-party access" that exposed student names, emails, and encrypted passwords across 1,700 government schools.
• Risk: The compromised data is being monitored for potential sale on dark web forums, posing a long-term identity theft risk for hundreds of thousands of students. EdTech providers are urged to enforce strict API access controls and rotate credentials to prevent similar "access failure" incidents.

SaaS & General Enterprise

The "Pay-to-Play" Problem Despite ASD warnings, a new report highlights that Australian businesses are capitulating to ransomware demands at an alarming rate.

• Data: In the first eight months of mandatory reporting, 75 Australian businesses (with turnover >$3M) admitted to paying ransoms.
• Cloud Security: Researchers have also just disclosed critical vulnerabilities in several cloud-based password managers, a staple tool for many SaaS-reliant businesses.
• Root Cause: Analysis of recent breaches, including the incident at gold producer Regis Resources, suggests that many "hacks" are actually the result of access failures—forgotten API keys, exposed tokens, and stale credentials—rather than zero-day exploits.

IoT & Technical Spotlight

Network Backbone Under Fire The Cisco SD-WAN vulnerability mentioned above has direct implications for IoT deployments. SD-WAN often serves as the connectivity backbone for distributed IoT devices in industrial and smart city environments. An attacker with root access to the SD-WAN controller can potentially pivot to compromise connected IoT endpoints, manipulating data streams or causing physical disruption.

---

Summary for CISOs & Security Leaders The events of the last 24 hours emphasise two distinct battlegrounds: the technical imperative to patch critical infrastructure (Cisco SD-WAN) and the strategic need to upgrade fraud detection against AI adversaries. With state-sponsored actors like UAT-8616 active in Australian networks, complacency is not an option.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Cyber Threat Briefing: Supply Chain Shocks, FinTech Fallout & The AI Attack Surface

Executive Summary

The last 24 hours have seen a significant escalation in the Australian cyber threat landscape. We are witnessing a convergence of physical supply chain disruption and high-volume digital data theft. A major poultry processor has confirmed a cyber attack impacting national distribution, while the FinTech sector grapples with the massive ‘youX’ data breach. On the technical front, the weaponisation of AI workflows is no longer theoretical, with critical exploits targeting automation platforms used by Australian businesses.

Here is your daily deep dive into the threats impacting Australian sectors today.

---

Sector Spotlight

🥩 Supply Chain & Food Security: "Fowl Play" Disrupts Market

In a breaking development confirmed late yesterday, a major Australian poultry processor has suffered a significant cyber attack. The incident has disrupted production lines and distribution logistics, threatening shortages across major supermarkets. While the specific threat actor has not yet been named, the operational impact bears the hallmarks of a ransomware attack targeting Operational Technology (OT) environments.

💸 FinTech: The youX Breach Fallout

The Australian alternative lending sector is reeling from the confirmation of a massive data breach at FinTech platform youX.

• The Incident: Threat actors compromised a misconfigured MongoDB Atlas cluster, exfiltrating approximately 141 gigabytes of sensitive data.
• Impact: The breach exposes over 600,000 loan applications involving nearly 100 downstream lenders.
• Data at Risk: Driver’s licences, bank statements, and tax documents.
• Vector: Likely exploitation of the recently disclosed MongoDB Server Leak vulnerability (CVE-2025-14847) or a simple access control failure.

🏥 Healthcare: Under Siege from "Termite" and "0APT"

The healthcare sector remains the primary target for extortion, with two major incidents escalating in the last 24 hours:

• Genea Fertility: The Termite ransomware group has claimed responsibility for an attack on this major IVF provider. Fears are mounting regarding the potential theft of highly sensitive Patient Health Information (PHI).
• Epworth HealthCare: The emerging 0APT ransomware gang has listed Epworth as a victim, claiming possession of 920GB of data, including surgical records and billing details. This highlights a shift towards "psychological pressure" tactics where attackers threaten to release sensitive medical diagnoses.

🏛️ Government & Legal: Court Data Exposed

A significant third-party breach involving VIQ Solutions has exposed sensitive Australian court data. The breach occurred via a subcontractor, e24 Technologies, and affects the Federal Circuit and Family Court. This incident underscores the critical risk of "set and forget" outsourcing, where data sovereignty clauses are bypassed by vendors seeking lower-cost offshore processing.

---

Technical Analysis: Vulnerabilities & Exploits

🤖 AI & SaaS: The New "Blast Radius"

• n8n Workflow Automation (CVE-2026-21858): We are observing active exploitation of a critical unauthenticated Remote Code Execution (RCE) vulnerability in the n8n platform. As Australian organisations rush to integrate AI agents, tools like n8n have become critical infrastructure. An exploit here allows attackers to hijack AI workflows and steal API keys for services like OpenAI, Slack, and Salesforce.
• CrowdStrike 2026 Report: Released this morning, the report reveals an 89% surge in AI-enabled attacks. Adversaries are now injecting malicious prompts into GenAI tools to generate unauthorised commands, with the average "breakout time" (time to move laterally) dropping to just 29 minutes.

☁️ Cloud & Web Applications

• Google Chrome Zero-Day (CVE-2026-2441): Google has issued an emergency update for a high-severity Use-After-Free vulnerability in the CSS component. Threat actors are actively exploiting this in the wild. Action: Update all browsers to version 145.0.7632.75 immediately.
• RoundCube Webmail: Two new critical vulnerabilities allowing RCE were added to the Known Exploited Vulnerabilities (KEV) catalog yesterday. This platform is widely used by Australian educational institutions and ISPs.
• BeyondTrust Remote Support (CVE-2026-1731): A critical pre-authentication RCE is being exploited to deploy web shells and backdoors. This is a "keys to the kingdom" flaw for Managed Service Providers (MSPs).

IoT & Edge Security

New intelligence from Amazon suggests Russian-speaking threat actors are using commercial AI tools to scale attacks against Fortinet FortiGate firewalls. rather than using new exploits, they are leveraging AI to automate the scanning of exposed management ports and default credentials at machine speed.

---

Recommendation

Organisations must pivot from purely defensive posturing to proactive validation. The exploitation of n8n and the youX breach demonstrate that misconfigurations and unpatched third-party tools are the path of least resistance.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Critical Infrastructure Under Siege & New Webmail Exploits

Executive Summary

The Australian cyber threat landscape has seen significant escalation over the last 24 hours. A major poultry processor has confirmed a cyber attack disrupting supply chains, while the FinTech sector continues to reel from the massive youX data breach reported over the weekend. On the technical front, widely used webmail platforms are under active exploitation, and the Australian Signals Directorate (ASD) has released a new defence tool.

Here is your daily deep dive into the threats impacting Australian sectors today.

---

Sector Spotlight

🥩 Supply Chain & Food Security: "Fowl Play" Disrupts Market

In a breaking development, a major Australian poultry processor has confirmed a cyber attack that is currently impacting production and distribution. While the company has not yet attributed the attack to a specific threat actor, chicken shortages are already being reported across retailers. This incident underscores the fragility of operational technology (OT) environments and the cascading effects of ransomware on just-in-time supply chains.

🏥 Healthcare: Aeromedical Society Targeted by LockBit

The Aeromedical Society of Australasia remains in crisis management mode following claims by the LockBit ransomware gang. The group has listed the non-profit on its leak site, threatening to publish sensitive internal data. This highlights a ruthless trend: threat actors are increasingly targeting critical support services and NGOs in the healthcare sector, knowing these organisations often lack the resources of major hospitals but hold high-value data.

💸 FinTech: The youX Breach Fallout

The fallout from the youX breach continues to dominate the FinTech sector. Sydney-based lender youX confirmed that unauthorised access led to the exfiltration of personal and financial data belonging to approximately 444,538 borrowers.

• Data Exposed: Over 200,000 driver's licences, income details, and debt profiles.
• Root Cause: Initial forensic analysis points to inadequate "cyber hygiene," specifically an exposed database that lacked proper access controls.
• Impact: This serves as a stark warning for the FinTech industry regarding Third-Party Risk Management (TPRM) and the security of data aggregators.

🏨 Retail & Hospitality: Seagrass Group Incident

The Seagrass Boutique Hospitality Group, operator of premium dining venues, is investigating a cyber incident claimed by the Kairos ransomware group. With hospitality venues processing high volumes of cardholder data, this incident raises immediate concerns for customer payment security and PII exposure.

---

Vulnerability Watch: Web Applications & APIs

🚨 RoundCube Webmail: Active Exploitation

Severity: Critical Two new vulnerabilities in the RoundCube Webmail client have been added to the Known Exploited Vulnerabilities (KEV) catalog as of this morning (24 February).

• The Threat: Unauthenticated attackers can exploit these flaws to execute arbitrary code on the mail server.
• Relevance: RoundCube is widely deployed by Australian educational institutions, ISPs, and small businesses. Immediate patching is required.

🤖 SaaS & AI Automation: n8n RCE (CVE-2026-21858)

We are observing continued active exploitation of CVE-2026-21858, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform.

• Why it matters: As Australian organisations rush to integrate AI agents into their operations, tools like n8n are becoming critical infrastructure. An exploit here allows attackers to hijack AI workflows and access connected API keys for services like OpenAI, Slack, and Salesforce.

---

Government & Defence Updates

🛡️ ASD Releases "Azul" Malware Analysis Tool

In a positive development, the Australian Signals Directorate (ASD) yesterday released Azul, a new open-source malware analysis tool.

• Capability: Azul allows organisations to analyse and correlate malware at scale, helping SOC teams quickly identify common behaviours in malicious files.
• Recommendation: We advise Australian Security Operations Centres (SOCs) to evaluate Azul for integration into their threat intelligence pipelines to enhance sovereign capability.

---

Actionable Advice for CISOs

1. Check your Webmail: If your organisation or clients use RoundCube, verify that the latest security patches are applied immediately.
2. Review FinTech Exposures: With the youX breach exposing substantial identity data, financial institutions should increase fraud monitoring for loan applications using the compromised driver's licences.
3. Secure AI Workflows: Audit all instances of workflow automation tools (specifically n8n) to ensure they are not exposed to the public internet without strict authentication.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Ivanti Zero-Days, Healthcare Ransomware & The Identity Crisis

Executive Summary The Australian cyber threat landscape has remained volatile over the weekend, dominated by the active exploitation of critical zero-day vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM). Simultaneously, the healthcare and FinTech sectors are grappling with fresh ransomware claims and data breaches, highlighting a persistent failure in credential management and API security.

Here is your deep dive into the last 24 hours of threat activity affecting Australian organisations.

Critical Infrastructure & SaaS: Ivanti Under Fire Again

The Threat: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) affecting Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild. Impact: These vulnerabilities allow unauthenticated attackers to execute arbitrary code (RCE) on target servers, granting full control over mobile device management (MDM) infrastructure. This effectively hands threat actors the keys to an organisation’s entire mobile fleet, including IoT devices. Australian Context: The Australian Signals Directorate (ASD) and Palo Alto Networks Unit 42 have observed widespread exploitation targeting government, healthcare, and manufacturing sectors. Action: Immediate patching to RPM 12.x is mandatory. If you cannot patch immediately, isolate the appliances from the internet.

Healthcare Sector: LockBit Resurfaces

The Incident: The Aeromedical Society of Australasia has confirmed a cyber incident following claims by the LockBit ransomware group. Analysis: Despite previous law enforcement disruptions, LockBit remains a potent threat to Australian healthcare. The group is threatening to publish stolen sensitive data by the end of the month. This follows a broader trend noted in the ASD’s recent Annual Cyber Threat Report, which highlighted that ransomware incidents involving the healthcare sector have doubled in the 2024-25 period. Key Risk: The encryption of patient data and operational disruption in critical care support services.

FinTech & SaaS: youX Data Breach

The Incident: Australian FinTech platform youX has confirmed a significant data breach. Details: Threat actors have begun sharing samples of the stolen data, which reportedly compromises hundreds of thousands of user records. Experts point to a "lack of adequate cyber hygiene" as the root cause—likely an unmonitored API endpoint or hardcoded credentials. Broader Trend: This incident comes days after FIIG Securities was penalised $2.5 million for cyber security failures, signalling that regulators are losing patience with financial institutions that neglect data protection.

Government & Education: The "Identity" Crisis

The Incident: The Victorian Department of Education is managing the fallout from an unauthorised third-party access incident. Deep Dive: Recent analysis suggests that Australia’s biggest breaches in 2026 are not resulting from sophisticated zero-days, but from access failures. Attackers are bypassing perimeter defences by exploiting:

• Forgotten service accounts.
• Long-lived API keys embedded in code.
• Exposed cloud tokens. Takeaway: "Identity is the new perimeter." Organisations must pivot from purely network-based controls to robust Identity Threat Detection and Response (ITDR).

Emerging Tech: AI & Web Application Security

AI Vulnerabilities: The Langflow Unauthorized Code Injection (CVE-2025-3248) continues to be a vector for compromising AI application infrastructure. As Australian organisations race to deploy LLM-backed tools, unvalidated inputs in AI pipelines remain a critical blind spot. Web Apps: The React2Shell (CVE-2025-55182) vulnerability in Next.js allows pre-authentication RCE and is still being scanned for by botnets. Ensure your web frameworks are updated to versions 15.1.0+ or 16.0.2+.

Recommendations for C-Level & Security Teams

1. Patch Ivanti EPMM: Treat CVE-2026-1281 as an emergency.
2. Audit Non-Human Identities: Review all API keys, service accounts, and OAuth tokens. Rotate anything older than 90 days.
3. Validate AI Supply Chains: Ensure any AI development platforms (like Langflow) are not exposed to the public internet without strict authentication.
4. Healthcare Resilience: Verify offline backups are immutable, given the resurgence of LockBit targeting the sector.

Contact us for a quote for penetration testing service or adversary simulation.

Australia Cyber Threat Briefing: AI-Driven API Attacks, FinTech Fallout & The Rise of "0APT"

Weekly Threat Briefing: 16–22 February 2026

As we close out the third week of February 2026, the Australian cyber landscape is being defined by a sophisticated pivot towards AI-enabled API exploitation and high-impact ransomware campaigns targeting the FinTech and Healthcare sectors. The "blast radius" of AI systems is widening, with the Model Context Protocol (MCP) emerging as a critical new attack surface.

Here is your deep dive into the threats impacting Australian organisations over the last 7 days.

Sector Spotlight

FinTech: Massive Data Breach at youX

In a significant blow to the Australian alternative lending sector, FinTech platform youX confirmed a major data breach this week. Threat actors have claimed to compromise a MongoDB Atlas cluster, exfiltrating approximately 141 gigabytes of sensitive data.

• Impact: The breach potentially exposes over 600,000 loan applications across nearly 100 lenders.
• Data Exposed: Driver’s licences, bank documents, and PII.
• Vector: Preliminary reports suggest a misconfigured cloud database was exploited, possibly leveraging the recently disclosed MongoDB Server Leak vulnerability (CVE-2025-14847).

Healthcare: Ransomware Resurgence (Termite & 0APT)

The healthcare sector remains under siege, with two major incidents dominating the headlines:

• Genea Fertility: Following suspicious activity detected in mid-February, the Termite ransomware group has claimed responsibility for an attack on this major IVF provider. While Genea disabled systems to contain the breach, fears remain regarding the theft of highly sensitive patient management data (PII and PHI).
• Epworth HealthCare: The emerging 0APT ransomware gang has listed Epworth as a victim, claiming possession of 920GB of data, including surgical records and billing details. This incident highlights the growing trend of "psychological pressure" tactics, where threat actors threaten to release sensitive medical diagnoses to force payment.

Government & Education

• Fairfield City Council (NSW): Formally notified residents of a data breach this week (stemming from a late 2025 incident), confirming unauthorised access to staff and resident information.
• Victorian Department of Education: Continues to manage the fallout from the January breach impacting 1,700 schools, with new phishing campaigns impersonating the department now circulating.

IoT: The "PolarEdge" Botnet

A new botnet dubbed "PolarEdge" has been identified recruiting Cisco RV series routers. Active since late 2025, the botnet has grown to over 2,000 infected devices in Australia, leveraging older command injection flaws to deploy web shells for persistent access.

---

Vulnerability Watch: Web, Cloud & AI

The last week has seen active exploitation of critical vulnerabilities, particularly in cloud-native and AI-integrated systems.

1. React2Shell (CVE-2025-55182) – CVSS 10.0

• Status: Active Exploitation.
• Details: Dubbed "React2Shell," this unauthenticated Remote Code Execution (RCE) flaw in React Server Components is being called a watershed moment for web security.
• Risk: It allows attackers to execute privileged JavaScript code with SYSTEM-level access. Approximately 39% of cloud environments are estimated to have vulnerable instances.
• Action: Immediate patching of React versions 19.x and downstream frameworks like Next.js is mandatory.

2. Fortinet FortiCloud SSO (CVE-2025-59719)

• Status: Critical.
• Details: An authentication bypass vulnerability in FortiCloud SSO allows attackers to log in as legitimate users without credentials.
• Risk: This is a "keys to the kingdom" flaw for managed service providers (MSPs) and organisations relying on Fortinet for network security management.

3. The AI Threat: Model Context Protocol (MCP)

• Emerging Threat: Research released this week indicates a 270% increase in vulnerabilities related to the Model Context Protocol (MCP).
• Context: MCP is becoming the standard for connecting AI agents to data sources. Attackers are exploiting over-permissioned agents to perform "Shadow AI" data exfiltration, bypassing traditional endpoint security.

---

Recommendations

1. Immediate Patching: Prioritise React2Shell (CVE-2025-55182) and Fortinet SSO patches. These are currently the primary vectors for initial access.
2. Database Hardening: Review all MongoDB instances for public exposure and ensure strict access controls are in place to prevent incidents like the youX breach.
3. AI Governance: Audit the use of AI agents and MCP integrations within your environment. Ensure "Shadow AI" tools are not granted excessive permissions to internal APIs.
4. Adversary Simulation: With groups like Termite and 0APT aggressively targeting Australian healthcare and finance, test your resilience against their specific TTPs (Tactics, Techniques, and Procedures).

Contact us for a quote for penetration testing service or adversary simulation.