On 8 October 2026 Anthropic announced the Anthropic Cyber Mission, which it describes as a long-term effort to give defenders tools, research and funding, starting with critical infrastructure and open-source software. The Critical Infrastructure Defense Program puts frontier Claude models, on-site Anthropic engineers and threat research with trusted providers that secure operational technology (power, water, factories, transport). Founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation; Anthropic says it is starting with a small cohort. OSS Scanner is an opt-in service, modelled on Google's OSS-Fuzz, that periodically scans enrolled open-source projects free of charge. Each report includes a proof of concept, an explanation and a suggested fix where available; reports are model-generated and sent without human review, so some will be wrong (for example severity), and Anthropic says it expects a true-positive rate above 90%. Anthropic also cites funding for the Python Software Foundation, Alpha-Omega and OpenSSF (Linux Foundation) and the Apache Software Foundation, and says the Defender Advantage Fund keeps OSS Scanner free. It builds on the Project Glasswing lesson that finding bugs is now easy but verifying, prioritising and fixing them is slow. (sources: Anthropic; Cyber Security News)
Anthropic — Introducing the Anthropic Cyber Mission (8 Oct 2026)
ai ot ics
Advisories
Thu 8 Oct
Updated Thu 29 Oct
On 8 October 2026, CISA, FBI, NSA and international partners including Australia's ACSC published joint Cybersecurity Advisory AA26-281A on China-linked threat actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with government links that builds or acquires cyber tools, hosts infrastructure and compromises networks. Observed TTPs are consistent with activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett (vendor names may not map 1:1). Actors combine automated scanning (including MicroScan with 1,300+ scripts), large IoT botnets, password spraying against Microsoft 365/Exchange, VPN persistence and hands-on exploitation to steal email and credentials, and have run a portal giving third parties access to stolen mail. Same day, the US Justice Department and FBI announced court-authorised seizures of seven domains used for MicroScan and FishHub spear-phishing/malware delivery; scanning targets cited in court papers include a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms and universities. Integrity Tech was previously sanctioned by the US (Jan 2025) and UK (Dec 2025); a 2024 FBI action disrupted its Raptor Train botnet. Mitigations in the advisory include disabling unused services/ports, sanitising web inputs, MFA everywhere, and timely patching of listed n-day flaws. (sources: CISA AA26-281A; US Department of Justice) The advisory's victim list covers US government services, critical manufacturing, healthcare and IT organisations, US law enforcement, education and religious organisations, and organisations across Southeast Asia, Africa and North America; it does not name Australia. Besides ASD's ACSC, its co-authors include agencies from the UK, Canada, Japan, New Zealand and Spain. It says the FBI recovered an archived email database the actors used, with victims of email theft among government, law enforcement, healthcare and religious organisations in Southeast Asia, and access to the stolen data in some cases restricted to IP addresses in Xiamen, China; the actors also used a tool called DC.exe to run DCSync. It advises watching for unexpected Active Directory replication and replacing end-of-life products. (source: CISA AA26-281A) Correction (29 Oct 2026): removed an 11 October update that rested on an iTnews report, including an ASD spokesperson's comment to iTnews and a count of about 20 Taiwanese university FishHub victims, which no other linked source states; the iTnews link was removed and the advisory details that update repeated are now credited to CISA's advisory directly. (source: CISA AA26-281A)
CISA — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools (8 Oct 2026; ACSC co-author)
australia network identity
Advisories
Thu 8 Oct
Updated Thu 29 Oct
JPCERT/CC issued alert JPCERT-AT-2026-0030 on 8 October 2026 (updated 23 October) about a run of unauthorised-access incidents that have leaked personal data from Japanese organisations around September 2026. It names no attacker or victim and says the information it holds is limited and fragmentary. Besides consumer apps, victims include business intelligence (BI) tools and staff-facing management systems that were never meant to take access from the general public. The alert describes five cases, based on reports to JPCERT/CC, and says not every incident used the same method. Case A: attackers scan each target for a range of known flaws and try to exploit them, or abuse poor device management, for example by stealing configuration and backup files. Case B: unauthorised requests to apps' admin APIs, including analysing public smartphone apps to find API endpoints and keys; attacking internal APIs that the app's screens cannot reach (changing user privileges, creating rogue accounts, probing how responses change with missing headers or malformed tokens, and blind NoSQL injection to find account details); and using API keys stolen from other compromised systems, with access also routed through Tor exit nodes and residential proxies. Case C: exploitation, through API requests, of the Metabase SQL injection flaw CVE-2026-72898, covered in JPCERT/CC's 14 August alert. Case D: WAR files planted on application servers reachable from public web servers, whose JSP files act as simple web shells that were accessed repeatedly around September. Case E, added on 23 October: attack attempts using AI-driven penetration-testing platforms such as Cairn, CyberStrikeAI and ARTEX, mainly against internet-facing web applications. The alert lists suspicious source IP addresses and User-Agent strings for checking logs, and recommends rate limits on APIs, access control on every API endpoint including non-public ones, least-privilege, short-lived API tokens that can be revoked quickly, limiting access by region where a service is local, and patching known flaws (source: JPCERT/CC). Macnica's Security Research Center, which the alert lists as a reference, counted 119 publicly reported personal data leaks through web systems run by Japanese companies this year as of 6 October 2026 (84 in 2025 and 62 in 2024), 81 of them made public since July (source: Macnica). UPDATE (13 Oct): the Cabinet Secretariat's National Cybersecurity Office (NCO) issued an advisory dated 9 October 2026 saying it had confirmed multiple cases in which systems of companies handling large volumes of personal data were breached through web-system vulnerabilities, supply-chain compromise and weak data management. It asks those companies to patch promptly (including internal servers), stop using unsupported products, use MFA, keep admin accounts to a minimum, keep and watch logs, and check contractors and sub-contractors, and asks breached organisations to share technical details quickly with the NCO, their ministry or specialist bodies (source: National Cybersecurity Office). UPDATE 23 Oct 2026: JPCERT/CC added Case E and further suspicious source IP addresses to Case B (source: JPCERT/CC). Correction (29 Oct 2026): the card now follows the current JPCERT/CC alert, which describes five cases rather than three, and links Macnica's report directly. Removed details that the linked sources do not state: Jiji Press reporting on a cross-ministry meeting chaired by the cybersecurity minister and NCO comments on August and AI, a Financial Services Agency notice that is not linked, counts of IP addresses and User-Agent strings, Metabase CVSS and cloud zero-day details, a line saying the advisories are requests rather than legal duties, and internal source labels. (sources: JPCERT/CC; Macnica; National Cybersecurity Office)
JPCERT/CC — JPCERT-AT-2026-0030: alert on recent successive unauthorised access at domestic organisations (8 Oct 2026, updated 23 Oct, Japanese)
breaches cloud identity
Let's Encrypt announced on 7 October 2026 that every certificate it issues or renews on or after 10 February 2027 will be valid for 64 days by default instead of 90, unless the subscriber picks one of the shorter 45-day or roughly six-day profiles it has already announced. The last 90-day certificates should expire on 11 May 2027, and existing certificates will not be revoked. The staging environment switches to 64-day certificates on 14 October 2026 so administrators can check renewal behaviour early. Clients that support ACME Renewal Information (ARI) will be told when to renew; anything renewing at a fixed number of days before expiry should move to about two-thirds of the lifetime (around day 43), and Let's Encrypt suggests searching cron jobs, wrapper scripts and runbooks for hard-coded values such as 83, 80 or 60. The authorisation reuse period also drops from 30 days to 10 days, and to seven hours in 2028, ahead of a 2029 industry limit; rate limits, ACME endpoints and issuance chains do not change. Default lifetimes are due to fall to 45 days in February 2028. Shorter lifetimes reduce the damage from a stolen key or a mis-issued certificate. (sources: Let's Encrypt; Cyber Security News)
Let's Encrypt — 64-day certificates (7 Oct 2026)
tech network
On 7 October 2026 the Office of the Australian Information Commissioner announced a commissioner-initiated investigation into Shenzhen Qingcheng Future Technology Co. Ltd, maker of the HeyCyan companion app required for full use of Anko smart glasses sold by Kmart and other low-cost glasses sold via Big W Marketplace, Amazon and similar channels. After an Attorney-General request, the OAIC from 12 August 2026 sent preliminary inquiries to Meta, Kmart, Google and Shenzhen Qingcheng about recording, storage and access to personal information. Shenzhen Qingcheng (China) did not respond. Privacy Commissioner Carly Kind said that absence left no assurance the company protects Australians' personal information as required under APP 1, and that the investigation lets the OAIC use compulsory information-gathering powers. Kind has written to retailers selling HeyCyan-linked devices urging them to consider whether continued sale is appropriate. Opening an investigation is not a finding of breach. Parallel coverage: Kmart removed its $89 Anko camera glasses from online sale while still listing speaker-only glasses; ACS Information Age and SMH reported the retail pull alongside the OAIC action. (sources: OAIC media release; ACS Information Age)
OAIC — Opens investigation into maker of HeyCyan smart glasses phone app (7 Oct 2026)
australia identity
ABC News reported on 6 October 2026 that the Australian Competition and Consumer Commission received 138 scam reports involving LinkedIn in July and August 2026, with reported losses of up to $254,449. The pattern is recruitment fraud rather than a platform breach: fake job ads, cloned profiles of real recruiters and employees (one jobseeker was approached in the name of a real Aurecon staff member, and Aurecon confirmed it had not contacted him), and offers that end in an upfront fee. A common version, described by Contract Services Australia managing director Mark Hopcroft, is a 'recruiter' who says your CV fails the employer's keyword screening and then offers their own HR specialist to fix it, in his case for about A$8,600 (US$6,000); he only caught it because the role was not on the company's own careers site. Users say approaches rise sharply after switching a profile to 'open to work'. LinkedIn's Job Search Safety Pulse survey found about 16 per cent of Australian respondents say they have fallen for a job scam (25 per cent of Gen Z), 61 per cent have seen an ad they suspected was fake, and nearly half say cost-of-living pressure makes them take more risks. ANZ warned last month that realistic job scams have become a common impersonation scam. Practical checks: confirm any role on the employer's own website, contact the company through a number you look up yourself, and never pay for CV writing, training or equipment to get a job. Report to Scamwatch and, if money was sent, to your bank straight away.
ABC News — Jobseekers exploited by recruitment scammers on LinkedIn (6 Oct 2026)
australia identity
Advisories
Tue 6 Oct
Updated Tue 3 Nov
The FBI and the US Secret Service published joint cybersecurity advisory JCSA-20261006-01 on 6 October 2026, warning that FortiBleed is an active, worldwide campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. FortiBleed is not a single new software bug: the operators use credential stuffing and password spraying with logins from earlier Fortinet leak dumps and infostealer logs, then take password hashes from devices that still store administrator passwords with legacy SHA-256 and crack them offline on a GPU cluster run with Hashcat and Hashtopolis. SOCRadar has verified more than 86,644 compromised devices in 194 countries. The workflow came to light because the operators left their own backend server open; it shows them filtering out honeypots, ranking victims by revenue and network layout, creating new administrator accounts on the firewall to keep access, enumerating Active Directory and spraying passwords inside the network, then selling working VPN access. The agencies say some victims have been locked out after the attackers deleted or changed the original admin accounts, so recovery can take more than a patch and a password reset, and that the access has been used as an entry point for ransomware affiliates. The advisory lists account names seen on victim devices, including forticloud-sync, forticloud-tech, fortiAdmin, adminin, districtadmin and system_config, and infrastructure including a command-and-control server at 45.154.12[.]132 and a Hashtopolis host at 85.11.187[.]8. (source: FBI and USSS joint advisory) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: FBI and USSS joint advisory)
FBI and USSS — Joint Cybersecurity Advisory JCSA-20261006-01: FortiBleed operations continue targeting exposed systems leading to reports of lockouts (6 Oct 2026, PDF)
vulnerabilities network identity
Microsoft is adding the Windows app package extensions .msix and .msixbundle to the list of attachment types blocked by default in new Outlook for Windows and Outlook on the web for Exchange Online, The Register reported on 6 October 2026. Once the change lands, users of those clients will no longer be able to download or open attachments with these extensions. Microsoft calls the file types infrequently used and says the change is part of its ongoing work to protect organisations from unsafe attachments. Rollout is scheduled for early to mid-November 2026. Administrators who have a genuine need to receive these packages by email can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before then. Malicious MSIX packages have been used to deliver malware before: Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after it was abused. (sources: Microsoft's announcement; The Register)
The Register — Microsoft extends the Outlook block list with two more file types (6 Oct 2026)
tech cloud
Apple Developer News (2 October 2026; id=p6zjojqw) says macOS Full Disk Access (FDA) — the TCC privilege that largely sidesteps per-app privacy controls so backup apps can work — will gain additional controls so users who truly want to grant that extraordinary access can do so only with very explicit user action. Apple cites developers using FDA in ways that expose files, Mail, Messages and browsing history without users’ full understanding, and notes communication apps can also compromise the privacy of people users message. Framing: as AI agents become more capable and autonomous, FDA risk grows substantially; Apple commits to clearer risk disclosure before grant. No rollout date or OS version named in the notice. Context reports (Ars Technica / TechCrunch / MacRumors 2 Oct) link the move to debate over Meta Muse and other desktop AI agents that optionally request FDA plus in-app connectors. Not a CVE. (source: Apple Developer News)
Apple Developer News — Updates to Full Disk Access in macOS (2 Oct 2026)
ai identity
Advisories
Fri 2 Oct
Updated Mon 2 Nov
Google Android security blog states that in Android 17, enabling Advanced Protection automatically restricts AccessibilityService access exclusively to verified applications categorised as Accessibility Tools — closing a primary conduit used by banking trojans and spyware for screen reading, overlay fraud, silent permission grants and blocking uninstall, while preserving legitimate assistive tech. Advanced Protection also disables WebGPU in that mode to shrink browser attack surface. Google frames AccessibilityService abuse as a leading fraud/scam vector because the API can interact with the UI without root. Not a CVE; platform hardening for users who opt into Advanced Protection on Android 17. (source: Google security blog) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Google)
Google — Android Advanced Protection updates (Accessibility Tools lock / WebGPU; Android 17)
tech identity
Advisories
Wed 30 Sep
Updated Tue 3 Nov
MI5 Security Service Espionage Alert (published 30 September 2026) states that the China General Technology Research Institute (CGTRI), also translated China Academy of General Technology (CAGT), has very strong ties to China’s Ministry of State Security (MSS). MI5 says CGTRI’s primary purpose is to fund academic research that directly improves MSS technical capability for espionage. More than 100 UK-linked academics have contributed to CGTRI-funded projects (AI, cybersecurity, covert communications, steganography); some may not have known CGTRI was the funder. Expected actions: UK institutions immediately review ongoing/planned CGTRI collaboration; establish ultimate funding source on China-linked research; use HMG Research Collaboration Advice Team (RCAT) and NPSA Trusted Research guidance; take independent legal advice. Alert places CGTRI–MSS ties in the public domain and flags National Security Act 2023 s 3 (assisting a foreign intelligence service) and s 17 (obtaining a material benefit from a foreign intelligence service) for continued CGTRI-funded work after publication. (source: MI5 Espionage Alert) Relevant to Australian universities/research orgs as Five Eyes Trusted Research parallel — not an AU-specific ACSC alert. Correction (02 Nov 2026): removed The Hacker News as a source. (source: MI5 Espionage Alert)
MI5 — Espionage Alert: CGTRI 中国通用技术研究院 (30 Sep 2026)
tech ai australia
BleepingComputer (30 September 2026), citing a Microsoft Message Center update, reports that Microsoft Entra ID will enforce additional Content Security Policy (CSP) on browser sign-in experiences so only trusted Microsoft CDN-hosted scripts run during authentication, blocking external script injection / XSS-style credential theft on login.microsoftonline.com. Rollout begins mid-October 2026 and should complete by late October 2026; enabled by default, no tenant configuration required. MSAL and API-based auth flows are unaffected (CSP applies to browser sign-in only). Microsoft advises enterprises to stop relying on browser extensions/tools that inject code into Entra sign-in pages, and to test sign-in flows in browser developer tools for CSP violations (red console errors) before the deadline. Users can still sign in if unsupported injection tools break. Framed as part of Microsoft’s Secure Future Initiative.
BleepingComputer — Microsoft to block Entra ID script injection from October (30 Sep 2026)
tech identity cloud
