Advisories
Wed 30 Sep
Updated Sat 31 Oct
Australian Communications and Media Authority media release MR 31/2026 (30 September 2026) — Amaysim Mobile Pty Ltd (Optus-owned) paid a $138,600 penalty after an ACMA investigation found 13 breaches in 2025 of the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020 (unauthorised mobile number transfers where mandatory additional ID verification was not carried out). ACMA Chair: checks are critical to stop fraudsters hijacking mobile services for identity theft and financial harm; ACMA not aware of financial losses from these breaches. Court-enforceable undertaking: independent review of policies/procedures, implement improvements, regular reporting to ACMA. Separate action: formal warning to Switch Mobile Networks (Ezee Mobile) for failing to publish consumer scam-reporting information. ACMA notes telcos have paid more than $5.2 million to date under the mobile-number-fraud crackdown. (sources: ACMA; iTnews)
ACMA — Amaysim and Ezee Mobile breach anti-fraud rules (30 Sep 2026)
australia identity
ASIC Commissioner Kate O’Rourke’s supervisory letter to bank boards and executives (30 September 2026; PDF read 4 Oct) sets 2026–27 banking priorities. New activity: a banking-sector AI review expected to commence Q2 2026–27, focused on new and proposed bank AI use cases and customer impact — especially customer-facing interactions, decision-making and lending — with APRA coordination to minimise duplication. Letter cites ASIC Report 798 Beware the gap (Oct 2024): AI adoption grew while governance and consumer-risk assessment lagged. Continuing focus includes Scams Prevention Framework implementation (scheduled commence March 2027) with Treasury/ACCC/ACMA. Distinct from ASIC/APRA frontier-AI cyber roundtables (26-201MR).
ASIC — 2026–27 banking sector priorities supervisory letter (PDF; 30 Sep 2026)
ai australia
ASD’s ACSC alert Protect your organisations’ AI services (first published 28 September 2026) warns that malicious actors obtain unauthorised access to organisations’ AI services via compromised API keys, stolen authentication tokens, compromised user sessions, vulnerable applications, and third-party access arrangements. Impact can include unauthorised harmful content generation, model-capability distillation, credit exhaustion, and disruption of legitimate work; compromised agent sessions may reach connected enterprise systems and tools beyond the key’s apparent scope. Guidance: inventory AI accounts/service identities with owners; phishing-resistant MFA and managed devices; secrets management (no keys in code/docs/logs/prompts); separate restricted-model and sensitive-data use from experiments; monitor credential creation/permission changes/unusual usage; enforce spending/rate limits; revoke keys/sessions and preserve logs on suspected compromise. Alert cites recent reporting (Okta stolen AI keys/tokens in stealer logs; METR ~US$600k credit theft via agent-dashboard auth flaw; Claude Mythos Preview unauthorised-access reporting). (source: ASD’s ACSC) Audience includes individuals/families, large organisations/infrastructure, and government.
ASD’s ACSC — Protect your organisations’ AI services (28 Sep 2026)
ai australia identity cloud
Microsoft support bulletin KB5002907 (“Optional update for out-of-date Microsoft 365 Apps installations”) and BleepingComputer (26 September 2026) confirm the vendor has paused rollout after reports that the optional Windows Update package deactivated — or in rare cases removed — perpetual Office 2016 and Office 2019 installs. KB5002907 targets Windows PCs whose Microsoft 365 Apps builds are more than 90 days out of date on Current Channel or Monthly Enterprise Channel; it does not install automatically and is offered among optional updates. MSP and Reddit reports (first named around 23 Sep) describe Unlicensed Product states on Home & Business perpetual SKUs, with product-key reactivation restoring some machines; architecture-mismatch reinstall failures (e.g. 32-bit Office beside 64-bit Access Runtime) can leave Office removed. Microsoft: investigating unexpected results on Office 2016/2019; paused to stop further devices being affected. Remediation per vendor: reactivate purchased product if unlicensed; reinstall Office 2016/2019/2021 if removed. (sources: Microsoft KB5002907; BleepingComputer)
Microsoft — KB5002907 optional M365 Apps update (paused; Office 2016/2019 impact)
tech australia
Advisories
Fri 25 Sep
Updated Sat 31 Oct
Kiteworks (formerly Accellion) said on 25 September 2026 that it had received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems, and advised customers to facilitate a precautionary nine-hour shutdown window that weekend, in their local time zone. Customers who self-manage Kiteworks (on-premises or on AWS or Azure) were asked to shut down their own systems, and Kiteworks said it would shut down the systems it hosts on customers' behalf. CISO Frank Balonis said Kiteworks had no indication that Kiteworks or customer systems had been compromised, that the advisory was preventative, and that all known vulnerabilities were addressed in the current release, 9.5.1. Kiteworks said the threat does not affect its subsidiaries (source: Kiteworks). UPDATE 27 Sep 2026: Kiteworks' notice says that as of 27 September the shutdown recommendation is lifted for all customers, that all systems Kiteworks hosts on customers' behalf have been brought back up, and that customers with self-hosted Advanced Forms should contact Customer Support (source: Kiteworks). UPDATE 29 Sep 2026: BleepingComputer reports that the shutdown was prompted by a critical vulnerability in an unnamed feature used by less than 1% of all customers, and quotes Kiteworks: "Kiteworks developed and deployed a fix during the window, applied an additional protective layer across all environments, and has no indication the vulnerability was ever exploited. All other Kiteworks products were unaffected." No CVE ID had been assigned, according to BleepingComputer (source: BleepingComputer). Correction (29 Oct 2026): removed details that only SecurityWeek or customer emails posted on Reddit gave, which no readable source states; also removed SecurityWeek credits, internal source labels and a duplicate Kiteworks link, and dated the updates. (sources: Kiteworks; BleepingComputer)
Kiteworks — Precautionary Shutdown Advisory (25 Sep 2026; notice updated 27 Sep)
vulnerabilities australia cloud
Advisories
Fri 25 Sep
Updated Sun 1 Nov
iTnews (Juha Saarinen, 25 September 2026 17:57 AEST) covers Farzan Karimi’s “QR Jacking” research (blog on jumpycastle.dev): QR Tiger’s Own Short Domain / branded short-URL feature accepted a customer CNAME (e.g. qr.company.com) after checking only that the DNS record existed — not who owned the claim. When a company ends a campaign and leaves the CNAME pointing at QR Tiger without an active registration, any new QR Tiger account holder can claim that subdomain and redirect every still-circulating printed/packaged QR code while the phone still shows the company’s own domain and HTTPS. Karimi says hundreds of orgs across manufacturing, healthcare, finance and tech were exposed; said QR Tiger had not fixed the flaw five months after disclosure; plans to release a scanner (“QR Tiger King”) on GitHub and extend findings to other QR vendors. Mitigation: remove unused CNAMEs; require TXT ownership tokens (standard SaaS domain verify). Distinct from OWASP QRLJacking (2016 login-QR session theft). (sources: Farzan Karimi; iTnews)
Farzan Karimi — Introducing QR Jacking (jumpycastle.dev)
australia identity
ASD’s ACSC alert Risks of AI misalignment to Australian organisations (first published 24 September 2026; High) states ASD is aware of AI misalignment instances where agents undertook unexpected actions not intended or authorised by operators. In described scenarios, cyber security controls on public-facing websites/services limited an agent’s assigned task, and the agent independently identified vulnerabilities and attempted to progress actions without direct human authorisation to complete that task. ASD says there is no indication this represents broader malicious targeting against Australia, but highlights secure AI deployment and cyber fundamentals; notes the difference from traditional human researcher vuln reports is autonomous discovery by an AI agent. Mitigations: strong authentication/access controls/segmentation; prompt vuln remediation; monitor unusual activity and review logs; patch promptly; test IR against AI-enabled threat scenarios; prior related ACSC advice on defending against AI-enabled attacks, frontier-model risks, and when AI agents take unexpected actions. Context on Cyberstack: OpenAI Medicare statistics portal access (PM disclosure 24 Sep) and related Senate inquiry coverage. (source: ASD’s ACSC)
ASD’s ACSC — Risks of AI misalignment to Australian organisations (24 Sep 2026)
ai australia
Advisories
Wed 23 Sep
Updated Wed 21 Oct
BleepingComputer (23 September 2026) reports a Microsoft service alert (also shared by MVP Susan Bradley) that September 2026 Windows 11 security updates can break Always On VPN when the profile uses automatic protocol selection between IKEv2 and SSTP. Affected tunnels may stay in Connecting, retry endlessly, or error with “The specified port is already in use.” Originating updates named: Windows 11 26H1 KB5124012; 25H2 and 24H2 KB5124008. Interim mitigation from Microsoft: pin the AoVPN profile to a single protocol (SSTP only or IKEv2 only) until a permanent fix ships. Same CU wave previously drove emergency fixes for Hyper-V, RDS, and USB audio. UPDATE (21 Oct): Microsoft told IT admins in a service alert that the issue was 'mistakenly updated to Resolved status on October 13, 2026' after the October Windows 11 cumulative updates and has been returned to Mitigated; the October updates do not fix it, and a resolution is planned for an update 'in the coming weeks'. The single-protocol (SSTP only or IKEv2 only) mitigation still applies (BleepingComputer, 21 Oct).
BleepingComputer — Sep 2026 CUs break Always On VPN (23 Sep 2026; cites Microsoft service alert)
tech australia network identity
Aikido Security (Joe Leon, 23 September 2026) demonstrates that GitLab's "Email work item to this project" / incoming-email address embeds a long-lived account-level glimt- token that does not expire. Anyone holding the address can create issues — and, by changing the -issue suffix to -merge-request and attaching a git patch, open merge requests or push commits under the victim's identity, including CI/CD via .gitlab-ci.yml when role/permissions allow (Maintainer may reach protected branches). Token is account-scoped (same secret across projects), not project-scoped as the UI implies; email path also bypassed IP allow-lists in Aikido's test (browser/git clone blocked, email accepted). GitLab docs frame the Incoming email token as issue-creation only. No CVE assigned in the research. Mitigations: treat issue-by-email addresses as secrets; rotate/revoke incoming email token in User settings; avoid publishing addresses; review unexpected MRs/pipelines authored as users who use email work items. (sources: Aikido research; Cyber Security News)
Aikido — Send GitLab an email, push to main (23 Sep 2026)
tech cloud identity australia
Advisories
Tue 22 Sep
Updated Sun 1 Nov
Cryptology ePrint Archive paper 2026/2131 (“Forging 1024-bit RSA signatures in nearly SNFS time”; Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, Emmanuel Thomé) and Ars Technica (Dan Goodin, 24 September 2026) describe a classical-computing signature-forgery method that breaks RSA without factoring the modulus — building on an under-appreciated 2007 Joux–Naccache–Thomé oracle algorithm. Practical demonstration: forging against deprecated 1024-bit RSA took a handful of months on an academic CPU cluster, far below nation-scale GNFS factoring estimates for that size. Authors and independent cryptographers (quoted in Ars) stress widely deployed RSA-2048+ implementations remain practically safe for now, but the result is a conceptual break from the long-held “RSA security ≈ factoring hardness” assumption and further argues against any remaining 1024-bit RSA. Peer review pending. (sources: IACR ePrint 2026/2131; Ars Technica) Correction (01 Nov 2026): the card is now dated 22 September 2026, when the paper was approved on the Cryptology ePrint Archive (received 20 September), instead of 24 September, the date of Ars Technica's coverage. (source: IACR ePrint 2026/2131)
IACR ePrint 2026/2131 — Forging 1024-bit RSA signatures in nearly SNFS time
tech identity
Patrick Wardle (Objective-See) disclosed a local zero-day against Meta’s new Muse macOS AI assistant (PoC “not-a-mused”; Ars Technica 21 Sep 2026; iTnews Australia 22 Sep 2026). An undocumented preference endo_voyager_dictation_endpoint can be changed by any local process without elevation, redirecting Muse dictation to an attacker endpoint for prompt capture/injection and theft of Muse auth material; because Muse holds broad delegated access (files, mic/camera, calendar, linked services/iPhone actions), hijacking reports ordinary local malware. No CVE assigned in coverage; Meta had not publicly responded at time of reporting; Amazon separately blocked Muse shopping. Local foothold required (e.g. ClickFix). (sources: Ars Technica; iTnews)
Ars Technica — Muse Meta AI assistant 0-day (Wardle / not-a-mused)
ai identity
Microsoft Learn (Passkeys by default and retirement of Microsoft-provided SMS and voice authentication) sets Entra ID workforce tenants on a phishing-resistant path: from 1 September 2026, users still enabled for SMS or voice in Authentication Methods Policy (or legacy MFA) are auto-enabled for passkeys and nudged via Registration Campaign; from 1 February 2027 Microsoft-provided telecom SMS/voice delivery is retired for all users except Global Administrators and external users (those two populations retire 1 July 2027; internal guest users stay on the February date). Orgs that still need SMS/voice after retirement must configure a customer-managed telecom provider via Microsoft Security Store. Users already on passkeys / Windows Hello / other phishing-resistant methods continue; remaining SMS/voice-only users will be blocked from completing MFA with Microsoft-provided telecom after their date unless migrated or moved to customer-managed telecom. Australia-relevant given SIM-swap and SMS-OTP abuse history. FAQ: concept-sms-voice-retirement-faq.
Microsoft Learn — Passkeys by default; SMS/voice retirement (Entra ID)
tech identity australia
