Collabora published GHSA-g3vx-3m76-fghh on 14 October 2026 for CVE-2026-110447 in the optional Nextcloud app Collabora Online - Built-in CODE Server (package richdocumentscode). When the local CODE process is not running (restart, upgrade, or crash), an unauthenticated HTTP request can inject OS commands through proxy.php because request path text was placed inside a double-quoted bash command up to 26.4.302. Attackers used that window to plant web shells; admins reported first hits from 10 September 2026, with request markers such as %2e%2e, $(, ${IFS}, and base64 -d piped to sh. Collabora rates it Critical (CVSS 4.0 9.2), fixed the bug in 26.4.303 on 11 September, and warns that disabling the app is not enough — it must be upgraded to ≥ 26.4.303 or removed. Standalone Collabora Online servers are not affected; installs that use only the Nextcloud Office app (richdocuments) against an external Collabora server are not affected. Fixed builds need Nextcloud 30 or later; EOL Nextcloud ≤ 29 still receive an affected app-store build and should upgrade Nextcloud or remove the app. This path is separate from CVE-2025-66208 in the same script. UPDATE (24 Oct 2026): CISA added CVE-2026-110447 ('Collabora Online – Built-in CODE Server OS Command Injection Vulnerability') to its Known Exploited Vulnerabilities catalog on 23 October 2026, with a remediation due date of 26 October 2026 for US federal civilian agencies and forensic triage required. (source: CISA KEV)
Collabora GHSA-g3vx-3m76-fghh — Unauthenticated OS command injection in richdocumentscode proxy (CVE-2026-110447, 14 Oct 2026)
Palo Alto Networks published CVE-2026-0322 on 14 October 2026 (16:00 UTC; 15 Oct 00:00 Perth). A code-injection flaw (CWE-94) in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected, and no special configuration is needed to be exposed. Palo Alto rates it HIGH with suggested urgency HIGHEST, Exploit Maturity ATTACKED, and says very limited exploitation has been observed targeting the management interface. The advisory lists three IP addresses tied to the activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. There is no workaround; Threat Prevention Threat IDs 510046 and 510047 (content 9159-10287 and later) give only limited coverage and need management traffic routed through a data-plane interface with SSL decryption. Risk is highest where the management interface is reachable from the internet. The same 14 Oct bulletin also carries lower-rated PAN-OS, GlobalProtect app, Cortex XSOAR and Checkov fixes, listed separately on the Palo Alto advisory site. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies (BOD 26-04). (source: The Hacker News)
Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface (14 Oct 2026)
On 14 October 2026 Microsoft's Digital Crimes Unit, with Health-ISAC, said a US District Court for the Southern District of Florida order let them seize and redirect domains powering YAM Store (Storm-3119), CoGUI and Iron Man (Storm-2990 phishing kits) — a Chinese-language cybercrime marketplace that sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage, plus ready-made phishing kits. Since January 2026 the three services enabled more than one billion malicious messages targeting over 75,000 organisations and consumers in more than 150 countries, including more than 750 million messages aimed at Microsoft customers, generating tens of millions of dollars for operators. Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains. The investigation began in late 2025 after Japan's National Police Agency flagged campaigns against Japanese victims; JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and US/international law enforcement later joined. YAM Store acted as an access broker: operators bought expired organisation domains (often non-profit and education), rebuilt sites to look live, fraudulently obtained Microsoft 365 tenants, and resold them; AI tools were also used to invent fake organisations. Iron Man (advertised on YAM Store from June 2026) overtook CoGUI with more than 2,300 lure templates across 130+ countries/areas — Microsoft and Resecurity both cite Australia Post package-delivery SMS templates among the samples, alongside ANZ rewards web lures in Microsoft's illustration set. Kits support device-code phishing, geofencing, fake CAPTCHA and live OTP capture. (sources: Microsoft DCU blog; BleepingComputer)
Microsoft Digital Crimes Unit — Disrupting the service economy behind transnational cybercrime operations (14 Oct 2026)
ThreatFabric's Mobile Threat Intelligence team published Hirudo on 14 October 2026: a new Android banking remote-access trojan that combines on-device credential theft with live remote control. Victims first install a functional lure (Shopora shopping, 1V1 X adult video, or ZoyaTV/KoiShort short drama) served via Amazon CloudFront with OpenInstall attribution and Meta Pixel IDs; some download routes were still live in October 2026. The lure shows a fake in-app update, installs a separate Hirudo payload, and may briefly raise a blackhole VPN during install. Once Accessibility and notification access are granted, Hirudo can steal banking passwords, payment PINs, device-unlock secrets and SMS, stream the screen, and use both cameras. What sets it apart from overlay bankers is app replacement: for eight Indonesian banking apps across seven banks it uninstalls the genuine app and installs a purpose-built patched copy that keeps almost all of the bank's code but injects a YAHFA/Dobby hooking engine. The engine substitutes the genuine signing certificate, hides Accessibility services, strips FLAG_SECURE, re-signs key-attestation with a publicly leaked keybox (at least two certificates already on Google's revocation list), and relays Play Integrity requests to an operator server. Credential targets named in code also span China, India, Mexico, Morocco and Thailand; the fake checkout carries Malaysian bank and wallet branding. An unsecured backend panel captured in August 2026 exposed thousands of credential and device records. Victim count is unknown; no Australia-specific targeting is stated. (sources: ThreatFabric; BleepingComputer)
ThreatFabric — Hirudo: From Fake Updates to Patched Banking Apps (14 Oct 2026)
According to The Verge (13 October 2026, 9:59 pm UTC; 14 October, 5:59 am AWST), citing SecurityWeek, Meta says its GitHub was hacked, exposing the personal data of 1,500 people. The Verge reports, citing SecurityWeek, that Meta says "99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data," some of which was "synthetic or anonymized", and that most of that personal data reportedly belonged to Meta employees in the US. No Australian impact has been stated. Correction (25 Oct 2026): the card now rests on The Verge's report; details The Verge does not state (stolen employee credentials, detection timing, Meta's response steps, credit monitoring, regulator notification and notification dates) have been removed, and the card date has moved from 13 to 14 October 2026, the Perth date of The Verge's report (13 October, 21:59 UTC; 14 October, 5:59 am AWST). (source: The Verge) Correction (29 Oct 2026): The Verge's time is now given as it shows it, 9:59 pm UTC on 13 October, instead of "US time"; an internal source label was removed. (source: The Verge)
The Verge — Meta says its GitHub was hacked, exposing 1,500 people's personal data (13 Oct 2026, 9:59 pm UTC; citing SecurityWeek)
Have I Been Pwned (HIBP) added Crunchbase on 14 October 2026 (06:01 UTC; 14:01 Perth time). HIBP says the private company intelligence platform was targeted in a ShinyHunters 'pay or leak' extortion attempt in January 2026, and that data allegedly obtained from the company was then published, including about 560,000 unique email addresses, largely of leads and business contacts, along with names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. In a statement reported by Security Affairs on 26 January 2026, Crunchbase said it "detected a cybersecurity incident where a threat actor exfiltrated certain documents from our corporate network", that no business operations were disrupted, that the incident was contained, that it engaged cybersecurity experts and contacted federal law enforcement, and that it was reviewing the impacted information to decide whether any notifications were required. Australian contacts are not separately stated. UPDATE 22 Oct 2026: re-sourced Crunchbase's acknowledgement to Security Affairs and attributed the data details to Have I Been Pwned (source: Security Affairs, 26 Jan 2026).
Have I Been Pwned — Crunchbase breach (added 14 Oct 2026 UTC; breach January 2026)
Mandurah State Emergency Service has confirmed the incident to Cyber Daily (14 October). A spokesman said the WA Office of Digital Government's Cyber Security Operations Centre (WASOC) notified it on 5 October of a cyber security incident involving unauthorised access to one of its servers. That server held only historical records from before 2022, and there is no evidence any other systems were affected. Operations continue as normal. The unit says it is aware further data was published online as of 13 October. Per Cyber Daily, the leak includes several zip files of compressed backups and a backup folder of historical operations and planning data. Mandurah SES is contacting past and present members who are affected and, with DGov's guidance, advising them on how to protect their personal information. DFES is supporting the unit, and the WASOC-supported investigation into the extent of the incident is ongoing. Mandurah SES, a DFES volunteer SES unit in Western Australia, was listed on The Gentlemen ransomware gang's leak site, according to Cyber Daily. The Gentlemen emerged in September 2025 and, per Cyber Daily, is now second only to Qilin by victim count; Cyber Daily says its most recent Australian victim was All Souls St Gabriels School in Charters Towers. (source: Cyber Daily) Correction (25 Oct 2026): removed leak-site tracker links and the listing and attack dates they gave; the listing is now credited to Cyber Daily. The card date has moved from 2 to 14 October 2026, the Perth date of Cyber Daily's report (13 October 23:52 UTC, 14 October 07:52 Perth time (AWST)). (source: Cyber Daily)
Cyber Daily — Exclusive: Mandurah SES confirms operations unaffected by ransomware attack (14 Oct 2026)
Siemens ProductCERT published advisory SSA-591731 on 13 October 2026 for eight vulnerabilities (CVE-2026-63350 to CVE-2026-63357) in the web server of SIMATIC S7-1500 devices. Siemens says affected devices do not properly validate or sanitise content in imported trace files (including calculated signals in CSV trace files) before rendering it on the web server's Trace page, so an attacker could social engineer an authorised user who holds the function right 'Read diagnostics' into importing a specially crafted file; successful exploitation could let attacker-controlled JavaScript run in the user's browser session and perform PLC operations through the web server within the scope of that user's authorisation. Siemens rates three of the flaws (CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354) CVSS 3.1 9.6 / CVSS 4.0 9.4 and the other five CVSS 3.1 6.1 / CVSS 4.0 5.3. Siemens lists all versions of the affected products, including S7-1500 CPUs (with related ET 200 CPUs and SIPLUS variants), S7-1500 MFP and ODK CPUs, the S7-1500 Software Controller, ET 200SP Open Controller, SIMATIC Drive Controllers and S7-PLCSIM Advanced, and says 'Currently no fix is available' for each; it says it is preparing fixes and recommends mitigations in the meantime. (source: Siemens ProductCERT SSA-591731) Updated 22 Oct 2026: CISA republished Siemens' advisory as ICSA-26-295-14 (8:00 pm Perth time). (source: CISA)
Siemens ProductCERT — SSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server (13 Oct 2026, V1.0)
Adobe released security bulletin APSB26-144 for ColdFusion on 13 October 2026, its October Patch Tuesday, with 31 CVE records published the same day by Adobe as the CVE numbering authority. Three are scored 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed): CVE-2026-105899, an unrestricted upload of a dangerous file type that Adobe says could lead to arbitrary code execution; CVE-2026-106624, a code-injection flaw leading to arbitrary code execution; and CVE-2026-106622, a server-side request forgery (SSRF) flaw that could lead to privilege escalation. Two more, CVE-2026-105903 (code injection) and CVE-2026-106612 (incorrect authorisation), are scored 9.9 and need only a low-privileged account. Others in the bulletin include CVE-2026-106621 (9.1, code injection without authentication), CVE-2026-106619 (9.0, input validation, high attack complexity), CVE-2026-106620 (9.6, authorisation bypass giving write access), CVE-2026-75994 (9.6, code execution from the administrative network zone), CVE-2026-90530 (9.3, path traversal in the RDS developer feature), and a long list of 7.1 to 8.8 authorisation, SSRF, XXE and denial-of-service bugs. Adobe's CVE records list ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 as affected, fixed in 2025.0.14 and 2023.0.26. The record for CVE-2026-90530 notes that RDS is a development feature that the Production Secure Profile disables automatically. We found no reports of exploitation, and none of these CVEs is in CISA's Known Exploited Vulnerabilities catalog as of 20 October, but internet-facing ColdFusion servers have been exploited quickly after past bulletins, so treat this as urgent. Details come from Adobe's CVE records; Adobe's bulletin page refused our fetch. (sources: Adobe APSB26-144; Adobe CVE records)
Adobe — APSB26-144 Security updates available for Adobe ColdFusion (13 Oct 2026)
MITRE released ATT&CK v20 on 13 October 2026, updating techniques, groups, campaigns and software across the Enterprise, Mobile and ICS matrices. MITRE says the biggest change is broader coverage of recent adversary activity, including AI-focused and AI-enabled techniques. New Enterprise techniques are Direct Prompt Injection, Indirect Prompt Injection, AI-Enabled Exfiltration, Stage Capabilities: AI Result Poisoning, Disable or Modify Tools: Impair Autonomous Defenses, Anti-Automation Evasion (with sub-techniques for automating CAPTCHA completion and avoiding CAPTCHA) and Steal Application Specific Passwords, each with new detection strategies. Supply Chain Compromise: Compromise Software Dependencies and Development Tools moves to version 2.0. New campaigns are '2026 U.S. Water Utilities Attacks' (ICS) and 'AI-Assisted Breach of Mexico's Government Infrastructure'. New groups are NIMBUS MANTICORE and The Gentlemen (whose ransomware is also added as software), and Salt Typhoon and APT38 entries get major revisions. ICS gains execution techniques for command and scripting interpreters (PowerShell, Python, JavaScript, Unix shell, Visual Basic, Windows command shell) and command and control over DNS and publish/subscribe protocols, while the older ICS Command-Line Interface and Scripting techniques are deprecated. Mobile un-deprecates Deliver Malicious Application via Other Means. The release counts 971 software entries, 182 groups and 61 campaigns; Enterprise now has 227 techniques and 479 sub-techniques. Why it matters: teams that map detections, threat models or red-team plans to ATT&CK now have standard IDs for prompt-injection and AI-agent abuse, and ICS teams have script-execution techniques to map. (sources: MITRE ATT&CK October 2026 update notes; MITRE ATT&CK; Cyber Security News)
MITRE ATT&CK — Updates, October 2026 (v20, 13 Oct 2026)
Adobe's security bulletin APSB26-153, published on 13 October 2026, fixes CVE-2026-103849, a template-engine injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker run arbitrary PHP on the store server. E-commerce security firm Sansec, which named the flaw BlockStrap (reported to Adobe by researcher vozec), said on 15 October that it reproduced four separate routes to code execution within 24 hours of the patch, although it had not yet seen attacks on live stores. BlockStrap is a second-pass directive injection: September's StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) signs trusted template directives, but attacker-controlled data in a child email template can still be signed and re-scanned at the root level, where a smuggled {{block}} directive runs. Adobe's fix replaces that generic re-scan with registered placeholders. Adobe rated the bulletin priority 2 (patch within 30 days) because it reserves priority 1 for flaws it knows are exploited; Sansec disputes that, noting StyleSmuggler went from hotfix to mass exploitation in three days. A plain Composer install still pulls the vulnerable base version, so stores need the 2026-oct release or Adobe's isolated patch, and the October patch does not include the StyleSmuggler hotfix, which must stay installed separately. Public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9; patches for 2.4.4 to 2.4.6 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older must upgrade. Mage-OS 3.6.0 (14 October) includes the fix. (sources: Adobe APSB26-153; Sansec; BleepingComputer) Updated 15 Oct 2026 (Sansec): Sansec's report is dated 15 October 2026; details credited to Sansec on this card come from that report. Updated 16 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 16 October 2026; details credited to BleepingComputer on this card come from that report.
Adobe — APSB26-153 security update for Adobe Commerce and Magento Open Source (13 Oct 2026)
SolusVM published advisory CVE-2026-105474 (updated 13 October 2026) for a server-side template injection in SolusVM 2, the virtual-server control panel used by many hosting providers. An authenticated user can execute arbitrary code on the server with elevated privileges, which SolusVM says can lead to full compromise of the management node and affect other customers hosted on the same node. Rapid7 records CVSS 4.0 base score 9.4 (Critical) for the issue and describes remote authenticated users reaching root. Affected: all SolusVM 2 builds through 2.0.0-44576. Patched version listed by SolusVM: 2.0.0-44739. The advisory tells operators to update to 2.0.0-44739 or later once that build is available. Credited to Georgii Shutiaev. No in-the-wild exploitation is stated in the vendor note or the Rapid7 entry this pass. (sources: SolusVM support advisory; CVE record)
SolusVM — CVE-2026-105474 Server-Side Template Injection in SolusVM 2 (updated 13 Oct 2026)
