Latest cyber news, threats, security, and guidelines. Stack up.
Thu 8 Oct
Apache Struts Command Injection Vulnerability. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Thu 8 Oct
ISC BIND Data Processing Errors Vulnerability. ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Thu 8 Oct
ProFTPD Improper Access Control Vulnerability. ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Thu 8 Oct
SEC Consult published technical details on 8 October 2026 of five vulnerabilities it reported to TP-Link from December 2024 in ISP-supplied (Aginet) mesh systems, routers, fibre (PON) devices and DSL modems. TP-Link says 65 models are affected, including ISP-customised variants; the list includes Australian models HX510(AU) and HX220(AU). CVE-2025-30237 is an authentication bypass in the web server that lets an unauthenticated attacker with access to the web interface create a super-administrator and enable SSH; CVE-2025-30238 lets a low-privileged user act as an administrator; CVE-2025-30241 is authenticated command injection as root; CVE-2025-30239 is hardcoded, model-wide keys protecting configuration files and backups, so extracted keys reveal user, Wi-Fi and sometimes ISP remote-management credentials; CVE-2025-30240 needs physical USB access to read the whole file system. SEC Consult says an attacker on the same network could fully take over a device. TP-Link disclosed the flaws in August 2026; its fixes, including custom ISP firmware, rolled out into 2026 and are distributed by ISPs. Separately, the attorneys general of Florida, Iowa, Montana and Nebraska filed near-identical consumer protection lawsuits against TP-Link Systems on 6 October, after Texas in February, alleging its HomeShield marketing overstated protection, citing past use of TP-Link routers in Volt Typhoon and Flax Typhoon activity, unsupported models without updates, and undisclosed ties to China; they cite these five CVEs. TP-Link's response is not in the reporting. No exploitation of the five flaws is reported. (sources: SEC Consult; SecurityWeek)
Thu 8 Oct
Updated Tue 27 Oct
Oregon's Department of Justice breach database lists two Cerner Corporation entries for the breach of Oracle Health's legacy Cerner systems, for 1,970,332 Oregonians (reported 25 July 2025) and 8,329 (reported 6 July 2026), both giving 22 January to 1 April 2025 as the breach dates and 20 February 2025 as the discovery date. HIPAA Journal reported on 8 October 2026 that the Texas attorney general was given an updated total on 2 October and that state filings confirm 2,992,244 affected people in Texas, 283,903 in South Carolina and 69,238 in Washington. HIPAA Journal says Oracle Health has not publicly disclosed the total number of people affected or how many Cerner clients were affected. A sample patient letter dated 25 July 2025, filed by Cerner Corporation with the California attorney general, says an unauthorised third party gained access to personal health information on legacy Cerner systems at least as early as 22 January 2025, that the provider sending it learned of the breach on 7 March 2025, and that federal law enforcement asked for patient notification to be delayed. The letter says the information may have included names, Social Security numbers and medical record information such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment, and offers 24 months of Experian IdentityWorks. HIPAA Journal says the incident involved two legacy Cerner servers that had not yet been migrated to Oracle Cloud, and that Oracle Health said its own systems were not affected. HIPAA Journal and Fierce Healthcare, each citing another outlet's report of information released by the Texas attorney general, put the total at almost 20 million; HIPAA Journal says this has not been independently verified. Updated 9 Oct 2026 (Fierce Healthcare): Fierce Healthcare says Cerner's entry on the Texas attorney general's breach portal, dated 2 October 2026, lists addresses, Social Security numbers and medical information, and that affected Texans were notified by US mail. (source: Fierce Healthcare) Correction (23 Oct 2026): removed an extortionist's ransom demand. Correction (23 Oct 2026): re-sourced to HIPAA Journal, Fierce Healthcare, the Oregon Department of Justice breach database and the California attorney general's sample letter; removed details we could not verify from a source we can recheck; removed the third-hand nationwide total from the headline and kept it only as one attributed line; Oregon figures are now given as filed. (source: HIPAA Journal) Correction (26 Oct 2026): the Australia field said no Australian impact had been reported; no cited source mentions Australia either way, so it now reads unknown. (source: HIPAA Journal) Correction (26 Oct 2026): the card date has moved from 5 to 8 October 2026, the Perth date of HIPAA Journal's report, the earliest linked source for this story; Fierce Healthcare's later report now carries an Updated line. The 2025 breach notices are background and do not set the date. (source: HIPAA Journal; Fierce Healthcare) Correction (27 Oct 2026): removed a line about which outlet first reported the breach, which no source Cyberstack can read states first-hand; the nearly 20 million figure is now credited to HIPAA Journal and Fierce Healthcare, both of which attribute it to another outlet's report; Fierce Healthcare's update is now dated 9 Oct 2026, the date its page shows (no time zone is shown, so no time is given), instead of a converted Perth time, and HIPAA Journal's report carries only the date its page shows (Oct 8, 2026). (source: Fierce Healthcare; HIPAA Journal)
Thu 8 Oct
BleepingComputer reported on 8 October 2026 that Raheim Hamilton, 30, who co-created and ran the Empire Market dark web marketplace from August 2017 until it went offline in 2020 amid extortion DDoS attacks and exit-scam claims, has been sentenced to 40 years in federal prison, citing the US Attorney's Office for the Northern District of Illinois. Empire facilitated more than 4 million transactions worth about US$430 million; drugs made up nearly US$375 million, but the site also sold counterfeit currency, stolen account credentials, hacking tools and personal information. At its peak in August 2020 it had about 1.68 million registered users, over 5,000 vendors and nearly 360,000 buyers. Hamilton pleaded guilty in January and agreed to forfeit three Virginia properties, about 1,230 bitcoin and 24.4 ether; co-defendant Thomas Pavey ('Dopenugget') pleaded guilty last year and is due to be sentenced later this month. Authorities seized about US$75 million in cryptocurrency when the pair were charged in July 2024. (sources: US Department of Justice; BleepingComputer)
Thu 8 Oct
Socket and StepSecurity reported on 8 October 2026 that version 0.5.144 of tensorlake, the TypeScript SDK for Tensorlake's sandboxes for running LLM-generated code (about 12,000 weekly downloads), was malicious. StepSecurity says someone pushed eight commits straight to the main branch of tensorlakeai/tensorlake under a maintainer's name from 01:20 UTC on 7 October, and the project's own release workflow published 0.5.144 to npm at 01:12 UTC on 8 October, so the package carries a genuine npm provenance attestation. Socket flagged it about 11 minutes after release and it has since been pulled from npm. A preinstall hook runs lib/setup.mjs, which skips CI, downloads the Bun runtime and runs an obfuscated payload (lib/Math_Symbol.js) that collects GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and config files for AI coding tools. Data goes to a public GitHub repository created in the victim's account (description 'Shai-Hulud: Here We Go Again') or to a server found through an Ethereum contract. With a stolen npm token the worm republishes the victim's packages with itself added; with a GitHub token it commits .claude/settings.json and .vscode/tasks.json files so it runs again when a project is opened in Claude Code or VS Code. It also installs a gh-token-monitor service that checks the stolen token every 60 seconds for up to 24 hours and deletes the user's home directory (or Windows profile) if the token stops working. The loader and payload names match the August ChainDrop compromises of keyv and cacheable. (sources: Socket; StepSecurity; The Hacker News)
Thu 8 Oct
St Andrew's Hospital, a private hospital in Adelaide, said on Thursday 8 October 2026 that it had been investigating a breach of personal information affecting "a group of individuals". Chief executive Angela McCabe said the investigation had progressed far enough for the hospital to contact affected people directly, in line with its regulatory obligations, and that they had been given information on how to protect their personal information. The hospital says it has notified the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre, and is working with government agencies to apply extra measures to detect and prevent suspicious and fraudulent activity. The number of people affected, what kind of information was involved and how the breach happened have not been disclosed. South Australian Premier Peter Malinauskas said the state government expected to be briefed later on 8 October, including on whether anything criminal had occurred. (source: ABC News)
Thu 8 Oct
The US State Department's Rewards for Justice (RFJ) programme is offering up to US$10 million for information on Zhang Yu, a Chinese national it describes as a director at Shanghai Firetech Information Science and Technology Company working at the direction of China's Ministry of State Security Shanghai State Security Bureau. RFJ says that from early 2020 Zhang and his partner Xu Zewei, then general manager at Shanghai Powerock Network, gained unauthorised access to COVID-19 research at US universities and stole information from immunologists and virologists, and that in 2021 the pair exploited Microsoft Exchange Server flaws as part of the HAFNIUM mass-intrusion campaign, with victims including a US university and a law firm. Xu was arrested in Italy and extradited to the US in April 2026; Zhang remains at large. Cybersecurity News reported the offer on 8 October, citing the FBI Cyber Division; the RFJ page itself carries no date. The charges are allegations, not proof of guilt. (source: Rewards for Justice)
Thu 8 Oct
Updated Thu 29 Oct
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCisco published advisory cisco-sa-ngoam-rce-LWKQ4BU at 16:00 GMT on 7 October 2026 (midnight 8 October Perth). It covers three flaws (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) in Next Generation OAM (NGOAM), the operation, administration and maintenance feature of NX-OS, on Nexus 3000 and Nexus 9000 switches in standalone NX-OS mode. Cisco says improper validation of IP traffic lets an unauthenticated remote attacker send crafted packets to any IP interface and run code as root, or crash processes and reload the switch. All three score 9.8. Exposure depends on features: CVE-2026-76485 needs only NGOAM enabled; CVE-2026-76486 also needs SRv6 or NV Overlay with a VXLAN EVPN VNI and at least one peer VTEP learned; CVE-2026-76501 also needs SRv6, which Nexus 3000 does not support. Cisco says there are no workarounds, but disabling NGOAM where it is not needed removes the attack vector, and it has released temporary Live Protect shields for all three. Cisco found the flaws in internal testing and PSIRT knows of no public announcements or malicious use. (source: Cisco) Correction (27 Oct 2026): this card covered Cisco's whole 7 October batch and has been cut back to the NGOAM advisory its id names. Removed: the MPLS OAM and NX-API advisories (including the UCS 6300 note); the NX-OS, APIC and Meraki security hardening advisories; the Finesse SSRF; and the medium-rated NX-OS, APIC and ACI bugs; plus the NX-API advisory and batch-notice links. The card date has also moved from 7 to 8 October 2026, because Cisco states the time and zone (16:00 GMT, midnight 8 October Perth). (source: Cisco) Correction (29 Oct 2026): the CVE ids of the removed advisories were taken out of the correction note above so they are no longer listed or linked on this card. (source: Cisco)
Thu 8 Oct
Updated Mon 26 Oct
Japan's National Police Agency (NPA) said in a press release dated 8 October 2026 that Germany had announced the arrest of a Russian national believed to have led the Qilin ransomware group, which has hit companies around the world, and that Germany's announcement mentioned the Japanese police's contribution. According to the NPA, after the suspect, for whom Germany had obtained an arrest warrant over a ransomware attack in Germany, arrived in Japan, the Kanto Regional Police Bureau's cyber special investigation unit and the prefectural police concerned worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office and Germany to detain him on a provisional detention warrant under Japan's extradition law and then hand him over to Germany. The NPA says the same police units had also investigated ransomware cases in Japan in cooperation with Germany. The suspect has not been named. Updated 9 Oct 2026 (BleepingComputer, 11:38 pm Perth): BleepingComputer reported that Germany has arrested the suspect, a Russian national believed to be a leading member of Qilin, after his extradition from Japan earlier in October; that the NPA said he was detained after arriving in Japan as a tourist; and that Japanese media had reported the arrest earlier that week, citing internal sources. BleepingComputer says Qilin is a ransomware-as-a-service operation that emerged in August 2022 under the name Agenda and has targeted more than 2,350 known organisations in 62 countries, including Nissan, Asahi, Lee Enterprises and Australia's Court Services Victoria; that it more recently hit the US ATF and has been linked to the exploitation of Check Point VPN zero-days and Palo Alto VPN n-day flaws. Correction (26 Oct 2026): this card was first based on a SecurityWeek report (7 October) that this Cyberstack does not link. Details that only that report gave have been removed: the suspect's age, his detention in Osaka in May 2026, the 2 October handover date, the September 2024 attack on a logistics company, the ransom of more than US$160,000, the Synnovis attack, a 2025 leak-site count and CVE-2026-50751. The card now rests on the NPA press release and BleepingComputer, and its date has moved from 7 to 8 October 2026, the date of the NPA release. (source: National Police Agency of Japan; BleepingComputer) Correction (26 Oct 2026): removed a count of victims listed on Qilin's leak site since June; this Cyberstack does not publish leak-site claims. (source: BleepingComputer)
Wed 7 Oct
Morphisec (Shmuel Uzan, 7 October 2026) documents VulcanRAT207.A, a multistage Windows intrusion that starts as a WhatsApp attachment: a ZIP carrying a financial-document lure and Statement.exe. The outer executable is NRV2E-packed; after unpacking, the loader screens the host (disk, display, memory, CPU, event logs, Registry, VM markers, security products and timing checks), attempts privilege elevation, restores a clean ntdll.dll to drop user-mode hooks, and injects an importless downloader into the LocalSystem Task Scheduler process using PoolParty Variant 7 (thread-pool IoCompletion), so later stages inherit a SYSTEM token. The shellcode beacons over HTTP to 61[.]18[.]208[.]27:8888, validates a 0x0207 magic header, and receives a deployment bundle. A reflective loader maps a Deployment DLL that (1) installs GoFly64.sys — a legitimately signed Chinese network-filter driver — to terminate selected Baidu security processes, (2) writes a persistent Vulkan side-load package under C:\Program Files\Common Files and a scheduled task that later starts a signed VulkanInfo binary loading attacker-controlled vulkan-1.dll / vulkan-1.bin, and (3) launches the WebSocket RAT in memory for system data collection, command execution, file management, screen capture, keylogging, local account changes and further payloads. Morphisec published SHA-256 and network indicators for the Statement.exe / VulcanRAT207.A chain. No Australia-specific victims were named. (sources: Morphisec; Cybersecurity News)