Quest Apartment Hotels (Ascott Australasia) identified the incident on 17 August 2026 after a website outage investigation showed a threat actor exploited a vulnerability in a third-party service provider and accessed Quest’s environment; Quest says the incident was contained and systems secured. Managing Director update (16 September 2026 PDF / update page) states forensic analysis found information relating to approximately 1,991,613 customers, all from records before June 2025. Beyond name/address/phone/email contact fields, Quest publishes category counts: vehicle registration 225,300; passport and/or driver licence number only (no scanned ID images) 104,268; credit card number without CVV (incl. expired) 297,739; credit card number with CVV (incl. expired) 46,727; date of birth 3,328; NDIS number 271; Medicare card number 46. Not every category applies to every person; Quest is notifying individuals in stages. Quest says it has notified and continues to cooperate with OAIC, ASD, ACSC and Victoria Police. Separate 23 September 2026 passport/licence clarification (company PDF): where an Australian passport number was affected, Quest cites Australian Passport Office advice that the passport remains safe to use for international travel (number alone cannot obtain a new passport; APO facial-recognition controls); where a driver licence number was affected, Quest says consider contacting the relevant state/territory roads authority. Updated customer FAQ PDF dated 23 September 2026. ABC News (22 September 2026 UTC) reported customer SMS/email notices and earlier advice that prompted some guests to reissue licences/cards; treat ABC as secondary to Quest’s own PDFs. (source: Quest /update hub) UPDATE (23 Oct 2026): Quest's update page links a 25 September 2026 scam alert saying customers have received unsolicited emails and WhatsApp messages impersonating Quest that ask them to confirm an upcoming booking by clicking a link; Quest says not to click the link or call the number in the message, and to contact the hotel directly using the details on the Quest website. The alert does not say whether these messages are connected to the data breach. (source: Quest (questapartments.com.au))
CVE-2026-18556 and CVE-2026-18577 are authentication-bypass issues in N-able N-central that may allow unauthorised access through an alternate path. ASD's ACSC has observed targeting of the product in Australia. Affects current versions including 2026.3. Vendor Hotfix 2 (build 2026.3.1.10, 6 August 2026) supersedes Hotfix 1. Review whether the console needs to face the internet.
CISA added CVE-2026-64849 to KEV on 19 August 2026. MLflow contains an SSRF issue that can let attackers reach internal or cloud metadata services. The CVE record states the issue is fixed in 3.15.0. Do not expose MLflow tracking servers to untrusted networks.
TP-Link security advisory FAQ 5248 (last updated 27 August 2026; firmware release noted by OPSWAT as 18 August 2026) covers CVE-2026-15315 and CVE-2026-15316 in Tapo smart cameras. CVE-2026-15315 (CVSS v4.0 8.7 High; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N): improper authentication in the login verification module on Tapo C120 V1 and C200 V5 — a local-network attacker can replay device_confirm challenge material to obtain administrative session tokens without the camera password. CVE-2026-15316 (CVSS v4.0 7.1 High; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N): oversized encrypted Wi-Fi credential input in C200 V5 onboarding crashes/restarts the HTTPS management service (DoS). Discovery credit: OPSWAT Unit 515 / fellowship research (Khoi Tran, Thai Do); OPSWAT blog notes further critical findings still under coordinated disclosure. Adjacent-network only (AV:A) — not internet-unauth without LAN/VPN reach to the camera. SecurityWeek 18 Sep roundup re-reported the advisory. (sources: TP-Link FAQ 5248; OPSWAT)
TP-Link — Security Advisory FAQ 5248 Tapo C120/C200 (updated 27 Aug 2026)
The Essendon-headquartered SIA Medical Centre, a Victorian medical centre, has said it is investigating a cyber security incident after hackers claimed to have accessed sensitive patient data, Cyber Daily reported on 18 August 2026. “SIA Medical is aware of a cyber incident involving unauthorised access to a portion of its systems,” an SIA spokesperson told Cyber Daily. Rhysida claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (31 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily)
Oracle's 18 August 2026 Critical Security Patch Update (revision 3 on 27 August) contains 943 new security patches. Oracle says it continues to receive reports of attempts to exploit already-patched issues where customers had not applied available updates. Fusion Middleware includes unauthenticated WebLogic Server Core issues CVE-2026-60698 (IIOP, 9.8), CVE-2026-60672 and CVE-2026-60696 (T3/IIOP, 9.8) on 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, plus CVE-2026-60977 (RMI, 9.8) on 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, and Oracle Internet Directory LDAP Server CVE-2026-61241 at 10.0 on 12.2.1.4.0 and 14.1.2.1.0. Database Server includes adjacent-network Portable Clusterware issues CVE-2026-71063 and CVE-2026-71064 at 9.6. Apply the August 2026 CSPU for each product family you run. This is separate from CVE-2026-21962 (January 2026 CPU, later added to CISA KEV).
Broadcom VMSA-2026-0006 (29 July 2026; updated 19 August) covers CVE-2026-59310, a Critical directory-traversal flaw in the VMware vCenter Syslog server. A malicious actor with network access to vCenter can execute arbitrary code; Broadcom rates maximum CVSSv3 9.8; NVD CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No workarounds — apply fixed builds per the VMSA response matrix / FAQ (brcm.tech/vmsa-2026-0006). CISA added the CVE to KEV on 18 August 2026 (FCEB due 21 August) after QUIRSO reported 361+ compromised IPs across 47 countries with reverse-SSH persistence. Updated 15 Sep 2026: according to BleepingComputer and the CISA KEV catalog (knownRansomwareCampaignUse=Known), CISA now flags the flaw as used in ransomware campaigns; Shadowserver still tracks 450+ internet-exposed vCenter instances. Treat unpatched vCenter as emergency. (sources: Broadcom VMSA-2026-0006; CISA KEV; BleepingComputer)
Weak authentication in on-premises Microsoft SharePoint (CVE-2026-55040) lets an unauthorised attacker bypass a security feature over the network. CISA added it to KEV on 18 August 2026 after evidence of active exploitation. NVD scores it 9.1 (CVSS 3.1). It is the auth-bypass half of an unauthenticated RCE chain with August's CVE-2026-63520 (Business Connectivity Services RCE). Apply the July/August SharePoint security updates for Subscription Edition, 2019 and 2016, and keep farms off the public internet unless required.
CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities catalog on 18 August 2026: a double-free in Microsoft Internet Key Exchange (IKE) Service Extensions. Treat internet-reachable IKE as known-exploited and apply Microsoft's update.
Zabbix's 18 August 2026 advisory (ZBX-28071) says that in Zabbix 7.4 the cryptographic key used for signing frontend sessions was erroneously written to the database seed. The only known exploitation scenario is deployments that use both SAML authentication and guest users: the key can be used to forge valid session cookies and gain unauthorised frontend access. Other deployments have no known impact. Affected: 7.4.0 through 7.4.10. Fixed: 7.4.11. Vendor CVSS 4.0 is 7.7 (High). Workaround: clear settings.session_key in the Zabbix database so the frontend generates a new random key. Zabbix credited Daniel Shemesh and Or Ida via HackerOne. Not in CISA KEV at last check.
Brighton East Dental Clinic's official notice says ASD's ACSC alerted it on 13 August 2026 to a potential incident. On 17 August 2026 the clinic identified unauthorised access to data on on-premises file servers through its firewall, contained that access, and analysed leaked data. It assesses the access occurred in early April 2026 and involves records from before April 2026: patient contact details (name, address, date of birth, email, mobile), treatment plans, oral X-rays, referrals and treatment history, and private health insurance membership numbers. The clinic has not published a count of affected records. It says it notified OAIC, ACSC and Victoria Police, partnered with IDCARE, and that remediation is complete. This Cyberstack does not take actor names or leak sizes from secondary leak-site indexes. Correction (29 Oct 2026): the card date has moved from 17 to 18 August 2026, the date of Cyber Daily's report ("Tue, 18 Aug 2026"), the earliest linked source that shows a date. (source: Cyber Daily)
Red Hat's 17 August 2026 CVE record (threat severity Critical, CVSS 3.1 9.1) describes a reset-credentials flaw in keycloak-services for Red Hat Build of Keycloak. An unauthenticated remote attacker can force password reset for any user without the email verification step and set new credentials, taking over the account. Temporary mitigation if you cannot patch yet: turn Forgot password off for every realm (Realm settings → Login). Fixed packages include Keycloak 26.4 builds at or after rhbk/keycloak-operator-bundle 26.4.15-1 / keycloak-rhel9 26.4-23 (RHSA-2026:56519 / 56520) and 26.6 builds at or after 26.6.6-1 / 26.6-12 (RHSA-2026:56523 / 56524). Red Hat marks Red Hat Single Sign-On 7 and JBoss EAP Expansion Pack as not affected. No in-the-wild exploitation stated on the Red Hat CVE page at last check.
