Juniper's 8 July 2026 security bulletin (JSA110083): an improper validation issue in the TCP proxy plugin of Junos OS on SRX Series and MX Series with SPC3 lets an unauthenticated, network-based attacker cause a complete denial of service. When TCP proxy is in use (ALGs, Advanced Anti-Malware, ICAP or UTM), a TCP packet with a specifically malformed header crashes flowd, causing a full service outage until the process restarts. CVSS 3.1 is 7.5; CVSS 4.0 is 8.7. Affected: 23.4 before 23.4R2-S7, 24.2 before 24.2R2-S4, 24.4 before 24.4R2-S3, 25.2 before 25.2R2. Not before 23.4R1. Juniper SIRT says it is not aware of malicious exploitation; the issue was seen during production usage. No workaround. This was part of Juniper's 8 July 2026 bulletin round (Canadian Centre for Cyber Security AV26-675).
CVE records were published on 7 October 2026 for three flaws in Homer, the open-source SIP and VoIP capture and troubleshooting platform from the SIPCAPTURE project, used by carriers and VoIP operators. The project fixed them in Homer 11.0.283 and published GitHub security advisories on 25 June 2026. CVE-2026-62253 (GHSA-rqcc-94gv-wjm9, CVSS 3.1 9.8): both JWT middleware functions let a request through when the JWT secret is empty, and the secret defaults to empty, so on a default install all protected API endpoints under /api/v1, /api/v3 and /api/v4 need no login. CVE-2026-62252 (GHSA-6xp5-7rcx-xfgx, 9.8): fresh deployments using internal authentication create an admin account with the password 'sipcapture' and never force a change, so anyone who reaches the login page gets full admin access. CVE-2026-62251 (GHSA-f46q-3v67-fmm4, 8.1): any authenticated user can send raw SQL to DuckDB through the v4 statistics query endpoint and read or change everything reachable through the FlightSQL service. Homer stores captured call signalling, which includes phone numbers and call metadata. No exploitation has been reported. (sources: SIPCAPTURE GitHub security advisories; CVE records)
SIPCAPTURE — GHSA-rqcc-94gv-wjm9: complete authentication bypass when coordinator.jwt.secret is empty (default), CVE-2026-62253 (25 Jun 2026)
Aesto Health (Birmingham, Alabama), which provides healthcare data migration and archiving for covered-entity clients, posted a notice dated 24 June 2026: it discovered a network security incident on or about 18 December 2025 affecting a limited portion of its Amazon Web Services infrastructure. On 26 May 2026 the investigation determined that PII and PHI belonging to patients of various clients may have been accessed or acquired between about 2 and 18 December 2025, including names, dates of birth, medical information, driver's licence numbers, financial account numbers, health insurance information, taxpayer identification numbers, other government IDs, and Social Security numbers (elements varied; SSNs for a limited number of people). The company says it has no evidence of identity theft or financial fraud tied to the incident. No Australia link is reported. Updated 1 Sep 2026 (BleepingComputer): BleepingComputer reports that in a report to the US Department of Health and Human Services, Aesto Health said the breach affects 9,540,683 individuals, and that Aesto began notifying affected people on 21 August. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 31 August to 24 June 2026, the date on Aesto's notice; the SecurityWeek link, the HHS listing date and a count of affected provider clients that only SecurityWeek gave have been removed, and the 9,540,683 figure is now credited to BleepingComputer. (source: BleepingComputer)
Aesto Health notice of data security incident (24 Jun 2026)
The University of Western Australia's own notice says that on 28 May 2026, UWA IT identified unauthorised external access to Callista, the university's Student Information Management System, after system access credentials were unintentionally exposed online. UWA says it secured the system and removed the vulnerability. Exposed fields, on that notice, include name, UWA student ID, UWA staff ID if applicable, home and mobile numbers, date of birth (day and month only), personal email, postcode, and enrolment status as at 2 April 2026, for some prospective students, current students and recent graduates. UWA says financial details were not involved, that it found no evidence of malicious use, and that it emailed affected people on 8 June 2026. UWA password resets were not required. (source: UWA) Correction (29 Oct 2026): removed an unsourced statement about ASD's ACSC alerts and a duplicate UWA link. (source: UWA)
Roundcube security updates 1.6.16 / 1.7.1 (published 24 May 2026) fix CVE-2026-48842: pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass (reporter: skull). Affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 when the plugin is enabled/reachable. CVE.report CVSS 3.1 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Same releases also fix XSS/CSS injection, SSRF/local URL fetch bypasses, remote-image CSS var() bypass, pre-auth arbitrary file delete via redis/memcache session poisoning, and LDAP autovalues code-evaluation removal. Canadian Centre for Cyber Security advisory AV26-503 (updated 21 September 2026) confirms open-source reporting of active exploitation — CCCS did not publish attack details. UPDATE 25–26 Sep: SentinelOne describes the SQLi path (backslash sequences defeating preg_replace escaping so quotes land in the SQL string); Shadowserver Foundation telemetry cited by THN shows >523,000 internet-exposed Roundcube instances with 10 hosts flagged vulnerable as of 23 September 2026. (sources: Roundcube security news; GitHub 1.6.16; SecurityWeek)
Roundcube — security updates 1.6.16 and 1.7.1 (24 May 2026)
CVE-2026-23870 (GitHub advisory GHSA-rv78-f8rc-xrxh, published 11 May 2026) is a high-severity denial-of-service flaw in React Server Components (react-server-dom-webpack, -turbopack and -parcel) used by React 19.x apps, including Next.js deployments that use Server Actions. When React rebuilds submitted form data before a Server Action runs, each $K (nested form) reference triggers a full scan of every field in the request, and neither the reference count nor the field count is limited. A request with 10,000 references and 10,000 fields means about 100 million string checks, run synchronously on Node.js's single event-loop thread, so other visitors see timeouts or 503s; no authentication is needed. Researcher Simon Koeck published a technical write-up on 8 October 2026 showing a request of roughly 900 KB is enough, which makes the bug easy to reproduce for anyone still unpatched. Fixed React package versions: 19.0.6, 19.1.7 and 19.2.6; Next.js fixed it in 15.5.16 and 16.2.5 (GHSA-8h8q-6873-q5fj), and the Vite React plugin has its own advisory. No in-the-wild exploitation has been reported. (sources: GitHub advisory; Cyber Security News)
React (GitHub) — GHSA-rv78-f8rc-xrxh: Denial of Service in React Server Components (11 May 2026)
Instructure detected unauthorised activity in Canvas on 29 April 2026 and a second access on 7 May 2026 that changed pages some students and teachers saw after login. The vendor says both used a Free-For-Teacher account path, took Canvas into maintenance, remediated the privilege-escalation routes, and permanently discontinued Free-For-Teacher. Fields named on the vendor FAQ include usernames, email addresses, course names, enrolment information, and messages; Instructure says core learning data (course content, submissions, credentials) was not compromised, and the US Education Department FSA alert (12 May, updated 29 May) repeats that there is no evidence passwords, dates of birth, government identifiers, or financial information were exposed. The US Education Department's FSA alert says a ransomware group identified as ShinyHunters claimed responsibility and repeatedly defaced Canvas login pages with ransom demands; Instructure later said it reached an agreement with the unauthorised actor, that data was returned with shred logs, and that customers should not engage the actor. Patch posture for customers: rotate Canvas integrations, LTI tools, SSO connectors, and API keys; review logs for 25 April–8 May 2026. Correction (24 Oct 2026): removed data-volume and institution counts that no linked source supports, and attributed the ShinyHunters claim to the US Education Department's FSA alert. (source: US Dept of Education FSA alert)
ASD's ACSC has observed ClickFix social-engineering activity using compromised WordPress sites to distribute Vidar Stealer against Australian infrastructure. Treat unexpected 'paste this command' prompts as hostile. This is social engineering, not an AI-stack flaw.
ASD's ACSC said in a 1 May 2026 critical alert that it is 'aware of active exploitation in Australia of a critical vulnerability (CVE-2026-41940) affecting cPanel/WHM products', according to Cyber Daily (4 May). The CVE record (NVD) describes it as an authentication bypass in cPanel and WHM versions after 11.40 that allows unauthenticated remote attackers to gain unauthorized access to the control panel. cPanel says it released security updates for cPanel & WHM on 28 April 2026. Correction (23 Oct 2026): this card earlier also cited a mistyped CVE number (the final 0 dropped), which belongs to an unrelated D-Link NAS flaw; the cPanel/WHM issue is CVE-2026-41940. Correction (23 Oct 2026): removed a line saying the ACSC noted patches as of 30 April 2026, which rested only on an ASD page we cannot recheck; the ACSC alert is now credited to Cyber Daily. Correction (26 Oct 2026): the mistyped number is no longer written out, so the page no longer links it. Correction (26 Oct 2026): removed the 9.3 (CVSS 4.0) score and vector, which this card credited to the CVE record but which no source Cyberstack can read gives independently. cPanel's post of 10 May 2026 says the flaw affects every version of cPanel & WHM after 11.40 and WP Squared up to 11.136.1.6, and that CISA added it to its Known Exploited Vulnerabilities catalog on 1 May 2026. (source: cPanel blog — CVE-2026-41940: Response, Actions and Next Steps)
On 1 May 2026 ASD's ACSC, with CISA, NSA, and the other Five Eyes cyber centres, published guidance on LLM-based agentic AI. The agencies say agents that plan and act are a different risk than a chatbot. Adopt incrementally, keep them on low-risk tasks, enforce least privilege, and require a human for high-impact actions. Treat this inside existing cyber programmes, not as a side hobby.
Tenable's advisory says Langflow's POST /api/v2/files endpoint does not sanitise multipart filenames, allowing a logged-in attacker to use path traversal to write files outside the upload directory. The CNA rates it 8.8 (CVSS 3.1). Exploit-DB published a working exploit on 31 August for Langflow 1.8.4 and earlier that uses the default auto-login path, writes a cron file and reaches remote code execution; BleepingComputer reported on 10 June 2026 that attackers were exploiting the flaw to write files on exposed servers; it is not on CISA's KEV catalog as of 24 October 2026. Upgrade to Langflow 1.9.0 or later. Disabling auto-login and restricting network access reduce exposure but do not fix the underlying arbitrary file write.
ASD's ACSC, with Five Eyes partners, published mitigations for ongoing exploitation of Cisco SD-WAN, including CVE-2026-20127, CVE-2026-20128 and CVE-2026-20122. Patch, hunt, and follow Cisco's hardening guidance.
