Publications

Greetings, We are excited to release our latest episode of the Share Today, Save Tomorrow podcast, Episode 46: Jess Dodson on Security, Strategy & Sci-Fi. Our General Manager, Ivano Bongiovanni, sits down with Jess Dodson, Cloud Solution Architect at Microsoft, and a long-time friend of AUSCERT. Jess shares her unconventional journey from sysadmin to cyber security leader, exploring the importance of mastering the basics, the role of communication, and challenges for SMBs and government. She also unpacks AI’s impact on data protection, the Essential Eight (with a sci-fi twist), and why cyber security should be seen as business transformation. This episode is sure to educate and entertain, and it’s available now on Spotify, Apple Podcasts, and YouTube! This October is Cyber Awareness Month 2025, with the theme, Building our cyber safe culture, reminding us to make cyber safe practices part of our everyday lives. This month encourages us to not only strengthen our own habits but also help friends and family build their confidence in cyber security. From spotting phishing attempts to using stronger passwords and enabling multi-factor authentication, small steps can go a long way in protecting the people around you. By sharing your knowledge, you can help extend a culture of cyber safety beyond the workplace and into the community. The ASD has developed a wide range of resources to support Cyber Awareness Month, including practical guides, tips, and shareable tools to help you and your loved ones stay secure online. CISA warns of critical Linux Sudo flaw exploited in attacks Date: 2025-09-30 Author: Bleeping Computer [AUSCERT has published bulletins for Sudo security updates] Hackers are actively exploiting a critical vulnerability (CVE-2025-32463) in the sudo package that enables the execution of commands with root-level privileges on Linux operating systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, describing it as “an inclusion of functionality from untrusted control sphere.” 50K Cisco firewalls remain vulnerable to advanced attacks Date: 2025-09-30 Author: The Register Nearly 50,000 Cisco ASA/FTD instances vulnerable to two bugs that are actively being exploited by "advanced" attackers remain exposed to the internet, according to Shadowserver data. The internet monitoring outfit said that as of Monday, the internet-facing Cisco firewalls are potentially exploitable, with the vast majority of those – more than 19,000 – located in the US. How to Use a Password Manager to Share Your Logins After You Die Date: 2025-09-29 Author: WIRED It’s not fun to talk about, but there’s only one thing certain in life. You need to have a plan for your digital legacy, just like you make a plan for your physical assets; otherwise, your accounts, services, and logins will rot away in a data center before they’re inevitably erased by a data retention policy. Some services recognize how important digital legacy is. Apple and Facebook have legacy contacts that can gain access to your accounts, and the American Bar Association is still grappling with the legalities of accessing online accounts when someone passes away. Most online services don't. Apple Patches Single Vulnerability CVE-2025-43400 Date: 2025-09-29 Author: SANS ISC [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.6939, https://portal.auscert.org.au/bulletins/ESB-2025.6938, https://portal.auscert.org.au/bulletins/ESB-2025.6937, https://portal.auscert.org.au/bulletins/ESB-2025.6936, https://portal.auscert.org.au/bulletins/ESB-2025.6935, https://portal.auscert.org.au/bulletins/ESB-2025.6934] It is typical for Apple to release a ".0.1" update soon after releasing a major new operating system. These updates typically fix various functional issues, but this time, they also fix a security vulnerability. The security vulnerability not only affects the "26" releases of iOS and macOS, but also older versions. Apple released fixes for iOS 18 and 26, as well as for macOS back to Sonoma (14). Apple also released updates for WatchOS and tvOS, but these updates do not address any security issues. For visionOS, updates were only released for visionOS 26. Hackers Actively Scanning to Exploit Palo Alto Networks PAN-OS Global Protect Vulnerability Date: 2025-09-30 Author: Cyber Security News Security researchers are observing a significant increase in internet-wide scans targeting the critical PAN-OS GlobalProtect vulnerability (CVE-2024-3400). Exploit attempts have surged as attackers seek to leverage an arbitrary file creation flaw to achieve OS command injection and ultimately full root code execution on vulnerable firewalls. Since late September 2025, honeypots deployed globally have logged thousands of TCP connections probing PAN-OS SSL VPN portals. ESB-2025.7032 – chromium Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. ESB-2025.7020 – Linux kernel (Oracle) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. ESB-2025.7007 – Splunk Enterprise Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.0.1, 9.4.4, 9.3.6, 9.2.8, and higher. ESB-2025.6759.2 – Cisco IOS and IOS XE Software An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 46: Jess Dodson on Security, Strategy & Sci-Fi In this episode of Share Today, Save Tomorrow, our General Manager Ivano Bongiovanni sits down with Jess Dodson, Cloud Solution Architect at Microsoft and long-time friend of AUSCERT. With her signature blend of technical insight and infectious enthusiasm, Jess shares her unconventional journey into cyber security – from sysadmin roots to strategic security leadership. The conversation dives into the importance of mastering the basics, the evolving role of communication in cyber strategy, and the challenges facing SMBs and government sectors. Jess also offers her take on AI’s impact on data protection, the Essential Eight (with a sci-fi twist), and why reframing cyber security as business transformation is key to resilience. Listen now and join the conversation on how we can build a more secure, inclusive, and forward-thinking cyber industry. This episode was hosted by Ivano Bongiovanni. The AUSCERT podcast can also be found on Spotify, Apple Podcasts, and our YouTube channel!

Greetings, Cisco is warning customers to urgently patch two critical zero-day vulnerabilities affecting the VPN web server of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software. Both flaws, which the company confirmed have been exploited in the wild, pose serious risks to affected networks. The first, tracked as CVE-2025-20333 with a CVSS score of 9.9, could allow an attacker with valid VPN credentials to execute arbitrary code as root by sending crafted HTTP requests. The second, CVE-2025-20362, with a CVSS score of 6.5, could enable unauthenticated attackers to access restricted endpoints without authentication. Cisco noted that attackers appear to be chaining the vulnerabilities to bypass authentication and run malicious code on vulnerable devices. The company credited international partners including the ACSC, CISA, and the UK’s NCSC, for assisting with the investigation. In response, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive ED 25-03, requiring federal agencies to immediately identify, analyse, and mitigate potential compromises. Both flaws have also been added to CISA’s Known Exploited Vulnerabilities catalogue, with a 24-hour deadline for applying mitigations. CISA warned that the campaign, linked to the advanced threat cluster ArcaneDoor, is ongoing and widespread. Attackers are said to be leveraging these zero-day flaws to gain unauthenticated remote code execution on ASA devices, even manipulating read-only memory to persist through reboots and upgrades. Customers are strongly urged to apply patches without delay to defend against ongoing exploitation. Fortra warns of max severity flaw in GoAnywhere MFT’s License Servlet Date: 2025-09-19 Author: Bleeping Computer Fortra has released security updates to patch a maximum severity vulnerability in GoAnywhere MFT's License Servlet that can be exploited in command injection attacks. GoAnywhere MFT is a web-based managed file transfer tool that helps organizations securely transfer files and maintain audit logs of who accesses the shared files. Tracked as CVE-2025-10035, this security flaw is caused by a deserialization of untrusted data weakness and can be exploited remotely in low-complexity attacks that don't require user interaction. While Fortra stated that the vulnerability was discovered over the weekend, it didn't specify who reported it or whether the flaw has been exploited in attacks. Cisco warns of IOS zero-day vulnerability exploited in attacks Date: 2025-09-24 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.6759/] Cisco has released security updates to address a high-severity zero-day vulnerability in Cisco IOS and IOS XE Software that is currently being exploited in attacks. Tracked as CVE-2025-20352, the flaw is due to a stack-based buffer overflow weakness found in the Simple Network Management Protocol (SNMP) subsystem of vulnerable IOS and IOS XE software, impacting all devices with SNMP enabled. Authenticated, remote attackers with low privileges can exploit this vulnerability to trigger denial-of-service (DoS) conditions on unpatched devices. High-privileged attackers, on the other hand, can gain complete control of systems running vulnerable Cisco IOS XE software by executing code as the root user. Microsoft Entra ID flaw allowed hijacking any company's tenant Date: 2025-09-21 Author: Bleeping Computer A critical combination of legacy components could have allowed complete access to the Microsoft Entra ID tenant of every company in the world. The fatal mix included undocumented tokens called “actor tokens” and a vulnerability in the Azure AD Graph API (CVE-2025-55241) that allowed the tokens to work with any organization’s Entra ID environment. SolarWinds releases third patch to fix Web Help Desk RCE bug Date: 2025-09-23 Author: Bleeping Computer [AUSCERT has contacted potentially affected members about this vulnerability where possible] SolarWinds has released a hotfix for a critical a critical vulnerability in Web Help Desk that allows remote code execution (RCE) without authentication. Tracked as CVE-2025-26399, the security issue is the company's third attempt to address an older flaw identified as CVE-2024-28986 that impacted Web Help Desk (WHD) 12.8.3 and all previous versions. SolarWinds WHD is a help desk and ticketing suite used by medium-to-large organizations for IT support request tracking, workflow automation, asset management, and compliance assurance. Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials Date: 2025-09-24 Author: The Hacker News Cloud security company Wiz has revealed that it uncovered in-the-wild exploitation of a security flaw in a Linux utility called Pandoc as part of attacks designed to infiltrate Amazon Web Services (AWS) Instance Metadata Service (IMDS). The vulnerability in question is CVE-2025-51591 (CVSS score: 6.5), which refers to a case of Server-Side Request Forgery (SSRF) that allows attackers to compromise a target system by injecting a specially crafted HTML iframe element. ESB-2025.6802 – Red Hat JBoss Enterprise Application Platform 7: CVSS (Max): 8.8 Redhat has released important patches for Red Hat JBoss EAP 7.1 on RHEL 7 to fix multiple vulnerabilities, and it has been added to the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog. ESB-2025.6809 – Tenable Security Center: CVSS (Max): 8.8 Tenable addresses PostgreSQL vulnerabilities in Security Center 6.5.1 and 6.6.0. The patch update mitigates risks of data exposure, denial of service, and other security weaknesses in the affected versions. ESB-2025.6814 – Cisco Products: CVSS (Max): 9.9 Cisco has confirmed two critical zero-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) are actively being exploited in its ASA/FTD VPN web server appliances. ESB-2025.6820 – GitLab Community Edition and Enterprise Edition: CVSS (Max): 7.5* GitLab issued patch releases 18.4.1, 18.3.3, and 18.2.7, bringing a number of security and bug fixes and urging all self-managed installations to upgrade immediately Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, This week, we have released an exciting new episode of the Share Today, Save Tomorrow podcast, Episode 45: Phishing, Passion & Progress: A Conversation with Shane Lim. Our host Bek Cheb sits down with Shane, one of our valued analysts at AUSCERT, for a deep dive into his journey from IT generalist to cyber security specialist. This episode also features an insider look at one of AUSCERT’s most vital member services, Phishing Takedowns. Shane breaks down how the process works, why phishing remains a persistent threat, and the technical and human challenges involved in taking malicious sites offline. This is an episode you won’t want to miss, and it’s available on Spotify, Apple Podcasts, and Soundcloud now. SonicWall has warned customers to reset credentials following a breach that exposed firewall configuration backup files linked to MySonicWall accounts. Attackers exploited the company’s cloud backup API service using brute-force methods, affecting fewer than 5% of its firewall install base. While the files contained encrypted passwords, SonicWall cautioned that they also held details that could make it easier for attackers to exploit impacted devices. The company has since blocked attacker access, launched an investigation with law enforcement and cyber security partners, and published guidance for administrators. Recommendations include restricting WAN access, resetting all credentials, and updating keys and tokens across related services. SonicWall emphasised this was not a ransomware event but a series of targeted brute-force attacks, adding there is no evidence that the files have been leaked online. Apple backports zero-day patches to older iPhones and iPads Date: 2025-09-16 Author: Bleeping Computer [See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2025.6540]​ Apple has released security updates to backport patches released last month to older iPhones and iPads, addressing a zero-day bug that was exploited in "extremely sophisticated" attacks. This security flaw is the same one Apple has patched for devices running iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, and macOS (Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8) on August 20. Tracked as CVE-2025-43300, this vulnerability was discovered by Apple security researchers and is caused by an out-of-bounds write weakness in the Image I/O framework, which enables apps to read and write image file formats. From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques Date: 2025-09-17 Author: Bleeping Computer During the past fifteen business days, Huntress analysts have observed increased threat activity involving several notable techniques. One case involved a malicious AnyDesk installer, which initially mimicked a standard ClickFix attack through a fake Cloudflare verification page but then utilized Windows File Explorer and an MSI package masked as a PDF to deploy MetaStealer malware. FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data Date: 2025-09-14 Author: Bleeping Computer The FBI has issued a FLASH alert warning that two threat clusters, tracked as UNC6040 and UNC6395, are compromising organizations’ Salesforce environments to steal data and extort victims. "The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate Indicators of Compromise (IOCs) associated with recent malicious cyber activities by cyber criminal groups UNC6040 and UNC6395, responsible for a rising number of data theft and extortion intrusions," reads the FBI's FLASH advisory. Threat Actors Leverage Several RMM Tools in Phishing Attack to Maintain Remote Access Date: 2025-09-15 Author: Cyber Security News Cybercriminals are increasingly exploiting legitimate remote monitoring and management (RMM) tools to establish persistent access to compromised systems through sophisticated phishing campaigns. Joint research conducted by Red Canary Intelligence and Zscaler threat hunters has identified multiple malicious campaigns utilizing ITarian (also known as Comodo), PDQ, SimpleHelp, and Atera RMM solutions as attack vectors. HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks Date: 2025-09-15 Author: The Hacker News Chinese-speaking users are the target of a search engine optimization (SEO) poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet FortiGuard Labs researcher Pei Han Liao said. "By using convincing language and small character substitutions, they tricked victims into visiting spoofed pages and downloading malware." ESB-2025.6633 – Linux kernel: CVSS (Max): 9.1* Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. ESB-2025.6569 – pcp: CVSS (Max): 8.8 This update for pcp fixes the following issues, exposure of the redis server backend allows remote command execution via pmproxy. ESB-2025.6567 – Mozilla Firefox: CVSS (Max): 8.8* Memory safety bugs are present. Some of these bugs showed evidence of memory corruption and it's presumed that with enough effort some of these could have been exploited to run arbitrary code. ESB-2025.6636 – Google Chrome: CVSS (Max): None Google released security updates for the Chrome web browser, to addresses four vulnerabilities, including one that it said has been exploited in the wild. The vulnerability has been described as a type confusion issue in the V8 JavaScript and WebAssembly engine. ESB-2025.6555 – Delta Electronics DIALink: CVSS (Max): 10.0 Delta Electronics DIALink has an Improper Limitation of a Pathname to a Restricted Directory vulnerability which could allow an attacker to bypass authentication. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 45: Phishing, Passion & Progress: A Conversation with Shane Lim In this episode of the AUSCERT podcast, host Bek Cheb sits down with Shane Lim, Senior Analyst at AUSCERT, for a deep dive into his journey from IT generalist to cyber security specialist. Shane shares how a cyber champions program sparked his passion for the field, and how he quickly rose through the ranks at AUSCERT thanks to his curiosity, leadership, and collaborative spirit. Get an insider’s look at one of AUSCERT’s most vital member services, Phishing Takedowns. Shane breaks down how the process works, why phishing remains a persistent threat, and the technical and human challenges involved in taking malicious sites offline. From impersonation tactics to CAPTCHA barriers, Shane offers practical insights into how AUSCERT protects member brands and data. Whether you’re curious about career paths in cyber or want to understand the real-world impact of phishing protection, this episode is packed with relatable stories, expert knowledge, and even a few surprises. Tune in now to hear how passion, teamwork, and a love of cars intersect in the world of cyber security.   This episode was hosted by Bek Cheb The AUSCERT podcast can also be found on Spotify, Apple Podcasts and Google Podcasts

Greetings, This week, a major phishing campaign has led to a large supply chain compromise, targeting the npm (node package manager) ecosystem. Npm is a critical registry hosting over two million reusable code packages used worldwide by developers. The incident began when attackers registered a lookalike domain, npmjs.help, and sent out emails designed to mimic official npm security communications. These emails urged developers to update their two-factor authentication (2FA) credentials. At least one prominent developer fell victim to the phishing attempt, allowing attackers to take control of his account. With access secured, the attackers injected malicious code into at least 18 widely used npm packages, collectively downloaded 2.7 billion times per week. According to security vendor Aikido, the injected code was designed to run on client websites, silently intercepting cryptocurrency and web3 activity. The code manipulated wallet interactions and rewrote payment destinations so that funds and approvals were redirected to attacker-controlled accounts. The attack was particularly insidious because it operated without obvious signs, making detection difficult for end users. The compromise has since been identified and cleanup efforts are underway, though researchers warn that additional developers are being targeted by the same unknown threat actor. The scale of the incident has raised significant concerns across the development community, given how widely npm packages are integrated into both small projects and large-scale enterprise systems. Critical SAP S/4HANA vulnerability now exploited in attacks Date: 2025-09-05 Author: Bleeping Computer A critical SAP S/4HANA code injection vulnerability is being leveraged in attacks in the wild to breach exposed servers, researchers warn. The flaw, tracked as CVE-2025-42957, is an ABAP code injection problem in an RFC-exposed function module of SAP S/4HANA, allowing low-privileged authentication users to inject arbitrary code, bypass authorization, and fully take over SAP. Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts Date: 2025-09-10 Author: The Hacker News [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.6320/] Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 (aka SessionReaper), carries a CVSS score of 9.1 out of a maximum of 10.0. It has been described as an improper input validation flaw. Adobe said it's not aware of any exploits in the wild. More npm packages poisoned, but would-be thieves get little Date: 2025-09-09 Author: The Register During the two-hour window on Monday in which hijacked npm versions were available for download, malware-laced packages reached one in 10 cloud environments, according to Wiz researchers. But crypto-craving crims did little more than annoy defenders. Microsoft Patch Tuesday addresses 81 vulnerabilities, none actively exploited Date: 2025-09-09 Author: CyberScoop [AUSCERT has published security bulletins for these Microsoft updates] The most severe defect disclosed this month — CVE-2025-55232 — is a deserialization of untrusted data vulnerability affecting Microsoft High Performance Compute Pack with a CVSS rating of 9.8. Microsoft said exploitation is less likely, but researchers warned organizations to prioritize patching. Fortinet, Ivanti, Nvidia Release Security Updates Date: 2025-09-10 Author: Security Week [AUSCERT has published security bulletins for these Fortinet updates] Fortinet, Ivanti, and Nvidia on Tuesday announced security updates that address over a dozen high- and medium-severity vulnerabilities across their product portfolios. Ivanti resolved two high-severity insufficient filename validation issues in Endpoint Manager (EPM) that could be exploited remotely, without authentication, to execute arbitrary code. The exploitation of both defects, however, require user interaction. ASB-2025.0158 – Microsoft Azure: CVSS (Max): 9.8 Microsoft has released its monthly security patch update for the month of September 2025, which resolves 3 important vulnerabilities with Azure Connected Machine Agent and HPC Pack 2019. Microsoft recommends updating the software to the latest available version available on the Microsoft Update Catalog. ESB-2025.6253 – IBM MQ container software: CVSS (Max): 9.8 Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images, such as memory corruption issues, crashes and denial of service. IBM strongly recommends applying the latest container images. ESB-2025.6435 – kernel: CVSS (Max): 7.8 An update for kernel is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, resolving various security issues and exploited vulnerability as identified on the CISA KEV list. ESB-2025.6441 – Daikin Security Gateway: CVSS (Max): 9.8 A weak password recovery mechanism for forgotten passwords has been identified in this product. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the system. Daikin has reported they will not fix this vulnerability and will respond directly to user inquiries. ESB-2025.6437 – imagemagick: CVSS (Max): 9.8 Multiple memory corruption vulnerbilities were discovered in imagemagick, a software suit used for editing and manipulating digital images, which could lead to information leak, denial of service, and potentially arbitrary code execution. It is recommended that you upgrade your imagemagick packages. Stay safe, stay patched and have a good weekend! The AUSCERT team

Greetings, We’re excited to release a brand-new episode of the Share Today, Save Tomorrow podcast, Episode 44: Security2Cure – Where Cyber Meets Health Planning. In this powerful episode, host Bek Cheb speaks with Zane Jarvis, founder of the charity Security2Cure, an initiative born from personal tragedy and driven by a mission to raise awareness around cancer, health planning, and digital preparedness. Zane shares his deeply personal story and explains how core cyber security principles have inspired a unique framework for personal wellbeing and future planning. With Security2Cure’s upcoming Brisbane conference on the 10th October, this episode offers the perfect opportunity to explore the charity’s mission and learn more about their work. This is an episode you won’t want to miss, and it’s available on Spotify, Apple Podcasts, and YouTube now. This week, a widespread supply chain attack linked to Salesloft Drift has impacted hundreds of organisations, including Cloudflare, Zscaler, Palo Alto Networks, PagerDuty, and SpyCloud. While Salesloft initially claimed exposure was limited to Salesforce-integrated customers, Google’s Threat Intelligence Group and Mandiant have warned that any platform integrated with Drift may be compromised. The attack, attributed to threat group UNC6395, led to the exposure of sensitive customer data such as business emails, phone numbers, support case details, and, in some cases, credentials. While no core products or infrastructure were directly breached, many companies are rotating tokens, tightening security, and investigating potential impacts. Salesloft announced that Drift will be taken offline to strengthen security and conduct a full review. The incident highlights the growing risks of third-party integrations, with more than 700 organizations potentially affected. Google warns Salesloft breach impacted some Workspace accounts Date: 2025-08-28 Author: Bleeping Computer Google now reports that the Salesloft Drift breach is larger than initially thought, warning that attackers also used stolen OAuth tokens to access a small number of Google Workspace email accounts in addition to stealing data from Salesforce instances. "Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations,' warns Google. "We now advise all Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised." NIST Enhances Security Controls for Improved Patching Date: 2025-09-02 Author: Dark Reading Addressing the ongoing patch management problem requires more finessing, especially to protect the software supply chain. The US National Institute of Standards and Technology (NIST) revised its Security and Privacy Control catalog to help vendors and organizations improve software update and patch release protocols. Originally published in 2020, the Security and Privacy Control catalog details security and privacy safeguards to help organizations mitigate cyber-risks. Federal information systems are required to implement the controls, but the catalog is intended for the private and public sectors. It covers access, authentication, incident response, and supply chain risk management. WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS Devices Date: 2025-08-30 Author: The Hacker News WhatsApp has addressed a security vulnerability in its messaging apps for Apple iOS and macOS that it said may have been exploited in the wild in conjunction with a recently disclosed Apple flaw in targeted zero-day attacks. The vulnerability, CVE-2025-55177 (CVSS score: 8.0 [CISA-ADP]/5.4 [Facebook]), relates to a case of insufficient authorization of linked device synchronization messages. Internal researchers on the WhatsApp Security Team have been credited with discovering and rerating the bug. The Meta-owned company said the issue "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device." Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentication Date: 2025-08-29 Author: The Hacker News Amazon on Friday said it flagged and disrupted what it described as an opportunistic watering hole campaign orchestrated by the Russia-linked APT29 actors as part of their intelligence gathering efforts. The campaign used "compromised websites to redirect visitors to malicious infrastructure designed to trick users into authorizing attacker-controlled devices through Microsoft's device code authentication flow," Amazon's Chief Information Security Officer CJ Moses said. Melbourne dev finds gift card PINs can be brute-forced Date: 2025-09-03 Author: itnews Gift cards sold in Australian supermarkets can have their PINs easily guessed, thanks to a vulnerability on the issuer's website, opening them up to redemption by thieves who only need to know the card number to access the stored funds. The vulnerability was discovered by Melbourne developer Simon Dean who bought two gift cards worth $500 each, which he intended to use to purchase a laptop at JB Hi-Fi with. After buying the cards, Dean ran into trouble redeeming them as the cards had had the last four digits scratched off them. ESB-2025.6241 – Ruby It was discovered that Ruby incorrectly handled certain IO stream methods. A remote attacker could use this issue to cause Ruby to crash, resulting in a denial of service, or possibly obtain sensitive information. ASB-2025.0156.2 – Salesloft Drift Several major firms, including ZScaler, Cloudflare, and Palo Alto Networks, confirmed breaches of their Salesforce databases. The incidents stem from a data theft campaign exploiting the third-party Salesloft Drift integration with Salesforce. ESB-2025.6176 – Google Android The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. The most severe of these issues is a critical security vulnerability in the System component that could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. ESB-2025.6205 – Cisco Products A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 44: Security2Cure: Where Cyber Meets Health Planning In this powerful episode of the AUSCERT podcast, host Bek Cheb speaks with Zane, founder of Security2Cure, a charity born from personal tragedy and driven by a mission to raise awareness around cancer and health planning. Zane shares how cyber security principles like plan, prevent, detect, and respond have inspired a framework for personal wellbeing, and how the cyber security community has rallied behind his cause. From digital estate planning to emotional support, this episode explores the human side of tech and the importance of preparing for life’s unexpected challenges. This episode was hosted by Bek ChebThe AUSCERT podcast can also be found on Spotify, Apple Podcasts and Google Podcasts.Also now available to watch on our Youtube Channel! 

Greetings, The team are already hard at work planning another amazing AUSCERT conference, and we’re excited to share these key dates with you! AUSCERT2026 will run from 19–22 May at The Star, Gold Coast. Tutorials will take place on 19 and 20 May, followed by the main conference on 21 and 22 May. Don’t miss the Welcome Reception at 5:00 PM on 20 May, or the Gala Dinner on 21 May. Stay tuned for more details, including the Call for Tutorials in October and the Call for Presentations in November. We can’t wait to see you there! This week marked Scams Awareness Week, a nationwide campaign aimed at helping Australians stay safe online. This year’s theme, “Stop. Check. Protect.” encourages us all to pause before clicking, verify information, and take proactive steps to safeguard our personal and financial details. The Scamwatch “Scam Statistics” page is a standout resource, providing an interactive dashboard that allows you to explore real-time data on scam reports. Every report feeds into a national intelligence network that contributes to early detection and disruption efforts. You can see which scams are growing, which methods are being used most effectively, and where education and awareness are making an impact. Docker Fixes CVE-2025-9074, Critical Container Escape Vulnerability With CVSS Score 9.3 Date: 2025-08-25 Author: The Hacker News Docker has released fixes to address a critical security flaw affecting the Docker Desktop app for Windows and macOS that could potentially allow an attacker to break out of the confines of a container. The vulnerability, tracked as CVE-2025-9074, carries a CVSS score of 9.3 out of 10.0. It has been addressed in version 4.44.3. Over 28,000 Citrix instances remain exposed to critical RCE flaw CVE-2025-7775 Date: 2025-08-27 Author: Security Affairs [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.5974] Experts at the Shadowserver Foundation warn that more than 28,200 Citrix instances are vulnerable to the vulnerability CVE-2025-7775, which is under active exploitation. CVE-2025-7775 (CVSS score: 9.2) is a memory overflow vulnerability leading to Remote Code Execution and/or Denial-of-Service. This week, Citrix addressed three security flaws (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424) in NetScaler ADC and NetScaler Gateway, including one (CVE-2025-7775) that it said has been actively exploited in the wild. CISA warns of actively exploited Git code execution flaw Date: 2025-08-26 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2025.5077] The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of hackers exploiting an arbitrary code execution flaw in the Git distributed version control system. The agency has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and has set the patch deadline for federal agencies to September 15th. Git version control system allows software development teams to track codebase changes over time. The library is the backbone of modern software collaboration, serving as the basis for platforms such as GitHub, GitLab, and Bitbucket. High-severity vulnerability in Passwordstate credential manager. Patch now. Date: 2025-08-29 Author: Ars Technica The maker of Passwordstate, an enterprise-grade password manager for storing companies’ most privileged credentials, is urging them to promptly install an update fixing a high-severity vulnerability that hackers can exploit to gain administrative access to their vaults. The authentication bypass allows hackers to create a URL that accesses an emergency access page for Passwordstate. From there, an attacker could pivot to the administrative section of the password manager. A CVE identifier isn’t yet available. A hacker used AI to automate an 'unprecedented' cybercrime spree, Anthropic says Date: 2025-08-27 Author: NBC News A hacker has exploited a leading artificial intelligence chatbot to conduct the most comprehensive and lucrative AI cybercriminal operation known to date, using it to do everything from find targets to write ransom notes. In a report published Tuesday, Anthropic, the company behind the popular Claude chatbot, said that an unnamed hacker “used AI to what we believe is an unprecedented degree” to research, hack and extort at least 17 companies. ESB-2025.5938 – Atlassian Products: CVSS (Max): 9.4 Atlassian monthly bulletin addresses 14 high-severity and 1 critical-severity vulnerabilities. Users are advised to upgrade their Server/Data Center instances to the latest versions. ESB-2025.5966 – IBM Security QRadar SIEM: CVSS (Max): 9.8 IBM has addressed vulnerable open-source components such as Linux kernel and Python libraries in QRadar SIEM which may be exploitable via automated scanning tools. ESB-2025.5974 – Citrix Products: CVSS (Max): 9.2 Citrix has released urgent patches addressing three serious vulnerabilities in NetScaler ADC and NetScaler Gateway—including a critical zero-day memory-overflow flaw actively exploited in the wild, and additional memory-overflow & management-interface access control issues. ESB-2025.6029 – GitLab Community Edition and Enterprise Edition: CVSS (Max): 6.5 GitLab delivered patch releases 18.3.1, 18.2.5, and 18.1.5 for both CE and EE, addressing multiple security and bug fixes, and strongly urges all self-managed users to upgrade immediately. Stay safe, stay patched and have a good weekend! The AUSCERT team

We’re excited to announce that AUSCERT training participants will now receive digital badges via Credly upon completing their course. These verified badges make demonstrating your achievements even easier, allowing you to share your accreditation across various platforms, including LinkedIn, resumes, and professional profiles. Upon completing your AUSCERT training course, you will receive an email directly from Credly with instructions on how to claim your digital badge. By sharing your Credly badge on LinkedIn and other professional platforms, you can highlight your cyber security skills and training achievements, demonstrate your commitment to ongoing professional development, and differentiate yourself among peers and potential employers in the industry. Additionally, your badge includes a direct link to course sign-ups, making it easier for others to explore and enrol in the same training. We encourage all participants to claim and share their Credly badges to inspire others in pursuing professional development in cyber security. For more details on accessing and using your badge, please refer to Credly’s help page.

Greetings, We are excited to announce the release of a new episode of Share Today, Save Tomorrow – Episode 43: Behind the Code: Josh Hopkins on Building, Leading, and Leveling Up AUSCERT. In this episode, host Bek Cheb sits down with Josh, our Team Leader of Development, for an open and insightful chat about life behind the screens in cyber defence. From his unexpected journey into cyber security to leading a dynamic development team, Josh reflects on the twists and turns of his career, describes the sometimes-unpredictable nature of a typical working day, and how experimentation, collaboration, and a passion for building innovation within the team makes working at AUSCERT so unique. This episode is available on Spotify and Apple Podcasts. This week, iiNet, owned by TPG Telecom, has confirmed that an unknown third party gained unauthorised access to iiNet’s order management system on Saturday, August 16, 2025. The breach led to the extraction of approximately 280,000 email addresses, along with 10,000 usernames, phone numbers, and nearly 1,700 modem setup passwords, though no financial or identity documents were compromised. TPG responded swiftly by isolating the breach, engaging external cyber security experts, and initiating its incident response plan immediately upon discovery. Customers are being contacted directly and urged to remain vigilant against phishing attempts. Apple fixes new zero-day flaw exploited in targeted attacks Date: 2025-08-20 Author: Bleeping Computer [AUSCERT has published security bulletins for these Apple updates] Apple has released emergency updates to patch another zero-day vulnerability that was exploited in an "extremely sophisticated attack." Tracked as CVE-2025-43300, this security flaw is caused by an out-of-bounds write weakness discovered by Apple security researchers in the Image I/O framework, which enables applications to read and write most image file formats. Cisco Patches Critical Vulnerability in Firewall Management Platform Date: 2025-08-15 Author: Security Week [AUSCERT has published security bulletins for these Cisco updates] Cisco has published more than 20 security advisories as part of its August 2025 bundled publication for Secure Firewall Management Center (FMC), Secure Firewall Threat Defense (FTD), and Secure Firewall Adaptive Security Appliance (ASA) products. The most serious vulnerability — based on its severity rating — is CVE-2025-20265, a critical flaw affecting the Secure FMC platform designed for managing and monitoring Cisco FTD appliances and other security solutions. TPG Telecom reveals iiNet order management system breached Date: 2025-08-19 Author: iTnews TPG Telecom has revealed that iiNet’s order management system was breached by an unknown attacker who abused legitimate credentials to gain access. The telco said that it “appears” that a list of email addresses and phone numbers was extracted from the system. The order management system is used to create and track orders for iiNet services. Microsoft: Recent Windows updates may fail to install via WUSA Date: 2025-08-18 Author: Bleeping Computer Microsoft has mitigated a known issue that caused Windows update failures when installing them from a network share using the Windows Update Standalone Installer (WUSA). WUSA is a built-in command-line tool that helps IT admins install and uninstall Microsoft Standalone Update (.msu) files through the Windows Update Agent API to deploy and remove patches, hotfixes, and updates. This known issue affects Windows 11 24H2 and Windows Server 2025 systems on enterprise networks, as WUSA isn't a common method for installing Windows updates on home devices. HR giant Workday discloses data breach after Salesforce attack Date: 2025-08-18 Author: Bleeping Computer Human resources giant Workday has disclosed a data breach after attackers gained access to a third-party customer relationship management (CRM) platform in a recent social engineering attack. As the company revealed in a Friday blog, the attackers gained access to some of the information stored on the compromised CRM systems, adding that no customer tenants were impacted. ESB-2025.5731 – Cisco Secure Firewall Management Center Software: CVSS (Max): 10.0 A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. Cisco has released software updates that address this vulnerability. ESB-2025.5888 – firefox-esr: CVSS (Max): 9.8 Multiple security issues have been found and patched in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape or bypass of the same-origin policy. ESB-2025.5881 – Linux kernel (IoT): CVSS (Max): 9.8* Several security issues were discovered and patched in the Linux kernel. An attacker could possibly use these to compromise the system. ESB-2025.5710 – IBM Security QRadar SIEM: CVSS (Max): 9.4 Vulnerable components in IBM Security QRadar SIEM (e.g., framework libraries) have been identified that may be exploited with automated tools. IBM QRadar Data Synchronization app for IBM QRadar SIEM has addressed the applicable CVEs. ESB-2025.5788 – Apache HTTP Server: CVSS (Max): 9.1 Several security issues were fixed in Apache HTTP Server that potentially allowed remote attackers to perform HTTP response splitting attacks, send outbound proxy requests to an arbitrary url, insert escape characters into log files, bypass access control, denial of service, or perform configuration changes in certain environments. Stay safe, stay patched and have a good weekend! The AUSCERT team

LISTEN HERE: AUSCERT “Share Today, Save Tomorrow” – ep 43: Behind the Code – Josh Hopkins on Building, Leading, and Leveling Up AUSCERT   In this episode Bek Cheb sits down with AUSCERT’s Team Leader of Development, Josh Hopkins, for a candid and insightful conversation. From his journey into cyber security to leading a dynamic dev team, Josh shares how experimentation, collaboration, and a passion for building drive innovation at AUSCERT. Discover the human side of tech leadership, the power of hybrid work, and why documenting everything might just be the secret to success. Whether you’re in cybersecurity or simply curious about what goes on behind the scenes, this episode is packed with inspiration and practical wisdom. This episode was hosted by Bek Cheb The AUSCERT podcast can also be found on Spotify, Apple Podcasts and Google Podcasts