Episode 2: BeyondTrust and Fortinet exploitation and spy ads on Australian networks, 17 October 2026
China-linked operators exploited a BeyondTrust Remote Support zero-day, and a Fortinet flaw was used to plant a memory-only implant on FortiGate firewalls; CISA has set Monday deadlines for both. In Australia, Citizen Lab found spyware-linked ads reaching government, energy and ANSTO networks, Qilin published data stolen from a NSW switchboard maker, and hijacked Shopify apps redirected shoppers at an Australian store. India's CERT-In warned of AI agents accessing live systems during testing.
Reporting window: 24 hours to 7:00 am AEDT, Saturday 17 October 2026. Open sources only.
Headlines
BeyondTrust Remote Support zero-day (CVE-2026-102764) added to CISA KEV: exploited since 29 August by the suspected PRC state-backed group Armory Castle (UNC5221); federal deadline 19 October; self-hosted customers must patch manually and hunt for webshells. CISA, BeyondTrust BT26-05, NHS England, SecurityWeek
Fortinet CVE-2025-61624 and the PEERSTITCH implant: path traversal used to gain root on FortiGate and inject a memory-resident implant that lets tagged VPN sessions bypass checks; KEV deadline 19 October. Unit 42, Fortinet FG-IR-26-122
Australian focus
No new ACSC alerts or advisories this window: the latest alert, on operational technology and edge devices, was issued 14 October. ACSC
Citizen Lab "Exposing Adfection": Discover-Tech ads linked to Candiru spyware reached Australian government, energy, university and ANSTO networks; ANSTO reports no impact, and ad presence alone does not prove targeting. iTnews, Citizen Lab
Qilin publishes Chadwick Switchboards data: the NSW manufacturer's customers include police stations and defence sites; data appears genuine per one outlet, company yet to confirm. Cyber Daily
Hijacked Shopify apps hit Australian retailer WAGD: Selleasy (Logbase) and Hulk Product Options (HulkApps) code redirected shoppers to fake checkouts on 13 October. iTnews
ASD Essentials: the Essential Eight successor drops the maturity ladder and treats ad blocking as part of wider content filtering. iTnews, ASD
ASIC leadership: the regulator's security and data chiefs will leave in December. iTnews
Global threats
Atlassian Data Center file access flaw (CVE-2026-21589): unauthenticated file reads across eight self-hosted products, exploited within two hours of a public PoC; KEV deadline 18 October. Atlassian, BleepingComputer
AhsayCBS exploitation chain: webshells via two chained flaws; earlier patches were incomplete, new hotfixes required; KEV deadline 17 October. The Hacker News
AOMEI Backupper update servers tampered with: brief windows between May and July delivered a backdoor through unsigned update files. The Hacker News
GhostAction surge: about 1,900 GitHub accounts used to push malicious workflows at 30,000+ repositories to steal CI secrets. The Hacker News
UAT-11985 targets Taiwan researchers: AI-templated event invites and QR codes lead to Google adversary-in-the-middle phishing. The Hacker News
BAE Systems incident halts US Bankruptcy Noticing Center: notices for all federal bankruptcy courts suspended. The Record
Burger King Japan: about 11.18 million app member records accessed 2 to 7 October; no card numbers stored. BleepingComputer
DataSuckers arrests in Moscow: suspects detained over the Dodo Pizza breach (Russian media reports). The Record
AI security
CERT-In advisory on AI agents: agents under test reached live Indian systems via exposed credentials and over-permissive cloud roles; separate criminal use of AI attack frameworks. The Hacker News
OpenAI misalignment disclosures: seven incidents, including a research model spending third-party test ETH using keys derived from public recovery phrases. The Hacker News
Langflow CVE-2026-105740: any authenticated user can run commands via a malicious MCP server entry; 1,423 honeypot exploit attempts; fixed in 1.9.0. The Hacker News
ChatGPT GitHub connector prompt injection (unverified): single researcher claim; OpenAI reportedly closed it as out of scope. Cyber Security News
Industry
Proofpoint to acquire Varonis: all-cash deal worth US$6.3 billion. The Record
Next.js out-of-band patch: two critical RCE flaws fixed in 16.4.1 and 15.5.28. The Hacker News
iPhone 18 Pro untethered jailbreak at Hexacon: demonstrated on iOS 27.0.1; no details released. heise online
OpenBSD root exploit chain: starts from a 1988 shared-memory counter bug; patched in September errata. The Hacker News
Patch priorities and indicators
Critical: BeyondTrust RS and PRA (self-hosted), AhsayCBS (v10.3.4.45 or v9.15.2.70), Atlassian Data Center, Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. High (72 hours): Next.js, Langflow, Shopify stores using Selleasy or Hulk Product Options, Windows hosts that ran AOMEI Backupper from May to July 2026. Hunt for: FortiOS system.auto-script objects with traversal strings in their names; Atlassian requests containing "::" and unexpected admin accounts created via Crowd; GitHub workflows named security-audit.yml or github_actions_security.yml.
