Fortinet shipped critical fixes for FortiOS and four other product lines, found with frontier AI testing, and is withholding the details until 10 November; ASD has issued a critical alert. PHP2Shell is drawing millions of attempts but no confirmed successful compromise, and PHP flagged a narrower unpatched issue. CISA added exploited Arista VeloCloud and Collabora flaws to its catalogue, researchers exposed a ransomware affiliate running AI-executed intrusions, and Proofpoint is buying Varonis for US$6.3 billion.
Reporting window: 24 hours to 7:00 am AEDT, Saturday 24 October 2026. Open sources only.
Australian focus
- ASD critical alert on Fortinet products: FortiOS fixed in 8.0.2, 7.6.8, 7.4.13, 7.2.14; FortiManager and FortiAnalyzer in 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiMail and FortiAuthenticator per the vendor table. Details due 10 November. Not aware of exploitation in Australia. ASD's ACSC, Fortinet, GovCERT.HK
- Australia sanctions North Korean IT worker network: two individuals and two companies; workers using stolen and doctored Australian licences and passports for remote contracts. iTnews
- ABC wipes devices exposed to Adfection spyware ads: no sign of compromise; more than two dozen Australian organisations reportedly in the targeted cluster (moderate confidence). Follow-up to Episode 2. ABC News, Episode 2 notes
- PHP patch window under the Essential Eight: 48 hours for critical internet-facing flaws, now passed for the 22 October releases. efex, ASD's ACSC
- AGL passes 500,000 passkey enrolments: 30.5 per cent adoption. iTnews
Global threat activity
- PHP2Shell: attempts in the millions, no confirmed compromise: Potassium and Mirai botnet payloads failing against ASLR; Sophos retracted a success report; VulnCheck has built an ASLR bypass. Follow-up to Episodes 7 and 8. The Record, SecurityWeek, The Hacker News, Episode 8 notes
- New unpatched PHP issue, CVE-2026-115560: unusual session configuration only; set session.upload_progress.enabled=0. BleepingComputer, The Hacker News
- Arista VeloCloud Orchestrator zero-day, CVE-2026-114625 (CVSS 9.9): read-only users can gain operator privileges; fixed in 5.2.3.18, 6.1.3.10, 6.4.2.12; in CISA KEV, due 26 October. The Hacker News, SecurityWeek, CISA KEV
- Collabora built-in CODE server on Nextcloud, CVE-2026-110447: web shells planted since 10 September; update to 26.4.303 or remove; in CISA KEV, due 26 October. The Hacker News, CISA KEV
- HPE ArubaOS: 72 flaws, eight maximum severity: unauthenticated RCE and auth bypass in AOS-8 and AOS-10; no known exploit. BleepingComputer
- k0t edge-device campaign: FortiGate and GlobalProtect devices, over 70,000 credentials, about 38% of victims in Asia-Pacific; ransomware link inferred (moderate confidence). The Hacker News
- Ruby fixes Onigmo bugs behind GitLab's critical flaws: 4.0.9, 3.4.12, 3.3.13; no fix for 3.2. Follow-up to Episode 8. The Hacker News
- Pillow CVE-2026-112900: crafted EPS filenames can run commands via Ghostscript; fixed in 13.0.0. The Hacker News
- Quest Diagnostics lab system breach: Quanum LSM offline; some patient data believed accessed. The Record, BleepingComputer
- Capcom CAPCOM ID breach: 11.7 million email addresses exposed. BleepingComputer
- BlackX UEFI bootkit attributed to APT41: bypasses Secure Boot where revocations are not applied (vendor attribution). The Hacker News
- Sandworm and UAC-0099 wiper attack in Ukraine; APT28 Hookedge backdoor at NATO defence firms. The Hacker News, SecurityWeek
- 333 hijacked Tor exit relays harvested SSH passwords: since removed. SecurityWeek
AI security
- Phantom: AI-executed, human-approved ransomware intrusions: INC and The Gentlemen affiliate using OpenCode with commercial models; refusals bypassed by posing as red teaming (single vendor report). The Hacker News
- Fortinet withholds details over AI patch diffing. Fortinet
- x402 agent payment SDK flaws: no default spending limit in older clients; fixed in August without an advisory. The Hacker News
- US banks find unsanctioned AI agents in customer accounts: anonymous sources via Axios (moderate confidence). SecurityWeek
- ISO/IEC 27090 published: guidance on AI-specific threats. SecurityWeek
- Microsoft Teams AI phishing detection: from early November. BleepingComputer
Industry and strategic
- Proofpoint to acquire Varonis for US$6.3 billion. The Record
- Windows Server 2016 support ends 12 January 2027. BleepingComputer
- FCC bars devices with Huawei HiSilicon surveillance chips. The Record
- UK proposes 14-year terms for undersea cable sabotage. The Record
Outlook and patch priorities
- Critical (today): Fortinet updates, internet-facing first; PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 plus session.upload_progress.enabled=0; on-premises Arista VCO; Collabora richdocumentscode 26.4.303 or removal.
- High (this week): ArubaOS; Ruby and GitLab; Pillow 13.0.0; replace eMudhra certificates before 27 October; apply Secure Boot revocations.
- Watch: a confirmed PHP2Shell compromise or reliable public exploit; Fortinet patch-diff analysis before 10 November; more VeloCloud and Collabora victims; other Australian organisations in the Adfection cluster.
Indicators
- Phantom operator infrastructure (SOCRadar): 45.227.254[.]43.
- Collabora: unexpected PHP files in the richdocumentscode app folder; requests with $(...) in the proxy.php path.
- PHP2Shell: POST requests carrying PHP_SESSION_UPLOAD_PROGRESS; botnet downloaders spawned by PHP workers.