The Australian Signals Directorate says it cut a criminal's Amadey malware operation off from about 180,000 infected computers and destroyed a stolen 5 TB data haul before it could be sold. CISA has added the PHP2Shell flaws to its Known Exploited Vulnerabilities catalogue, and Microsoft has removed eMudhra root certificates from Windows after weak keys were found. We also cover Tailworm fixes for Tailscale, critical HPE Aruba patches, the University of New Mexico Health attack, and an AI pentesting framework used in a South Korean extortion spree.
Australia
- ASD disrupts an Amadey botnet and destroys stolen data. About 180,000 computers, including in Australia, disconnected from one criminal's controller; 5 TB of stolen business data, including about 4.8 million files from Australians, destroyed before sale. Earlier theft is not undone, so revoke credentials and sessions from affected machines. ABC News; The Hacker News
- ASD warns of more frequent disruptions to essential services as AI scales attacks. Includes new incident response protocols with AI labs. ABC AM
Global threats
- PHP2Shell added to CISA KEV. CVE-2026-109618 and CVE-2026-109619, federal patch deadline 29 October (US); more than 10 million of about 42 million exposed PHP services patched since 21 October. The Record; The Hacker News
- Tailscale prepares Tailworm fixes. Eleven findings published before patches; Tailscale SSH flaws can give root on reachable servers where forwarding is allowed. Disable SSH forwarding where not needed until the update ships. SecurityWeek
- Microsoft removes eMudhra roots from Windows. Out-of-band updates (including KB5134133 and KB5134125) after eight eMudhra intermediate keys proved trivially recoverable; update disconnected systems and replace dependent certificates. MSRC; BleepingComputer
- HPE patches 72 Aruba AOS flaws, 33 critical. Eight maximum-severity bugs (CVE-2026-79844 to CVE-2026-79851); fixed in AOS 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2. SecurityWeek
- University of New Mexico Health diverts ambulances after cyberattack. Services resumed Tuesday; BYOD ransomware claim unverified. The Record
- Apple backports exploited CoreGraphics fix to iOS 18.7.11. CVE-2026-86950; 27.2 releases fix hundreds more. The Hacker News
- Microsoft Authenticator for Android token theft flaw fixed. CVE-2026-80097; update to 6.2606.4246 or later. The Hacker News
- Lazarus Operation FlashHole targets South Korea. Fake résumé sites and abuse of INISAFE CrossWeb EX. The Hacker News
- UK police suppliers repeatedly breached, watchdog finds. The Record
AI security
- ARTEX AI framework used to breach about 90 South Korean organisations. 8.2 million records stolen; 38 extortion demands. BleepingComputer; EDAILY
- Warp discloses vendor breach exposing agent traces and telemetry. Up to about 1 per cent of users; CEO attributes it to an agent swarm. BleepingComputer
- Aokigahara infostealer targets AI assistant sessions. Claude, ChatGPT, Codex, Cursor, Copilot and more, plus Git, SSH and cloud credentials. Dark Reading
Industry
- Anthropic's IPO filing devotes 93 pages to risk factors, including runaway AI. SecurityWeek
Outlook and patch priorities
- Critical: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (Windows -1 builds) plus a compromise check on hosts exposed since 21 October; HPE Aruba AOS updates with isolated management interfaces.
- High: Tailscale client update when released (disable SSH forwarding meanwhile); eMudhra out-of-band update for disconnected Windows systems; Authenticator for Android 6.2606.4246; iOS 18.7.11 or 27.2.
- Hygiene: rotate AI tool, Git and cloud tokens on any workstation with a past infostealer infection.