An attacker hijacked the update channel of the cPGuard Linux security tool to backdoor hosting servers and steal password hashes, and attackers are exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 gateways. Barracuda disclosed a chainable path to root on its email and web appliances, Google and Mandiant say LLMjacking has cost some organisations US$1 million in AI charges, and Binance explained how its theft unfolded over five months.
Australian focus
- First State Auctions confirms a customer data incident. Mostly basic contact details accessed; no evidence card details or passwords affected; ACSC and OAIC informed. Cyber Daily
- Amadeus breach: airlines quantify exposure (update). Cathay Pacific about 53,000 bookings, JAL about 92,000 passengers; Qantas still assessing. Cyber Daily
Global threats
- cPGuard update channel hijacked. Versions 5.88.12 to 5.88.19 carried a backdoor and data-collecting script; update to 5.88.25 and rotate root, database and SSH credentials. The Hacker News
- Siemens SIMATIC IoT2050 Advanced flaw exploited (CVE-2026-58115). Unauthenticated Node-RED code execution; fixed in 4.3.4.1. The Hacker News
- Barracuda flaws chain to root (CVE-2026-116606, CVE-2026-111560). ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway; restrict admin interfaces. BleepingComputer; The Hacker News
- Linux IPv4 TCP race (CVE-2026-98432): Red Hat fixes ship (update). RHEL 8, 9 and 10 kernels out; Ubuntu fixes still in -proposed. The Hacker News
- Binance details a months-long campaign (update). Trojanised Homebrew installer, fake job interview, abused internal AI tool. The Record; The Hacker News
- Refrigeration attacks reach UK suppliers (update). Copeland XWEB 1.12.1 and earlier; firmware fix available since August. The Record
- Gorbag targets Ukrainian justice, local government and defence. Russia-aligned, per ESET. The Hacker News
- mSecure warns of suspicious activity. Customers advised to consider changing passwords and resetting 2FA and passkeys; scope unknown. The Hacker News
AI security
- LLMjacking charges reach US$1 million. Stolen cloud tokens and exposed API keys used to run up AI model bills. BleepingComputer; The Hacker News
- 3AM ransomware on a UK school estate, suspected AI-assisted. Bitdefender's inference from command timing. BleepingComputer
- DIVD names ARTEX behind its September breach (update). Two zero-days chained to root in 12 minutes. BleepingComputer
Industry
- UK NCSC warns of an "unprecedented rise" in incidents. The Record
- Google Cloud VRP adds a US$250,000 root-in-cloud reward. BleepingComputer
Outlook and patch priorities
- Critical: cPGuard 5.88.25 plus credential rotation; Siemens IoT2050 Advanced 4.3.4.1 or remove Node-RED.
- High: Barracuda patches and admin interface restriction; RHEL kernels for CVE-2026-98432; Copeland XWEB firmware; spend alerts and key scoping for AI projects.
- Indicators: Siemens IoT2050 campaign (VulnCheck, via The Hacker News): 85.215.73[.]250; 45.194.90[.]57:38472; files /dev/shm/.b and /tmp/.kworker.