ASIC said on 14 October 2026 (media release 26-244MR) that the Supreme Court of NSW has ordered Fortnum Private Wealth Ltd, a Sydney-based financial advice licensee, to pay a $1.35 million penalty and $250,000 towards ASIC's costs. Fortnum admitted that between 20 April 2021 and 11 May 2023 it failed to implement an adequate cybersecurity policy across its business and authorised-representative network; failed to have adequate processes, systems and frameworks to oversee and monitor its representatives' cyber resilience; failed to maintain adequate staff with specialised cybersecurity expertise; and failed to maintain adequate cybersecurity risk-management systems. Over that period the network had 81 to 94 financial advice practices, more than 200 authorised advisers and around 55,000 retail clients, whose files included identification documents, tax file numbers and financial account details. Justice Black said the agreed penalty provides the 'necessary sting or burden' for deterrence, noting the conduct was not deliberate and Fortnum cooperated with ASIC. ASIC Chair Sarah Court called it the third outcome ASIC has obtained against a licensee over cyber-risk failures, after RI Advice and FIIG Securities, and said Fortnum knew the risks but lacked an adequate policy and oversight. ASIC began the case in July 2025 after Fortnum notified it of a cyber attack on one of its authorised representatives. ASIC's 2025 filing alleged that one attack on a representative led to a major breach in which the data of more than 9,000 clients was published on the dark web. Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise. Primary: ASIC 26-244MR; background: ASIC 25-143MR; wire: Cyber Daily.
ASIC — 26-244MR Fortnum Private Wealth penalised $1.35 million for cybersecurity failures (14 Oct 2026)
MITRE released ATT&CK v20 on 13 October 2026, updating techniques, groups, campaigns and software across the Enterprise, Mobile and ICS matrices. MITRE says the biggest change is broader coverage of recent adversary activity, including AI-focused and AI-enabled techniques. New Enterprise techniques are Direct Prompt Injection, Indirect Prompt Injection, AI-Enabled Exfiltration, Stage Capabilities: AI Result Poisoning, Disable or Modify Tools: Impair Autonomous Defenses, Anti-Automation Evasion (with sub-techniques for automating CAPTCHA completion and avoiding CAPTCHA) and Steal Application Specific Passwords, each with new detection strategies. Supply Chain Compromise: Compromise Software Dependencies and Development Tools moves to version 2.0. New campaigns are '2026 U.S. Water Utilities Attacks' (ICS) and 'AI-Assisted Breach of Mexico's Government Infrastructure'. New groups are NIMBUS MANTICORE and The Gentlemen (whose ransomware is also added as software), and Salt Typhoon and APT38 entries get major revisions. ICS gains execution techniques for command and scripting interpreters (PowerShell, Python, JavaScript, Unix shell, Visual Basic, Windows command shell) and command and control over DNS and publish/subscribe protocols, while the older ICS Command-Line Interface and Scripting techniques are deprecated. Mobile un-deprecates Deliver Malicious Application via Other Means. The release counts 971 software entries, 182 groups and 61 campaigns; Enterprise now has 227 techniques and 479 sub-techniques. Why it matters: teams that map detections, threat models or red-team plans to ATT&CK now have standard IDs for prompt-injection and AI-agent abuse, and ICS teams have script-execution techniques to map. Primary: MITRE ATT&CK October 2026 update notes; context: ATT&CK v20 blog post; wire: Cyber Security News.
MITRE ATT&CK — Updates, October 2026 (v20, 13 Oct 2026)
Microsoft opened a Windows release health known issue on 13 October 2026 (09:43 PT; 14 October Perth time): after the September 2026 non-security preview update KB5124010 or later updates, non-admin users might be unable to connect over Remote Desktop to devices that have Administrator protection enabled. Connections fail with error 0xC000000D and the message 'The token that was passed to the function is invalid.' It mainly hits enterprise-managed Remote Desktop hosts, however the feature was enabled. Administrator protection gives signed-in users standard rights and asks for Windows Hello to elevate; Microsoft notes it is enabled by default in the Windows 11 24H2, 25H2 and 26H2 security baselines from the Security Compliance Toolkit, and BleepingComputer reports it now lands by default in organisations using those baselines after the October 2026 security update. Affected: Windows 11 24H2, 25H2, 26H1 and 26H2 clients; no server versions. Microsoft lists the issue as mitigated by a workaround and is working on a fix. This is a reliability problem, not a vulnerability. Primary: Microsoft Windows release health.
Microsoft Windows release health — Remote Desktop connections might fail for non-admin users with error 0xC000000D (opened 13 Oct 2026)
Microsoft's Security Update Guide added seven cloud-service CVEs on 8 October 2026 (US time), all rated Critical by Microsoft and all marked as already fully mitigated by Microsoft with no action for customers; they are published for transparency under its cloud-service CVE policy. They are CVE-2026-96207, improper certificate validation in Microsoft Partner Center allowing privilege escalation by an unauthenticated attacker (CVSS 10.0); CVE-2026-94510, an authorisation bypass through a user-controlled key in Microsoft Bookings (9.9); CVE-2026-88131, deserialisation of untrusted data allowing unauthenticated code execution in Microsoft Dataverse (9.8); CVE-2026-77900, missing authentication allowing unauthenticated code execution in Azure App Service (9.8); CVE-2026-69435, missing authorisation in Azure SRE Agent allowing an authenticated attacker to escalate privileges (9.6); CVE-2026-83943, information disclosure in Azure API Center (8.7); and CVE-2026-83947, spoofing in Azure Event Grid (7.7). Microsoft says none were publicly disclosed or exploited. Primary: Microsoft Security Response Center.
Microsoft Security Response Center — CVE-2026-96207, Microsoft Partner Center elevation of privilege (8 Oct 2026)
Microsoft said in its Windows message center on 8 October 2026 that certificates used to make trusted connections to Windows Update expire on 17 May 2027 and 19 June 2027, and that devices must hold the replacement certificates to keep receiving updates after those dates. Windows 11 25H2 and later need no action. Windows 11 24H2 and Windows Server 2025 need the September 2025 security update or later before 19 June 2027. Other supported Windows 11 releases, Windows Server 2022 and supported Windows 10 versions need the July 2026 security update or later before 19 June 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 update or later before 17 May 2027. Any other (unsupported) Windows version must be upgraded, or it will lose access to Windows Update. Devices that get updates through Windows Server Update Services (WSUS) are not affected by this change. Microsoft advises identifying old or unsupported devices now and planning upgrades before the deadlines. Primary: Microsoft Windows message center; wire: BleepingComputer.
Microsoft Learn — Windows message center: Prepare for Windows Update certificate rotation in 2027 (8 Oct 2026)
On 8 October 2026 Zscaler ThreatLabz said it had found another new installer for the Anatsa (TeaBot) Android banking trojan distributed through the Google Play Store, disguised as a PDF reader with more than 10,000 installs, and published the Play Store listing and indicators (installer and payload hashes, command-and-control addresses) in its alert. Anatsa uses a dropper model: the harmless-looking app is installed first, then downloads the banking payload, often presented as an app update, and overlays fake login screens to steal banking credentials. The install figure is for the dropper app, not confirmed infections; the alert does not name targeted banks or countries, or say whether Google has removed the listing. Earlier ThreatLabz analysis documented Anatsa using environment checks and malformed APK archives to avoid analysis. Primary: Zscaler ThreatLabz (X); wire: Cyber Security News.
Zscaler ThreatLabz on X — new Anatsa installer on Google Play disguised as a PDF reader (8 Oct 2026)
On 8 October 2026 Anthropic announced the Anthropic Cyber Mission, which it describes as a long-term effort to give defenders tools, research and funding, starting with critical infrastructure and open-source software. The Critical Infrastructure Defense Program puts frontier Claude models, on-site Anthropic engineers and threat research with trusted providers that secure operational technology (power, water, factories, transport). Founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation; Anthropic says it is starting with a small cohort. OSS Scanner is an opt-in service, modelled on Google's OSS-Fuzz, that periodically scans enrolled open-source projects free of charge. Each report includes a proof of concept, an explanation and a suggested fix where available; reports are model-generated and sent without human review, so some will be wrong (for example severity), and Anthropic says it expects a true-positive rate above 90%. Anthropic also cites funding for the Python Software Foundation, Alpha-Omega and OpenSSF (Linux Foundation) and the Apache Software Foundation, and says the Defender Advantage Fund keeps OSS Scanner free. It builds on the Project Glasswing lesson that finding bugs is now easy but verifying, prioritising and fixing them is slow. Distinct from the desk card on the expanded Cyber Verification Program tiers (anthropic-cvp-tiers-20261006). Primary: Anthropic; wire: Cyber Security News.
Anthropic — Introducing the Anthropic Cyber Mission (8 Oct 2026)
On 8 October 2026, CISA, FBI, NSA and international partners including Australia's ACSC published joint Cybersecurity Advisory AA26-281A on China-linked threat actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with government links that builds or acquires cyber tools, hosts infrastructure and compromises networks. Observed TTPs are consistent with activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett (vendor names may not map 1:1). Actors combine automated scanning (including MicroScan with 1,300+ scripts), large IoT botnets, password spraying against Microsoft 365/Exchange, VPN persistence and hands-on exploitation to steal email and credentials, and have run a portal giving third parties access to stolen mail. Same day, the US Justice Department and FBI announced court-authorised seizures of seven domains used for MicroScan and FishHub spear-phishing/malware delivery; scanning targets cited in court papers include a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms and universities. Integrity Tech was previously sanctioned by the US (Jan 2025) and UK (Dec 2025); a 2024 FBI action disrupted its Raptor Train botnet. Mitigations in the advisory include disabling unused services/ports, sanitising web inputs, MFA everywhere, and timely patching of listed n-day flaws. Primary: CISA AA26-281A (ACSC co-author); DOJ seizure PR; wire: BleepingComputer / The Hacker News. UPDATE (11 Oct): Australia is not among the victim locations the advisory names (it lists US government, critical manufacturing, healthcare and IT organisations, plus victims in Southeast Asia, Africa and North America), but an ASD spokesperson told iTnews that "the vulnerabilities, tactics, techniques and procedures outlined in this advisory are applicable to Australian entities" and urged organisations to mitigate the threat. The other co-sealing agencies are from the UK, Canada, Japan, New Zealand and Spain. The advisory also notes that the FBI recovered an archived email database stolen from government, law enforcement, healthcare and religious organisations in Southeast Asia, with access in some cases restricted to IP addresses in Xiamen, China; about 20 Taiwanese universities were confirmed FishHub victims; and the actors used a tool called DC.exe to run DCSync against domain controllers. Watch for unexpected Active Directory replication and replace end-of-life edge products. Source: iTnews (12 Oct AEDT), quoting ASD.
CISA — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools (8 Oct 2026; ACSC co-author)
JPCERT/CC issued alert JPCERT-AT-2026-0030 on 8 October 2026 about a run of unauthorised-access incidents that leaked large amounts of personal data from Japanese organisations around September 2026. It names no attacker or victim and calls its picture limited and fragmentary. It describes three patterns: attackers pulling API keys from smartphone apps and calling APIs in ways that look like normal use, then hunting for APIs that return too much data, have excessive privileges, expose member functions to anonymous users or mishandle sessions (weak admin passwords and known flaws were also seen); attackers scanning each target for a range of known flaws and stealing configuration and backup files; and exploitation of CVE-2026-72898, the unauthenticated Metabase SQL injection (CVSS 10.0) that was a zero-day against Metabase's own cloud in August and is on CISA's KEV list. Targets include consumer apps, business intelligence tools and staff-facing management systems their operators never meant to be public. The alert lists eight source IP addresses, five User-Agent strings and API controls such as access checks on every endpoint, public or not. The security research centre of Macnica, cited by the alert, counted 119 publicly reported web-system personal data leaks in Japan this year to 6 October (84 in all of 2025, 62 in 2024), 81 of them since July. Primary: JPCERT/CC (Japanese); wire: The Hacker News. UPDATE (13 Oct): Japan's government has since responded across agencies. The Cabinet Secretariat's National Cybersecurity Office (NCO) issued an advisory dated 9 October 2026 saying it had confirmed multiple cases in which systems of companies handling large volumes of personal data were breached through web-system vulnerabilities, supply-chain compromise and weak data management. It asks those companies to patch promptly (including internal servers), retire unsupported products, use MFA, trim admin accounts, keep and watch logs, and check contractors and sub-contractors, and to share technical details with the NCO or their ministry. Jiji Press reported that cybersecurity minister Toshiharu Furukawa chaired the first cross-ministry meeting on the leaks on 8 October and told agencies to report leaks to the NCO so information is held centrally; the NCO said attacks on private companies began rising in August and that defenders should assume attackers use AI. The Financial Services Agency warned financial institutions on 9 October that recent breaches leaked customer data including images of identity documents such as driver's licences, and asked them to guard against impersonation in remote identity checks. The advisories are requests, not new legal duties. Primary: NCO advisory (Japanese PDF); FSA notice; Jiji Press.
JPCERT/CC — JPCERT-AT-2026-0030: alert on recent successive unauthorised access at domestic organisations (8 Oct 2026, Japanese)
Let's Encrypt announced on 7 October 2026 that every certificate it issues or renews on or after 10 February 2027 will be valid for 64 days by default instead of 90, unless the subscriber picks one of the shorter 45-day or roughly six-day profiles it has already announced. The last 90-day certificates should expire on 11 May 2027, and existing certificates will not be revoked. The staging environment switches to 64-day certificates on 14 October 2026 so administrators can check renewal behaviour early. Clients that support ACME Renewal Information (ARI) will be told when to renew; anything renewing at a fixed number of days before expiry should move to about two-thirds of the lifetime (around day 43), and Let's Encrypt suggests searching cron jobs, wrapper scripts and runbooks for hard-coded values such as 83, 80 or 60. The authorisation reuse period also drops from 30 days to 10 days, and to seven hours in 2028, ahead of a 2029 industry limit; rate limits, ACME endpoints and issuance chains do not change. Default lifetimes are due to fall to 45 days in February 2028. Shorter lifetimes reduce the damage from a stolen key or a mis-issued certificate. Primary: Let's Encrypt; wire: Cyber Security News.
On 7 October 2026 the Office of the Australian Information Commissioner announced a commissioner-initiated investigation into Shenzhen Qingcheng Future Technology Co. Ltd, maker of the HeyCyan companion app required for full use of Anko smart glasses sold by Kmart and other low-cost glasses sold via Big W Marketplace, Amazon and similar channels. After an Attorney-General request, the OAIC from 12 August 2026 sent preliminary inquiries to Meta, Kmart, Google and Shenzhen Qingcheng about recording, storage and access to personal information. Shenzhen Qingcheng (China) did not respond. Privacy Commissioner Carly Kind said that absence left no assurance the company protects Australians' personal information as required under APP 1, and that the investigation lets the OAIC use compulsory information-gathering powers. Kind has written to retailers selling HeyCyan-linked devices urging them to consider whether continued sale is appropriate. Opening an investigation is not a finding of breach. Parallel coverage: Kmart removed its $89 Anko camera glasses from online sale while still listing speaker-only glasses; ACS Information Age and SMH reported the retail pull alongside the OAIC action. Distinct from the earlier desk card on APS/Optus smart-glasses policy (au-smart-glasses-policy-20260918). Primary: OAIC media release 7 Oct; wire: ACS Information Age.
OAIC — Opens investigation into maker of HeyCyan smart glasses phone app (7 Oct 2026)
ABC News reported on 6 October 2026 that the Australian Competition and Consumer Commission received 138 scam reports involving LinkedIn in July and August 2026, with reported losses of up to $254,449. The pattern is recruitment fraud rather than a platform breach: fake job ads, cloned profiles of real recruiters and employees (one jobseeker was approached in the name of a real Aurecon staff member, and Aurecon confirmed it had not contacted him), and offers that end in an upfront fee. A common version, described by Contract Services Australia managing director Mark Hopcroft, is a 'recruiter' who says your CV fails the employer's keyword screening and then offers their own HR specialist to fix it, in his case for about A$8,600 (US$6,000); he only caught it because the role was not on the company's own careers site. Users say approaches rise sharply after switching a profile to 'open to work'. LinkedIn's Job Search Safety Pulse survey found about 16 per cent of Australian respondents say they have fallen for a job scam (25 per cent of Gen Z), 61 per cent have seen an ad they suspected was fake, and nearly half say cost-of-living pressure makes them take more risks. ANZ warned last month that realistic job scams have become a common impersonation scam. Practical checks: confirm any role on the employer's own website, contact the company through a number you look up yourself, and never pay for CV writing, training or equipment to get a job. Report to Scamwatch and, if money was sent, to your bank straight away.
ABC News — Jobseekers exploited by recruitment scammers on LinkedIn (6 Oct 2026)
