The FBI and the US Secret Service published joint cybersecurity advisory JCSA-20261006-01 on 6 October 2026, warning that FortiBleed is an active, worldwide campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. FortiBleed is not a single new software bug: the operators use credential stuffing and password spraying with logins from earlier Fortinet leak dumps and infostealer logs, then take password hashes from devices that still store administrator passwords with legacy SHA-256 and crack them offline on a GPU cluster run with Hashcat and Hashtopolis. SOCRadar has verified more than 86,644 compromised devices in 194 countries. The workflow came to light because the operators left their own backend server open; it shows them filtering out honeypots, ranking victims by revenue and network layout, creating new administrator accounts on the firewall to keep access, enumerating Active Directory and spraying passwords inside the network, then selling working VPN access. The agencies say some victims have been locked out after the attackers deleted or changed the original admin accounts, so recovery can take more than a patch and a password reset, and that the access has been used as an entry point for ransomware affiliates (wire reports name INC/Lynx and Payload). The advisory lists account names seen on victim devices, including forticloud-sync, forticloud-tech, fortiAdmin, adminin, districtadmin and system_config, and infrastructure including a command-and-control server at 45.154.12[.]132 and a Hashtopolis host at 85.11.187[.]8. Primary: FBI/USSS joint advisory on IC3; wires: The Hacker News and Cyber Security News (7 Oct).
FBI and USSS — Joint Cybersecurity Advisory JCSA-20261006-01: FortiBleed operations continue targeting exposed systems leading to reports of lockouts (6 Oct 2026, PDF)
vulnerabilities network identity
Microsoft is adding the Windows app package extensions .msix and .msixbundle to the list of attachment types blocked by default in new Outlook for Windows and Outlook on the web for Exchange Online, The Register reported on 6 October 2026. Once the change lands, users of those clients will no longer be able to download or open attachments with these extensions. Microsoft calls the file types infrequently used and says the change is part of its ongoing work to protect organisations from unsafe attachments. Rollout is scheduled for early to mid-November 2026. Administrators who have a genuine need to receive these packages by email can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before then. Malicious MSIX packages have been used to deliver malware before: Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after it was abused. Primary: The Register (citing Microsoft's announcement).
The Register — Microsoft extends the Outlook block list with two more file types (6 Oct 2026)
tech cloud
Apple Developer News (2 October 2026; id=p6zjojqw) says macOS Full Disk Access (FDA) — the TCC privilege that largely sidesteps per-app privacy controls so backup apps can work — will gain additional controls so users who truly want to grant that extraordinary access can do so only with very explicit user action. Apple cites developers using FDA in ways that expose files, Mail, Messages and browsing history without users’ full understanding, and notes communication apps can also compromise the privacy of people users message. Framing: as AI agents become more capable and autonomous, FDA risk grows substantially; Apple commits to clearer risk disclosure before grant. No rollout date or OS version named in the notice. Context wires (Ars Technica / TechCrunch / MacRumors 2 Oct) link the move to debate over Meta Muse and other desktop AI agents that optionally request FDA plus in-app connectors. Not a CVE. Primary: Apple Developer News; wires: Ars / TechCrunch 2 Oct.
Apple Developer News — Updates to Full Disk Access in macOS (2 Oct 2026)
ai identity
Google Android security blog (amplified by The Hacker News 2 October 2026) states that in Android 17, enabling Advanced Protection automatically restricts AccessibilityService access exclusively to verified applications categorised as Accessibility Tools — closing a primary conduit used by banking trojans and spyware for screen reading, overlay fraud, silent permission grants and blocking uninstall, while preserving legitimate assistive tech. Advanced Protection also disables WebGPU in that mode to shrink browser attack surface. Google frames AccessibilityService abuse as a leading fraud/scam vector because the API can interact with the UI without root. Not a CVE; platform hardening for users who opt into Advanced Protection on Android 17. Primary: Google security blog; wire: THN 2 Oct.
Google — Android Advanced Protection updates (Accessibility Tools lock / WebGPU; Android 17)
tech identity
MI5 Security Service Espionage Alert (published 30 September 2026; THN amplify 3 Oct) states that the China General Technology Research Institute (CGTRI), also translated China Academy of General Technology (CAGT), has very strong ties to China’s Ministry of State Security (MSS). MI5 says CGTRI’s primary purpose is to fund academic research that directly improves MSS technical capability for espionage. More than 100 UK-linked academics have contributed to CGTRI-funded projects (AI, cybersecurity, covert communications, steganography); some may not have known CGTRI was the funder. Expected actions: UK institutions immediately review ongoing/planned CGTRI collaboration; establish ultimate funding source on China-linked research; use HMG Research Collaboration Advice Team (RCAT) and NPSA Trusted Research guidance; take independent legal advice. Alert places CGTRI–MSS ties in the public domain and flags National Security Act 2023 s 3 (assisting a foreign intelligence service) and s 17 (obtaining a material benefit from a foreign intelligence service) for continued CGTRI-funded work after publication. Primary: MI5 alert page + publication PDF; wire: The Hacker News 3 Oct. Relevant to Australian universities/research orgs as Five Eyes Trusted Research parallel — not an AU-specific ACSC alert.
MI5 — Espionage Alert: CGTRI 中国通用技术研究院 (30 Sep 2026)
tech ai australia
BleepingComputer (30 September 2026), citing a Microsoft Message Center update, reports that Microsoft Entra ID will enforce additional Content Security Policy (CSP) on browser sign-in experiences so only trusted Microsoft CDN-hosted scripts run during authentication, blocking external script injection / XSS-style credential theft on login.microsoftonline.com. Rollout begins mid-October 2026 and should complete by late October 2026; enabled by default, no tenant configuration required. MSAL and API-based auth flows are unaffected (CSP applies to browser sign-in only). Microsoft advises enterprises to stop relying on browser extensions/tools that inject code into Entra sign-in pages, and to test sign-in flows in browser developer tools for CSP violations (red console errors) before the deadline. Users can still sign in if unsupported injection tools break. Framed as part of Microsoft’s Secure Future Initiative. Wire-primary until a public Microsoft Learn / Message Center article URL is mirrored. Distinct from desk Entra SMS/voice/passkey and TrustSink EAM cards.
BleepingComputer — Microsoft to block Entra ID script injection from October (30 Sep 2026)
tech identity cloud
Australian Communications and Media Authority media release MR 31/2026 (30 September 2026) — Amaysim Mobile Pty Ltd (Optus-owned) paid a $138,600 penalty after an ACMA investigation found 13 breaches in 2025 of the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020 (unauthorised mobile number transfers where mandatory additional ID verification was not carried out). ACMA Chair: checks are critical to stop fraudsters hijacking mobile services for identity theft and financial harm; ACMA not aware of financial losses from these breaches. Court-enforceable undertaking: independent review of policies/procedures, implement improvements, regular reporting to ACMA. Separate action: formal warning to Switch Mobile Networks (Ezee Mobile) for failing to publish consumer scam-reporting information. ACMA notes telcos have paid more than $5.2 million to date under the mobile-number-fraud crackdown. Category australia (identity / telco compliance — not a data-breach notification). Primary: ACMA; wire: iTnews 30 Sep.
ACMA — Amaysim and Ezee Mobile breach anti-fraud rules (30 Sep 2026)
australia identity
ASIC Commissioner Kate O’Rourke’s supervisory letter to bank boards and executives (30 September 2026; PDF desk-fetched 4 Oct) sets 2026–27 banking priorities. New activity: a banking-sector AI review expected to commence Q2 2026–27, focused on new and proposed bank AI use cases and customer impact — especially customer-facing interactions, decision-making and lending — with APRA coordination to minimise duplication. Letter cites ASIC Report 798 Beware the gap (Oct 2024): AI adoption grew while governance and consumer-risk assessment lagged. Continuing focus includes Scams Prevention Framework implementation (scheduled commence March 2027) with Treasury/ACCC/ACMA. Distinct from ASIC/APRA frontier-AI cyber roundtables (26-201MR). Primary switched this pass from iTnews wire to the ASIC PDF letter; iTnews retained as secondary.
ASIC — 2026–27 banking sector priorities supervisory letter (PDF; 30 Sep 2026)
ai australia
ASD’s ACSC alert Protect your organisations’ AI services (first published 28 September 2026) warns that malicious actors obtain unauthorised access to organisations’ AI services via compromised API keys, stolen authentication tokens, compromised user sessions, vulnerable applications, and third-party access arrangements. Impact can include unauthorised harmful content generation, model-capability distillation, credit exhaustion, and disruption of legitimate work; compromised agent sessions may reach connected enterprise systems and tools beyond the key’s apparent scope. Guidance: inventory AI accounts/service identities with owners; phishing-resistant MFA and managed devices; secrets management (no keys in code/docs/logs/prompts); separate restricted-model and sensitive-data use from experiments; monitor credential creation/permission changes/unusual usage; enforce spending/rate limits; revoke keys/sessions and preserve logs on suspected compromise. Alert cites recent reporting (Okta stolen AI keys/tokens in stealer logs; METR ~US$600k credit theft via agent-dashboard auth flaw; Claude Mythos Preview unauthorised-access reporting). Primary: ACSC alert page. Audience includes individuals/families, large organisations/infrastructure, and government.
ASD’s ACSC — Protect your organisations’ AI services (28 Sep 2026)
ai australia identity cloud
Microsoft support bulletin KB5002907 (“Optional update for out-of-date Microsoft 365 Apps installations”) and BleepingComputer (26 September 2026) confirm the vendor has paused rollout after reports that the optional Windows Update package deactivated — or in rare cases removed — perpetual Office 2016 and Office 2019 installs. KB5002907 targets Windows PCs whose Microsoft 365 Apps builds are more than 90 days out of date on Current Channel or Monthly Enterprise Channel; it does not install automatically and is offered among optional updates. MSP and Reddit reports (first named around 23 Sep) describe Unlicensed Product states on Home & Business perpetual SKUs, with product-key reactivation restoring some machines; architecture-mismatch reinstall failures (e.g. 32-bit Office beside 64-bit Access Runtime) can leave Office removed. Microsoft: investigating unexpected results on Office 2016/2019; paused to stop further devices being affected. Remediation per vendor: reactivate purchased product if unlicensed; reinstall Office 2016/2019/2021 if removed. Primary: Microsoft KB5002907; wire: BleepingComputer 26 Sep.
Microsoft — KB5002907 optional M365 Apps update (paused; Office 2016/2019 impact)
tech australia
Kiteworks CISO Frank Balonis emailed customers 25 September 2026 after receiving credible federal intelligence that a threat actor may attempt to target some customer Kiteworks systems over the weekend. Vendor recommended a precautionary nine-hour (press also cited six-hour UTC window) shutdown on 26 September for on-premises and customer-hosted instances, including systems not Internet-facing; Kiteworks would shut down hosted instances on customers’ behalf. Vendor press notice (25 Sep) and SecurityWeek (28 Sep): no indication Kiteworks or customer systems were compromised; advisory preventative; known vulns said addressed in release 9.5.1. UPDATE: vendor NOTICE as of 27 Sep — shutdown recommendation lifted for all customers; hosted systems restored. Customer emails (via SecurityWeek/Reddit) say a severe vulnerability in Advanced Forms (secure data collection; aka Secure Data Forms) triggered the action; Advanced Forms enabled for fewer than 1% of customers (under 50 orgs) and confined to that product; DPE/file collaboration/transfer/email encryption/APIs/MFT unaffected; self-hosted Advanced Forms customers should contact Support; working with partners including Mandiant; no evidence of exploitation disclosed. UPDATE 29 Sep 2026 — BleepingComputer: vendor developed and deployed a fix during the shutdown window, applied an additional protective layer across all environments, still no indication the vulnerability was exploited, and still no public CVE ID. Primary: Kiteworks precautionary shutdown advisory (updated 27 Sep); wires: SecurityWeek 28 Sep + BleepingComputer 29 Sep.
Kiteworks — Precautionary Shutdown Advisory (25 Sep 2026; NOTICE lifted 27 Sep)
vulnerabilities australia cloud
iTnews (Juha Saarinen, 25 September 2026 17:57 AEST) covers Farzan Karimi’s “QR Jacking” research (primary blog on jumpycastle.dev): QR Tiger’s Own Short Domain / branded short-URL feature accepted a customer CNAME (e.g. qr.company.com) after checking only that the DNS record existed — not who owned the claim. When a company ends a campaign and leaves the CNAME pointing at QR Tiger without an active registration, any new QR Tiger account holder can claim that subdomain and redirect every still-circulating printed/packaged QR code while the phone still shows the company’s own domain and HTTPS. Karimi says hundreds of orgs across manufacturing, healthcare, finance and tech were exposed; told iTnews QR Tiger had not fixed the flaw five months after disclosure; plans to release a scanner (“QR Tiger King”) on GitHub and extend findings to other QR vendors. Mitigation: remove unused CNAMEs; require TXT ownership tokens (standard SaaS domain verify). Distinct from OWASP QRLJacking (2016 login-QR session theft). Australia-weighted via iTnews primary wire. Primary: Karimi blog; wire: iTnews.
Farzan Karimi — Introducing QR Jacking (jumpycastle.dev)
australia identity
