The n0n ransomware group initially listed a New South Wales neurology practice on the gang's leak site as 'Company 27' and has since named it as East Maitland-based Hunter Neurology, according to Cyber Daily (15 October). Hunter Neurology told Cyber Daily it is aware of the claim and, based on its investigation so far, understands it relates to an incident affecting the environment of a third-party technology provider that hosts and supports its systems. It has engaged cyber security and forensic experts to verify the claims, says it is operating normally with no interruption to patient services, and has notified the Australian Cyber Security Centre. If personal information is found to be affected, it will contact those individuals directly and notify the OAIC. Primary: Cyber Daily (practice statement). Correction (23 Oct 2026): removed n0n's own claims about how many scans, letters and backups it holds and its payment deadline; none has been confirmed by the practice. (source: https://www.cyberdaily.au/security/14305-exclusive-hunter-neurology-investigating-patient-data-breach-claims) Correction (25 Oct 2026): removed a leak-site tracker link and its listing date; the listing is now credited to Cyber Daily. The card date has moved from 11 to 15 October 2026, the Perth date of Cyber Daily's report (15 October 04:07 UTC, 12:07 Perth time (AWST)); the earlier date came from the tracker. (source: Cyber Daily)
Cyber Daily — Exclusive: Hunter Neurology investigating patient data breach claims (15 Oct 2026)
The Node.js project said in an advance notice dated 14 October 2026 that it will ship new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday 21 October 2026 to fix security vulnerabilities. The highest severity issue in each of the three lines is rated High. Node.js has not yet published the CVE numbers, affected components or fixed version numbers; those come with the release. The project reminds users that end-of-life versions are always affected when a security release happens, which includes Node.js 20 (last release 20.20.2 in March 2026) and older lines that will get no fix. Latest releases before the security update were 26.12.0 and 24.22.0 (both 14 October) and 22.23.3 (23 September). Node.js runs a large share of web back ends, build pipelines, serverless functions and developer tooling, including in Australian organisations. Separately, a trust-store change for the compromised eMudhra intermediate certificates was still listed as pending for Node.js on 21 October (see this desk's eMudhra card); the advance notice does not say whether this release includes it. Primary: Node.js security release notice (14 Oct). UPDATE (21 Oct): Node.js published the security releases: 26.12.1, 24.22.1 and 22.23.4. They fix ten vulnerabilities. High: CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says permits remote code execution (26.x, 24.x, 22.x); CVE-2026-105482, dns.resolve truncating names that contain a NUL character (all three lines); CVE-2026-105483, a TLS certificate hostname check bypass when an IP address is written in fullwidth digits (26.x, 24.x); and CVE-2026-106069, a TLS hostname check bypass when the host loosely resolves to an IP address (all three). Medium: CVE-2026-105481 (a keep-alive socket can process a response written before the request was sent), CVE-2026-106072 (DNS SANs can authenticate non-canonical IPv4 endpoints) and CVE-2026-106074 (crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so every process repeats the same values). Low: CVE-2026-106070 (ZipFile returns attacker-controlled prefix bytes, 26.x), CVE-2026-106071 (Permission Model wildcard over-grant, 26.x) and CVE-2026-106073 (Permission Model bypass with fs.realpathSync). The releases also update c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x and SQLite on 22.x, and update Node's bundled CA certificates for the eMudhra intermediate CA compromise on all three lines. Node.js publishes severity ratings, not CVSS scores. Primary: Node.js security release post (updated 21 Oct). UPDATE (23 Oct 2026): Imperva's red team said on 22 October that its 'Node2Shell' proof of concept ran code carried in Brotli data inside applications on the official Node.js 24.22.0 Linux arm64 image, through both a response read with the built-in fetch() and request bodies decoded by Express 5 and body-parser 2 parsers; it says execution took multiple attempts, it did not test every Node.js build or application, and 24.22.1 rejected the same inputs. Imperva says a bare Node.js HTTP server does not decode incoming Brotli bodies just by receiving them. Vercel said it deployed WAF rules on 21 October that block the inbound attack for projects on Vercel, but they do not cover responses an application fetches from other servers and do not replace patching. (source: Imperva; Vercel) UPDATE (24 Oct 2026): The Brotli flaw CVE-2026-111497 is in Google's Brotli C decoder, so other software that ships its own copy of that decoder needs its own fix. Google published fixed Brotli releases v1.2.1, v1.1.1 and v1.0.10 on 21 October, each listing 'CVE-2026-111497: out-of-bounds write permits remote code execution'. Envoy's advisory GHSA-3wvj-j6qm-62mr (23 Oct, rated Critical, CVSS 4.0 9.2) says Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 are vulnerable in deployments that have the Brotli decompressor configured, and that the flaw was addressed in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12. Istio's bulletin ISTIO-SECURITY-2026-007 says users who enable Brotli decompression, for example with an EnvoyFilter, should upgrade, to 1.31.2, 1.30.6 or 1.29.9 (the final 1.29 release). The Python Packaging Advisory Database (PYSEC-2026-4322 and PYSEC-2026-4323, 23 Oct) says the PyPI Brotli package up to and including 1.2.0 and brotlicffi releases before 1.2.1.0 carry the vulnerable decoder, fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0, and that with Brotli installed, common HTTP clients (urllib3/requests, httpx with the brotli extra, aiohttp) decode Brotli responses automatically. Red Hat rates the flaw Important (CVSS 3.1 8.1) and says there is no public, reliable remote code execution proof of concept. According to The Hacker News, Bun is also affected and no real-world attacks have been reported. (source: Google Brotli on GitHub; Envoy; Istio; PyPA advisory database; Red Hat; The Hacker News) UPDATE (25 Oct 2026): According to iTnews, Australian researcher Paul McCarty, co-founder and chief technology officer of OpenSourceMalware, found potentially vulnerable software that uses Google's Brotli decoder across several open source ecosystems, including Python, Go, .NET and Perl. iTnews reports McCarty as saying that Chrome and Firefox have picked up the fix in their bundled copies of Brotli; that Electron desktop apps such as Signal, Slack, Discord and Visual Studio Code each carry their own copy of the browser engine and rely on their own update mechanisms; and that Microsoft's .NET runtime, the DuckDB database and the Pillow and pyarrow Python libraries carry their own copies of the decoder. iTnews also reports that a Google engineer added the fix to Brotli in February, described only as a change to detect and report invalid streams earlier, and that it was not in an official Brotli release until October. (source: iTnews) UPDATE (26 Oct 2026): Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, along with .NET 11 Release Candidate 3, on 25 October (UTC) to fix CVE-2026-111497, which its .NET Blog describes as a buffer overflow in .NET's use of the Brotli decompression algorithm that may allow an unauthenticated attacker to read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege, on all platforms. Microsoft lists the fixed versions as .NET 8.0.33, 9.0.22 and 10.0.14, with .NET 11 RC2 users told to move to RC3. Microsoft says applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs; request decompression and automatic response decompression are not enabled by default, and .NET Framework is not affected. Microsoft says self-contained applications must be rebuilt and republished and containers rebuilt from updated .NET images, because installing a newer runtime on the host does not update a bundled runtime. The same release fixes CVE-2026-114148 (unsafe ownership metadata in Linux .NET tarballs) and re-releases fixes for CVE-2026-70197 and CVE-2026-102870 because, Microsoft says, the 13 October release did not fully address them. (source: Microsoft .NET Blog)
Node.js — Wednesday, October 21, 2026 Security Releases (advance notice 14 Oct; release details 21 Oct 2026)
EG Secure Solutions disclosed on 14 October 2026 an OS command injection vulnerability, CVE-2026-106931 (JVN#88474777), in the statistics function of SiteGuard Server Edition, a host-based web application firewall widely used in Japan for Apache, Nginx and IIS. The vendor says exploitation has already been confirmed. A successful attack lets an attacker run arbitrary OS commands with root or SYSTEM privileges on the server running the product. Affected are version 2.20 and later with the statistics feature enabled, which is the default: Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS Ver3.10 through Ver4.00 Update4 are not affected. The vendor rates it CVSS 4.0 8.5 (CVSS 3.0 7.8) with a local attack vector and low privileges required. It notified customers with direct support contracts on 29 September and offers a replacement-file patch for those who cannot upgrade, including end-of-support versions. JPCERT/CC issued an alert the same day, noting the product is widely used in Japan and urging both patching and compromise checks. The vendor warns that upgrading may wipe attack traces, so collect the diagnostic information from the web admin console before updating. Primary: EG Secure Solutions; JPCERT/CC alert; wire: The Hacker News ThreatsDay (16 Oct). UPDATE (22 Oct 2026): CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a 23 October due date for US federal agencies. (source: CISA KEV catalog)
EG Secure Solutions — SiteGuard Server Edition OS command injection vulnerability (urgent), CVE-2026-106931 (14 Oct 2026, Japanese)
Darktrace published research on 14 October 2026 on CikaBika Bot, a Rust-based Windows remote-access trojan that uses Discord for command-and-control. The lure chain starts with a PDF that contains a disk image holding a Windows shortcut (LNK) posing as a Word document. Opening the LNK shows a decoy document while a hidden PowerShell process decodes and runs an embedded Nim loader. That loader drops a Rust DLL and a PowerShell deployment script, then tries to move the DLL into Microsoft Edge's install directory using a UAC bypass so it can be sideloaded through DLL search-order hijacking (dbghelp.dll). Once running, CikaBika registers the host with Discord, gathers system, process and network details, takes screenshots, and accepts interactive commands over a per-victim Discord channel (execution, process control, file upload/download, camera/streaming). Darktrace also saw directory ZIP packing and exfiltration through ngrok. No CVE or patched product is involved — this is a phishing-delivered RAT. Primary: Darktrace.
Darktrace — CikaBika Bot: Inside a Discord RAT (14 Oct 2026)
Cisco Talos published joint research with Recorded Future's Insikt Group on 14 October 2026 on UAT-6275 (Recorded Future: TAG-193), activity that overlaps with the group publicly known as Silent Lynx. Talos assesses with medium confidence that the group has a Kazakhstan nexus, based on infrastructure access, language artefacts, sample submissions, working-hours analysis and targeting. Between June 2025 and August 2026 Talos saw four infection chains against government organisations across the Commonwealth of Independent States: macro-enabled Word documents (June 2025); PS2EXE-built downloaders that fetch reverse shells and add scheduled tasks (July 2025); LNK shortcuts in RAR archives that run a GitHub-hosted PowerShell script (October 2025); and, from April 2026, RAR archives exploiting the WinRAR path-traversal flaw CVE-2025-8088 to drop the PickleShell reverse shell into the Windows Startup folder. That is the first vulnerability exploit Talos has seen in the group's malware delivery. Payloads are lightweight custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Lures included a diplomatic letter to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form and a proposal involving Russia's Orsk Oil Refinery, with additional interest in water resources, the environment and energy. Phishing emails were sent from compromised government accounts. Three publicly exposed staging directories and an unreported GitHub repository revealed payload builds and C2 changes. They also held Linux tooling and a public exploit for the FortiWeb SQL injection CVE-2025-25257, suggesting plans to target Linux hosts and internet-facing appliances. Talos believes UAT-6275 and YoroTrooper are likely part of the same broader cluster but tracks them separately. Primary: Cisco Talos; also Recorded Future Insikt Group; wire: The Hacker News (15 Oct).
Cisco Talos — Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (14 Oct 2026)
ASIC said on 14 October 2026 (media release 26-244MR) that the Supreme Court of NSW has ordered Fortnum Private Wealth Ltd, a Sydney-based financial advice licensee, to pay a $1.35 million penalty and $250,000 towards ASIC's costs. Fortnum admitted that between 20 April 2021 and 11 May 2023 it failed to implement an adequate cybersecurity policy across its business and authorised-representative network; failed to have adequate processes, systems and frameworks to oversee and monitor its representatives' cyber resilience; failed to maintain adequate staff with specialised cybersecurity expertise; and failed to maintain adequate cybersecurity risk-management systems. Over that period the network had 81 to 94 financial advice practices, more than 200 authorised advisers and around 55,000 retail clients, whose files included identification documents, tax file numbers and financial account details. Justice Black said the agreed penalty provides the 'necessary sting or burden' for deterrence, noting the conduct was not deliberate and Fortnum cooperated with ASIC. ASIC Chair Sarah Court called it the third outcome ASIC has obtained against a licensee over cyber-risk failures, after RI Advice and FIIG Securities, and said Fortnum knew the risks but lacked an adequate policy and oversight. ASIC began the case in July 2025 after Fortnum notified it of a cyber attack on one of its authorised representatives. ASIC's 2025 filing alleged that one attack on a representative led to a major breach in which the data of more than 9,000 clients was published on the dark web. Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise. Primary: ASIC 26-244MR; background: ASIC 25-143MR; wire: Cyber Daily.
ASIC — 26-244MR Fortnum Private Wealth penalised $1.35 million for cybersecurity failures (14 Oct 2026)
Vercel published a Next.js Security Update for Upstream Vulnerabilities on 14 October 2026, shipping out-of-band fixes that had been postponed from the September security release while upstream dependencies caught up. Two issues are rated critical at CVSS 4.0 9.5: (1) GHSA-673q-mjm6-r5xr — unauthenticated remote code execution in App Router apps with Cache Components when a use cache function returns multiple typed arrays (affected Next.js 16.0.0 through 16.4.0; fixed in 16.4.1; related React advisory GHSA-xqc2-xf4c-x3h3; no known workaround — upgrade even if you think you lack similar functions); (2) CVE-2026-96889 / GHSA-2464-fhr4-w9xw — unauthenticated RCE via the Image Optimization API when attacker-supplied SVG is processed through sharp on glibc-based Linux (affected 10.0.0–15.5.27 and 16.0.0–16.4.0; fixed in 15.5.28 and 16.4.1; workaround is sharp >= 0.35.5). A third issue, GHSA-p3m5-59mp-jv5r (related React GHSA-h3gv-c5rc-p453), is a high-severity denial of service against App Router apps that expose at least one Server Action (crafted requests can pin CPU and block further requests in the same process; Pages Router or apps without Server Actions are not vulnerable; fixed in the same patched trains). Primary: Next.js blog security update; vendor advisories on GitHub.
Next.js — Security Update for Upstream Vulnerabilities (14 Oct 2026)
The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026 for CVE-2026-108097, a remote code execution flaw in the core Field UI module (the admin UI for managing fields and their display). Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). The advisory says the issue is not directly exploitable with core alone, but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication; custom code may also expose the vulnerable functionality. Mitigate immediately by uninstalling the core field_ui module while preparing the upgrade. Fixed releases: Drupal 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 for the 12.0 beta line (beta branch only). Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix. Drupal Steward is described as protecting some known attack vectors but not all. Reported by Drew Webber of the Security Team and Octavio Galland. Primary: Drupal SA-CORE-2026-014. UPDATE 14–17 Oct 2026: In the same 14 October security window the Drupal Security Team also published SA-CONTRIB-2026-218 for the contributed Entity List module (entity_list, which builds lists of entities without Views): CVE-2026-108099, remote code execution, rated Critical 19/25 with the same risk vector. As with the core flaw, the module alone is not directly exploitable, but multiple serious exploit paths exist through other contributed modules, at least one known path needs no authentication, and custom code may also expose it. The fix is Entity List 3.0.10. BleepingComputer (17 October) reported both flaws together and noted the Security Team's pre-release warning that exploits might be developed within hours or days of disclosure. No exploitation has been reported so far.
Drupal.org — SA-CORE-2026-014: Field UI remote code execution (CVE-2026-108097, 14 Oct 2026)
The util-linux project published two security advisories with CVE records on 14 October 2026 for the set-user-ID mount utility shipped by nearly every Linux distribution. Both need a local low-privileged user whom /etc/fstab already allows to mount something (a user or users entry), and both are time-of-check to time-of-use races won by swapping a path component with renameat2(RENAME_EXCHANGE) in an ancestor directory the attacker can write to. CVE-2026-53612 (GHSA-g8wm-75wr-g2vh) is in the hook_owner post-mount hook: when the fstab entry also sets X-mount.mode, X-mount.owner or X-mount.group, mount runs chmod and lchown on a path that can be redirected to a root-owned file. It affects 2.39 through 2.41.4 and 2.42 through 2.42.1. CVE-2026-53613 (GHSA-8gj5-72r3-428g) is in restricted non-root mount requests, which check the fstab target and then resolve the path again, so the mount can be redirected to somewhere like /etc/sudoers.d. It affects 2.17 through 2.41.6 and 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Both are rated CVSS 3.1 7.0 (local, high complexity). No exploitation has been reported. Primary: util-linux GitHub advisories and CVE records.
util-linux — GHSA-8gj5-72r3-428g, mount target TOCTOU (CVE-2026-53613; 14 Oct 2026)
Palo Alto Networks Unit 42 published on 14 October 2026 its investigation of a long-running intrusion at a telecommunications managed service provider, which it tracks as CL-STA-0954 (also known as UNC5820) and says overlaps with suspected nation-state activity. Initial access, in September 2024, came through CVE-2024-47575 (FortiJump), a missing-authentication flaw in FortiManager's FGFM management channel on TCP 541 (CVSS 3.1 9.8). The attackers registered a rogue virtual FortiGate, then exfiltrated an archive with running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls that protected the provider and its clients. After a long dwell period they used FortiManager to push packet-capture rules to downstream firewalls, targeting unencrypted HTTP, TFTP, RADIUS and LDAP traffic. Unit 42 confirmed that admin and SSL VPN passwords stored as reversible ciphertext in the stolen configs could be brute-forced, and the attackers logged in to perimeter firewalls over SSL VPN with legitimate credentials. They then exploited CVE-2025-61624, a path traversal in the FortiOS CLI auto-script feature that lets an admin write files as root (Fortinet FG-IR-26-122, CVSS 5.4), to drop PEERSTITCH on selected firewalls. PEERSTITCH is a statically linked ARM64 injector that uses ptrace to patch the miglogd logging and iked IPsec daemons in memory. It leaves no binary on disk, opens no listening port and makes no outbound connection, instead hiding its communications in traffic those daemons already handle. Unit 42 did not examine the client networks, so client exposure is configuration and credential material rather than confirmed intrusion. IOCs in the report include 45.32.41[.]202, 198.199.122[.]22, 23.240.77[.]233 and 47.18.167[.]159. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on 16 October 2026 (covering FortiOS, FortiPAM, FortiProxy and FortiSwitchManager), with a 19 October deadline for US federal agencies and a forensic-triage requirement. Primary: Unit 42; vendor: Fortinet FG-IR-26-122.
Palo Alto Networks Unit 42 — FortiManager CVE-2024-47575 intrusion and PEERSTITCH malware (14 Oct 2026)
The UK Ministry of Justice published an update on 14 October 2026 on the cyber-attack it identified on 23 April 2025 against the Legal Aid Agency (LAA), the executive agency that runs legal aid in England and Wales. By 16 May 2025 the MoJ had established that the criminal group behind the attack had exfiltrated a large amount of personal data about legal aid applicants and providers. Further forensic analysis now shows that most of the stolen data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period, but about 250,000 records predate 2007. Most of those are from the 1990s and 2000s, a very small number predate 1990, and the earliest verified record is from 1978. The analysis also found that probation data from HM Prison and Probation Service was in the exfiltrated material; the MoJ says none of it relates to victims of crime. Earlier disclosures listed applicant contact details, dates of birth, national ID numbers, criminal history, employment status and financial details such as contributions, debts and payments, plus provider contracts, financial information and LAA Online Portal credentials. The MoJ says the data involved varies greatly between individuals, a pre-2007 record does not mean everyone who dealt with legal aid back then is affected, and it has no indication the stolen data has been published or shared. It is working with the National Crime Agency, the NCSC and the Information Commission. A Ministry of Justice spokesperson told BleepingComputer it is now investing more than £200 million in modernising legal aid digital services and cyber security. Primary: GOV.UK notice; wire: BleepingComputer.
GOV.UK (Ministry of Justice) — Legal Aid Agency cyber security incident data update October 2026 (14 Oct 2026)
Progress published CVE records on 14 October 2026 for at least 11 vulnerabilities in MOVEit Transfer, its managed file transfer server, all fixed in MOVEit Transfer 2025.1.6 and 2026.0.4 and referenced to Progress's MOVEit Transfer Critical Security Bulletin (September 2026). The highest-rated are CVE-2026-89067, an authentication bypass through an alternate path in Secure Messaging (CVSS 3.1 8.8, low-privileged network attacker; credited to Leo Oliver), and CVE-2026-87093, a service directory writable by local users that allows local privilege escalation (8.8). Several more weaken sign-in: CVE-2026-89068, a missing step in LDAP sign-on authentication (8.1, no privileges needed but high complexity); CVE-2026-89074, an email MFA bypass through unicode handling (7.5); CVE-2026-89070, OIDC authentication replay (7.5); CVE-2026-89073, an OAuth access-restriction bypass through weak session expiry (7.5); CVE-2026-89071, LDAP injection in certificate-based authentication (7.5); CVE-2026-89072, an authorisation flaw in client-certificate management (7.5); and CVE-2026-89077, an identity-validation flaw in SFTP authentication (7.5). The set also includes SQL injection in Custom Reports for admins (CVE-2026-89076, 7.2) and local disclosure of session information (CVE-2026-89075, 7.3). The CVE records do not report exploitation. MOVEit Transfer matters for Australian organisations because internet-facing MOVEit servers were mass-exploited by the Clop gang in 2023 (CVE-2023-34362).
Progress — MOVEit Transfer Critical Security Bulletin, September 2026 (CVE records published 14 Oct 2026)
