According to The Verge (13 October 2026, US time; 14 October, 5:59 am Perth), citing SecurityWeek, Meta says its GitHub was hacked, exposing the personal data of 1,500 people. The Verge reports, citing SecurityWeek, that Meta says "99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data," some of which was "synthetic or anonymized", and that most of that personal data reportedly belonged to Meta employees in the US. No Australian impact has been stated. Primary: The Verge, citing SecurityWeek. Correction (25 Oct 2026): the card now rests on The Verge's report; details The Verge does not state (stolen employee credentials, detection timing, Meta's response steps, credit monitoring, regulator notification and notification dates) have been removed, and the card date has moved from 13 to 14 October 2026, the Perth date of The Verge's report (13 October, 21:59 UTC; 14 October, 5:59 am Perth). (source: The Verge)
The Verge — Meta says its GitHub was hacked, exposing 1,500 people's personal data (13 Oct 2026 US time; citing SecurityWeek)
Have I Been Pwned (HIBP) added Crunchbase on 14 October 2026 (06:01 UTC; 14:01 Perth time). HIBP says the private company intelligence platform was targeted in a ShinyHunters 'pay or leak' extortion attempt in January 2026, and that data allegedly obtained from the company was then published, including about 560,000 unique email addresses, largely of leads and business contacts, along with names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. In a statement reported by Security Affairs on 26 January 2026, Crunchbase said it "detected a cybersecurity incident where a threat actor exfiltrated certain documents from our corporate network", that no business operations were disrupted, that the incident was contained, that it engaged cybersecurity experts and contacted federal law enforcement, and that it was reviewing the impacted information to decide whether any notifications were required. Australian contacts are not separately stated. UPDATE 22 Oct 2026: re-sourced Crunchbase's acknowledgement to Security Affairs and attributed the data details to Have I Been Pwned (source: Security Affairs, 26 Jan 2026).
Have I Been Pwned — Crunchbase breach (added 14 Oct 2026 UTC; breach January 2026)
Mandurah State Emergency Service has confirmed the incident to Cyber Daily (14 October). A spokesman said the WA Office of Digital Government's Cyber Security Operations Centre (WASOC) notified it on 5 October of a cyber security incident involving unauthorised access to one of its servers. That server held only historical records from before 2022, and there is no evidence any other systems were affected. Operations continue as normal. The unit says it is aware further data was published online as of 13 October. Per Cyber Daily, the leak includes several zip files of compressed backups and a backup folder of historical operations and planning data. Mandurah SES is contacting past and present members who are affected and, with DGov's guidance, advising them on how to protect their personal information. DFES is supporting the unit, and the WASOC-supported investigation into the extent of the incident is ongoing. Mandurah SES, a DFES volunteer SES unit in Western Australia, was listed on The Gentlemen ransomware gang's leak site, according to Cyber Daily. The Gentlemen emerged in September 2025 and, per Cyber Daily, is now second only to Qilin by victim count; Cyber Daily says its most recent Australian victim was All Souls St Gabriels School in Charters Towers. Primary: Cyber Daily (unit statement). Correction (25 Oct 2026): removed leak-site tracker links and the listing and attack dates they gave; the listing is now credited to Cyber Daily. The card date has moved from 2 to 14 October 2026, the Perth date of Cyber Daily's report (13 October 23:52 UTC, 14 October 07:52 Perth time (AWST)). (source: Cyber Daily)
Cyber Daily — Exclusive: Mandurah SES confirms operations unaffected by ransomware attack (14 Oct 2026)
Siemens ProductCERT published advisory SSA-591731 on 13 October 2026 for eight vulnerabilities (CVE-2026-63350 to CVE-2026-63357) in the web server of SIMATIC S7-1500 devices. Siemens says affected devices do not properly validate or sanitise content in imported trace files (including calculated signals in CSV trace files) before rendering it on the web server's Trace page, so an attacker could social engineer an authorised user who holds the function right 'Read diagnostics' into importing a specially crafted file; successful exploitation could let attacker-controlled JavaScript run in the user's browser session and perform PLC operations through the web server within the scope of that user's authorisation. Siemens rates three of the flaws (CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354) CVSS 3.1 9.6 / CVSS 4.0 9.4 and the other five CVSS 3.1 6.1 / CVSS 4.0 5.3. Siemens lists all versions of the affected products, including S7-1500 CPUs (with related ET 200 CPUs and SIPLUS variants), S7-1500 MFP and ODK CPUs, the S7-1500 Software Controller, ET 200SP Open Controller, SIMATIC Drive Controllers and S7-PLCSIM Advanced, and says 'Currently no fix is available' for each; it says it is preparing fixes and recommends mitigations in the meantime. Primary: Siemens ProductCERT SSA-591731 (V1.0, 13 Oct 2026). Updated 22 Oct 2026: CISA republished Siemens' advisory as ICSA-26-295-14 (8:00 pm Perth time). (source: CISA)
Siemens ProductCERT — SSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server (13 Oct 2026, V1.0)
Adobe released security bulletin APSB26-144 for ColdFusion on 13 October 2026, its October Patch Tuesday, with 31 CVE records published the same day by Adobe as the CVE numbering authority. Three are scored 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed): CVE-2026-105899, an unrestricted upload of a dangerous file type that Adobe says could lead to arbitrary code execution; CVE-2026-106624, a code-injection flaw leading to arbitrary code execution; and CVE-2026-106622, a server-side request forgery (SSRF) flaw that could lead to privilege escalation. Two more, CVE-2026-105903 (code injection) and CVE-2026-106612 (incorrect authorisation), are scored 9.9 and need only a low-privileged account. Others in the bulletin include CVE-2026-106621 (9.1, code injection without authentication), CVE-2026-106619 (9.0, input validation, high attack complexity), CVE-2026-106620 (9.6, authorisation bypass giving write access), CVE-2026-75994 (9.6, code execution from the administrative network zone), CVE-2026-90530 (9.3, path traversal in the RDS developer feature), and a long list of 7.1 to 8.8 authorisation, SSRF, XXE and denial-of-service bugs. Adobe's CVE records list ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 as affected, fixed in 2025.0.14 and 2023.0.26. The record for CVE-2026-90530 notes that RDS is a development feature that the Production Secure Profile disables automatically. We found no reports of exploitation, and none of these CVEs is in CISA's Known Exploited Vulnerabilities catalog as of 20 October, but internet-facing ColdFusion servers have been exploited quickly after past bulletins, so treat this as urgent. Details come from Adobe's CVE records; Adobe's bulletin page refused our fetch. Primary: Adobe APSB26-144 and Adobe CVE records.
Adobe — APSB26-144 Security updates available for Adobe ColdFusion (13 Oct 2026)
MITRE released ATT&CK v20 on 13 October 2026, updating techniques, groups, campaigns and software across the Enterprise, Mobile and ICS matrices. MITRE says the biggest change is broader coverage of recent adversary activity, including AI-focused and AI-enabled techniques. New Enterprise techniques are Direct Prompt Injection, Indirect Prompt Injection, AI-Enabled Exfiltration, Stage Capabilities: AI Result Poisoning, Disable or Modify Tools: Impair Autonomous Defenses, Anti-Automation Evasion (with sub-techniques for automating CAPTCHA completion and avoiding CAPTCHA) and Steal Application Specific Passwords, each with new detection strategies. Supply Chain Compromise: Compromise Software Dependencies and Development Tools moves to version 2.0. New campaigns are '2026 U.S. Water Utilities Attacks' (ICS) and 'AI-Assisted Breach of Mexico's Government Infrastructure'. New groups are NIMBUS MANTICORE and The Gentlemen (whose ransomware is also added as software), and Salt Typhoon and APT38 entries get major revisions. ICS gains execution techniques for command and scripting interpreters (PowerShell, Python, JavaScript, Unix shell, Visual Basic, Windows command shell) and command and control over DNS and publish/subscribe protocols, while the older ICS Command-Line Interface and Scripting techniques are deprecated. Mobile un-deprecates Deliver Malicious Application via Other Means. The release counts 971 software entries, 182 groups and 61 campaigns; Enterprise now has 227 techniques and 479 sub-techniques. Why it matters: teams that map detections, threat models or red-team plans to ATT&CK now have standard IDs for prompt-injection and AI-agent abuse, and ICS teams have script-execution techniques to map. Primary: MITRE ATT&CK October 2026 update notes; context: ATT&CK v20 blog post; wire: Cyber Security News.
MITRE ATT&CK — Updates, October 2026 (v20, 13 Oct 2026)
Adobe's security bulletin APSB26-153, published on 13 October 2026, fixes CVE-2026-103849, a template-engine injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker run arbitrary PHP on the store server. E-commerce security firm Sansec, which named the flaw BlockStrap (reported to Adobe by researcher vozec), said on 15 October that it reproduced four separate routes to code execution within 24 hours of the patch, although it had not yet seen attacks on live stores. BlockStrap is a second-pass directive injection: September's StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) signs trusted template directives, but attacker-controlled data in a child email template can still be signed and re-scanned at the root level, where a smuggled {{block}} directive runs. Adobe's fix replaces that generic re-scan with registered placeholders. Adobe rated the bulletin priority 2 (patch within 30 days) because it reserves priority 1 for flaws it knows are exploited; Sansec disputes that, noting StyleSmuggler went from hotfix to mass exploitation in three days. A plain Composer install still pulls the vulnerable base version, so stores need the 2026-oct release or Adobe's isolated patch, and the October patch does not include the StyleSmuggler hotfix, which must stay installed separately. Public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9; patches for 2.4.4 to 2.4.6 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older must upgrade. Mage-OS 3.6.0 (14 October) includes the fix. Primary: Adobe APSB26-153; research: Sansec (15 Oct); wire: BleepingComputer (16 Oct).
Adobe — APSB26-153 security update for Adobe Commerce and Magento Open Source (13 Oct 2026)
SolusVM published advisory CVE-2026-105474 (updated 13 October 2026) for a server-side template injection in SolusVM 2, the virtual-server control panel used by many hosting providers. An authenticated user can execute arbitrary code on the server with elevated privileges, which SolusVM says can lead to full compromise of the management node and affect other customers hosted on the same node. Rapid7 records CVSS 4.0 base score 9.4 (Critical) for the issue and describes remote authenticated users reaching root. Affected: all SolusVM 2 builds through 2.0.0-44576. Patched version listed by SolusVM: 2.0.0-44739. The advisory tells operators to update to 2.0.0-44739 or later once that build is available. Credited to Georgii Shutiaev. No in-the-wild exploitation is stated in the vendor note or the Rapid7 entry this pass. Primary: SolusVM support advisory; CVE record published around 15 Oct 2026 per Rapid7.
SolusVM — CVE-2026-105474 Server-Side Template Injection in SolusVM 2 (updated 13 Oct 2026)
Arch Linux community members raised the alarm on the aur-general mailing list on 13 October 2026, in a thread titled 'hundreds of aur packages were mass uploaded with malware'. A user named marchos1as had uploaded packages to the Arch User Repository (AUR) under typosquatted names of yay and paru, the two most popular AUR helper tools. The AUR is the community-run index of build scripts (PKGBUILDs) used on Arch Linux and Arch-based distributions. AUR maintainer Andreas Reichel's analysis of one package, 'yyay', found it reused the legitimate yay upstream URL and source tarball but shipped a malicious install scriptlet. Outside any function, so it ran unconditionally as root on every install and upgrade, the scriptlet piped a script fetched through an unpinned Wayback Machine URL into a shell. That URL pointed to a personal repository, hellscripter/install-scripts, on the Russian code host GitFlic. The post_install and post_upgrade functions were emptied to look harmless. Maintainer Emiliano Gandini Outeda flagged further packages with his open-source TrustSight scanner. The AUR team banned the account and removed the packages. The exact number of malicious uploads has not been published. BleepingComputer notes a possible link to the 'DirtyBlanket' npm campaign documented by SafeDep. OSV advisory MAL-2026-17242 says nine npm packages published on 29 September (including express-javascript) fetched a second stage from a hellscripter/install-scripts repository on Codeberg via the Wayback Machine. On Linux that stage runs linux.sh, a worm that installs a Go binary as a 'Font Rendering Service' systemd service (systemd-fontd) proxied over Tor, collects SSH private keys and known_hosts, and spreads to known hosts over SSH. BleepingComputer says the worm deployed the CHAOS RAT and injected a loader into AUR packages, but there is no confirmation the two operations are related. The AUR was also hit in June (about 400 packages carrying credential-stealing malware with rootkit features) and July, when Arch temporarily disabled package adoption. Primary: aur-general mailing list; wire: BleepingComputer (15 Oct).
aur-general (Arch Linux) — Re: hundreds of aur packages were mass uploaded with malware (13–14 Oct 2026)
CISA published ICS advisory ICSA-26-286-01 on 13 October 2026 for Inductive Automation's Ignition, the SCADA/HMI and industrial application platform. CVE-2026-92817 (CWE-266, incorrect privilege assignment) is in the Perspective module, which does not properly validate session privileges when it decides whether a user has Designer-level access. An authenticated user with access to a Vision project can present their valid Vision session identifier and be granted Designer privileges, then use them to execute arbitrary code in the context of the Ignition Gateway process. Affected: Ignition 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. CISA scores it CVSS v3.1 8.8 and CVSS v4.0 8.7 and lists Critical Manufacturing, Energy and Information Technology as the sectors where Ignition is deployed. Per CISA, Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to fix the issue, and recommends updating to the newest version available. The flaw was reported to Inductive Automation by Tim Hemingway. CISA says no known public exploitation specifically targeting this vulnerability has been reported to it. Because the Gateway runs the plant-facing projects, code execution there can reach connected OT systems, so treat Vision project access as a privileged right until patched. Primary: CISA ICSA-26-286-01; vendor: Inductive Automation Trust Center bulletin (its page sits behind a browser check and could not be read for this card); CVE record published 13 October.
CISA — ICSA-26-286-01: Inductive Automation Ignition Software (13 Oct 2026)
Adobe published security bulletin APSB26-152 for Adobe Experience Manager (AEM), with CVE records released on 13 October 2026, its October Patch Tuesday. CVE-2026-48382 and CVE-2026-48383 are incorrect-authorisation flaws (CWE-863) that Adobe says could result in arbitrary code execution, potentially giving the attacker elevated access or control over a victim's account or session. Adobe scores both 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed). Affected releases are AEM as a Cloud Service up to 2026.9.28187, AEM 6.5 LTS up to SP3, and AEM 6.5 up to 6.5.25. Fixes are AEM as a Cloud Service 2026.9.28386 and a hotfix for GRANITE-72352 on 6.5 LTS SP1 to SP3 and on AEM 6.5.20 to 6.5.25. Details come from Adobe's own CVE records. No exploitation has been reported. This is separate from the September AEM Forms bulletin (APSB26-151) on this desk. Adobe also released ColdFusion bulletin APSB26-144 the same day, with 31 CVEs including three CVSS 10.0 flaws that need no login; it has its own card: /n/adobe-coldfusion-apsb26-144-cvss10-105899-20261013.
Adobe — APSB26-152 Security update available for Adobe Experience Manager (Oct 2026)
The US Department of Justice and Meta announced on 13 October 2026 the results of a 'Joint Disruption Week' against scam networks operating from West Africa, the first coordinated operation focused on the region. The UK National Crime Agency hosted it in London from 6 October with the DOJ, FBI, US Secret Service, Treasury, Homeland Security Investigations, Nigerian and Ghanaian cybercrime units, INTERPOL, and law enforcement from Australia, Canada, New Zealand and India. Industry partners including Meta, Google, Microsoft, OpenAI, Coinbase, Binance, Adobe, Starlink, Chainalysis, Elliptic, TRM Labs, Flashpoint, Silent Push and Cyjax shared intelligence and acted on their own platforms. Meta removed more than 3.7 million Facebook and Instagram accounts, Pages and Groups based in West Africa, most posing as American and British users; Microsoft suspended linked accounts; partners shared leads on more than 30 suspected scam centres and identified over US$11 million in potentially freezable funds, and Coinbase says it stopped more than US$415,000 in losses to 65-plus active victims. Authorities made 28 arrests: in Sasaabi near Accra, Ghana, 19 people were arrested, 303 devices seized, 117 human-trafficking victims identified for repatriation to Nigeria and 89 scam victims with about US$8.3 million in losses found; Nigeria made nine arrests and seized 53 devices. The schemes included law-enforcement impersonation, 'digital arrest' extortion and cryptocurrency investment fraud (pig butchering). Neither announcement names Australian victims.
US Department of Justice — Results of law enforcement and private industry Joint Disruption Week targeting West African scam networks (13 Oct 2026)
