A territory-wide technical network outage knocked out telecommunications and digital systems across key Northern Territory government departments and agencies on 8 October 2026, including Police, Health and Education. It began at about 3am NT time (4.30am Sydney) and was resolved about 12 hours later through what the government called undisclosed workarounds by the Department of Corporate and Digital Development (DCDD). NT Police, Fire and Emergency Services issued a public advisory that non-emergency communications, including police assistance lines and phone lines to local police stations, were affected, while triple zero (000) stayed up and all Territory hospitals kept providing patient care. Other agencies reported problems with phone lines, email and network-connected servers. DCDD says it is still investigating the root cause and how to prevent a repeat; the government has not said what caused the outage, and nothing published so far points to a cyber attack. Primary: NT Police, Fire and Emergency Services public advisory; wire: iTnews. UPDATE (23 Oct 2026): iTnews (8 Oct), citing ABC News (8 Oct), reported that the problem was linked to a gateway in the core network, and that three calls were missed during the outage, although checks found they were routine police follow-ups rather than emergencies, which qualifies the government's line that triple zero kept working throughout. DCDD's root-cause review is still open.
NT Police, Fire and Emergency Services — Public advisory: technical network outage affecting non-emergency communications (8 Oct 2026)
Microsoft has added two Teams meeting features to the Microsoft 365 Roadmap, BleepingComputer reported on 8 October 2026. The first lets organisations plug in certified third-party tools that analyse meeting audio and video for signs of synthetic or manipulated media and send detection signals into Teams, which will surface them in the meeting with related controls. The second, impersonation protection, warns users and shows risk indicators when Teams detects that a meeting organiser or participant may be pretending to be someone else. Both are in development, with a worldwide rollout and general availability planned for November. They follow other Teams anti-abuse changes: admins locking out external users through the Defender portal, blurring of QR codes from external senders, a meeting policy that blocks identified external bots, and reporting of suspicious guest invitations from November. The deepfake feature depends on buying a supported third-party provider; Microsoft has not named providers or prices. Source: BleepingComputer, citing Microsoft 365 Roadmap entries.
BleepingComputer — Microsoft Teams to get support for third-party deepfake detection tools (8 Oct 2026)
JPCERT/CC issued alert JPCERT-AT-2026-0030 on 8 October 2026 about a run of unauthorised-access incidents that leaked large amounts of personal data from Japanese organisations around September 2026. It names no attacker or victim and calls its picture limited and fragmentary. It describes three patterns: attackers pulling API keys from smartphone apps and calling APIs in ways that look like normal use, then hunting for APIs that return too much data, have excessive privileges, expose member functions to anonymous users or mishandle sessions (weak admin passwords and known flaws were also seen); attackers scanning each target for a range of known flaws and stealing configuration and backup files; and exploitation of CVE-2026-72898, the unauthenticated Metabase SQL injection (CVSS 10.0) that was a zero-day against Metabase's own cloud in August and is on CISA's KEV list. Targets include consumer apps, business intelligence tools and staff-facing management systems their operators never meant to be public. The alert lists eight source IP addresses, five User-Agent strings and API controls such as access checks on every endpoint, public or not. The security research centre of Macnica, cited by the alert, counted 119 publicly reported web-system personal data leaks in Japan this year to 6 October (84 in all of 2025, 62 in 2024), 81 of them since July. Primary: JPCERT/CC (Japanese); wire: The Hacker News. UPDATE (13 Oct): Japan's government has since responded across agencies. The Cabinet Secretariat's National Cybersecurity Office (NCO) issued an advisory dated 9 October 2026 saying it had confirmed multiple cases in which systems of companies handling large volumes of personal data were breached through web-system vulnerabilities, supply-chain compromise and weak data management. It asks those companies to patch promptly (including internal servers), retire unsupported products, use MFA, trim admin accounts, keep and watch logs, and check contractors and sub-contractors, and to share technical details with the NCO or their ministry. Jiji Press reported that cybersecurity minister Toshiharu Furukawa chaired the first cross-ministry meeting on the leaks on 8 October and told agencies to report leaks to the NCO so information is held centrally; the NCO said attacks on private companies began rising in August and that defenders should assume attackers use AI. The Financial Services Agency warned financial institutions on 9 October that recent breaches leaked customer data including images of identity documents such as driver's licences, and asked them to guard against impersonation in remote identity checks. The advisories are requests, not new legal duties. Primary: NCO advisory (Japanese PDF); FSA notice; Jiji Press.
JPCERT/CC — JPCERT-AT-2026-0030: alert on recent successive unauthorised access at domestic organisations (8 Oct 2026, Japanese)
GreyNoise reported on 8 October 2026 a rise in scanning and exploitation attempts against digital video recorders and cameras in Ukraine between 21 September and 1 October 2026. Almost all of it targeted CVE-2021-36260, the 2021 unauthenticated command injection in the web server of many Hikvision products (CVSS 9.8, NVD). Reconnaissance started on 21 September from a Ukrainian IP address; exploitation attempts jumped from near zero on 23 September and ran to 1 October. Four IP addresses sent nearly all of them: three PureVPN exit nodes (195.238.124.178, .181 and .188, AS56630) and one Ukrainian domestic address, which GreyNoise links to the VPN activity only with low confidence. Every request used the same command test from the public Nuclei template for this bug, with no payload, and the four addresses did not try it against GreyNoise sensors outside Ukraine; nothing more came from them through 7 October. GreyNoise records attempts, not confirmed takeovers, and does not link the activity to the missile and drone strikes it coincided with. Context: Ukraine said in January 2024 that Russian intelligence had used two hijacked cameras to watch Kyiv air defences. Primary: GreyNoise; wire: Cyber Security News.
GreyNoise — Spike in attacks targeting digital video recorders in Ukraine (8 Oct 2026)
Software supply-chain security firm Apiiro reported, and BleepingComputer covered on 8 October 2026, that the FakeGit campaign resumed on 4 October and now uses 17,610 GitHub repositories to spread SmartLoader, a loader that pulls in further malware such as the StealC infostealer. In 34 hours the operator pushed changes to more than 13,000 repositories, peaking at 2,999 an hour; in sampled commits 97% touched only the README and 88% pointed its Download button at a ZIP that installs SmartLoader. Most accounts are disposable, but at least 700 appear to belong to real developers. Island named the operation in July after finding 7,600 such repositories, 800 of them posing as AI skills or MCP servers listed in public AI registries. Apiiro says takedowns fail because they work from lists that cover a fraction of the repositories, and copies sit in forks, older files, release assets, issue attachments and separate download repositories, so the operator just changes the link. 71% of the fleet was missing from URLhaus before the report, and DNS blocking cannot single out one file on GitHub. Primary: Apiiro research; wire: BleepingComputer.
Apiiro — FakeGit research: never deleted, only re-pointed (Oct 2026)
Strapi Cleartext Storage of Sensitive Information Vulnerability. Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ONLYOFFICE Docs Server Path Traversal Vulnerability. ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Apache Struts Command Injection Vulnerability. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ISC BIND Data Processing Errors Vulnerability. ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ProFTPD Improper Access Control Vulnerability. ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
SEC Consult published technical details on 8 October 2026 of five vulnerabilities it reported to TP-Link from December 2024 in ISP-supplied (Aginet) mesh systems, routers, fibre (PON) devices and DSL modems. TP-Link says 65 models are affected, including ISP-customised variants; the list includes Australian models HX510(AU) and HX220(AU). CVE-2025-30237 is an authentication bypass in the web server that lets an unauthenticated attacker with access to the web interface create a super-administrator and enable SSH; CVE-2025-30238 lets a low-privileged user act as an administrator; CVE-2025-30241 is authenticated command injection as root; CVE-2025-30239 is hardcoded, model-wide keys protecting configuration files and backups, so extracted keys reveal user, Wi-Fi and sometimes ISP remote-management credentials; CVE-2025-30240 needs physical USB access to read the whole file system. SEC Consult says an attacker on the same network could fully take over a device. TP-Link disclosed the flaws in August 2026; its fixes, including custom ISP firmware, rolled out into 2026 and are distributed by ISPs. Separately, the attorneys general of Florida, Iowa, Montana and Nebraska filed near-identical consumer protection lawsuits against TP-Link Systems on 6 October, after Texas in February, alleging its HomeShield marketing overstated protection, citing past use of TP-Link routers in Volt Typhoon and Flax Typhoon activity, unsupported models without updates, and undisclosed ties to China; they cite these five CVEs. TP-Link's response is not in the reporting. No exploitation of the five flaws is reported. Primary: SEC Consult; wire: SecurityWeek.
SEC Consult Vulnerability Lab — Multiple critical vulnerabilities in multiple TP-Link device series (8 Oct 2026)
Oregon's Department of Justice breach database lists two Cerner Corporation entries for the breach of Oracle Health's legacy Cerner systems, for 1,970,332 Oregonians (reported 25 July 2025) and 8,329 (reported 6 July 2026), both giving 22 January to 1 April 2025 as the breach dates and 20 February 2025 as the discovery date. HIPAA Journal reported on 8 October 2026 (3:12 pm Perth) that the Texas attorney general was given an updated total on 2 October and that state filings confirm 2,992,244 affected people in Texas, 283,903 in South Carolina and 69,238 in Washington. HIPAA Journal says Oracle Health has not publicly disclosed the total number of people affected or how many Cerner clients were affected. A sample patient letter dated 25 July 2025, filed by Cerner Corporation with the California attorney general, says an unauthorised third party gained access to personal health information on legacy Cerner systems at least as early as 22 January 2025, that the provider sending it learned of the breach on 7 March 2025, and that federal law enforcement asked for patient notification to be delayed. The letter says the information may have included names, Social Security numbers and medical record information such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment, and offers 24 months of Experian IdentityWorks. HIPAA Journal says the incident involved two legacy Cerner servers that had not yet been migrated to Oracle Cloud, and that Oracle Health said its own systems were not affected. HIPAA Journal, citing a Bloomberg report of a Texas AG filing, puts the total at almost 20 million; this has not been independently verified. Updated 10 Oct 2026 (Fierce Healthcare, 9 October US time; 4:00 am 10 October Perth): Fierce Healthcare says Cerner's entry on the Texas attorney general's breach portal, dated 2 October 2026, lists addresses, Social Security numbers and medical information, and that affected Texans were notified by US mail. Bloomberg first reported the breach on 5 October (US time), according to Fierce Healthcare. (source: Fierce Healthcare) Correction (23 Oct 2026): removed an extortionist's ransom demand. Correction (23 Oct 2026): re-sourced to HIPAA Journal, Fierce Healthcare, the Oregon Department of Justice breach database and the California attorney general's sample letter; removed details we could not verify from a source we can recheck; removed the third-hand nationwide total from the headline and kept it only as one attributed line; Oregon figures are now given as filed. (source: HIPAA Journal) Correction (26 Oct 2026): the Australia field said no Australian impact had been reported; no cited source mentions Australia either way, so it now reads unknown. (source: HIPAA Journal) Correction (26 Oct 2026): the card date has moved from 5 to 8 October 2026, the Perth date of HIPAA Journal's report, the earliest linked source for this story; Fierce Healthcare's later report now carries an Updated line. Bloomberg's earlier report (5 October US time, according to Fierce Healthcare) cannot be read by this desk. The 2025 breach notices are background and do not set the date. (source: HIPAA Journal; Fierce Healthcare)
HIPAA Journal — Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner (8 Oct 2026)
