Machinery management specialist Macquarrie has confirmed it is responding to a cyber security incident at a third-party supplier, Cyber Daily reported on 14 September 2026: 'The Sharp Motor Group and machinery management specialist Macquarrie both recently confirmed they were responding to a cyber security incident at a third-party supplier.' On 15 September Cyber Daily reported that Sharp Motor Group, Penfold Motors and Macquarrie 'have all confirmed their incidents were linked to a third-party cyber incident, which Cyber Daily understands was the one just disclosed by Auto-IT'; Auto-IT told Cyber Daily it could not comment on individual customers, and Cyber Daily does not quote Macquarrie naming the supplier (see auto-it-storm-20260915). No Macquarrie customer notice, OAIC entry or ACSC advisory has been found. Primary: Cyber Daily (14 Sep); Cyber Daily (15 Sep).
Cyber Daily — Exclusive: Penfold Motors latest car dealer to fall victim to the Storm ransomware group (14 Sep 2026; Macquarrie confirmation)
Exploit-DB entry 52680 (dated 3 September 2026) and Metabase advisory GHSA-w95f-x9v9-wv36 cover CVE-2026-59827: Metabase instances with an H2 database connection (including the default sample database) deserialize arbitrary Java objects from native H2 query result columns of type OTHER without validation. An authenticated user who can run native queries against an accessible H2 connection can execute OS commands on the Metabase host. Affected ranges in the exploit write-up include ≥0.58.0 <0.58.15, ≥0.59.0 <0.59.12, ≥0.60.0 <0.60.6.3, and ≥0.61.0 <0.61.1.4. Patch Metabase; remove or lock down sample/H2 connections; restrict who can run native SQL.
Exploit-DB entry 52681 (dated 3 September 2026) documents a public remote-code-execution exploit for CVE-2025-57819 in FreePBX Endpoint Manager. The flaw is an unauthenticated SQL injection in the brand parameter of /admin/ajax.php that can insert a malicious cron_jobs row and yield a reverse shell as the web user. Affected branches per the exploit write-up: FreePBX 15.x before 15.0.66, 16.x before 16.0.89, and 17.x before 17.0.3 (title tested against 17.0.2). The write-up cites CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-89 and CWE-288, NVD, and GitHub advisory GHSA-m42g-xg4c-5f3h. Upgrade Endpoint Manager / FreePBX to the fixed releases; restrict admin/ajax exposure; hunt for unexpected cron_jobs entries. Correction (25 Oct 2026): FreePBX's own advisory (GHSA-m42g-xg4c-5f3h, 28 August 2025) and the CVE record score CVE-2025-57819 at 10.0 Critical under CVSS 4.0; 9.8 is the score cited in the Exploit-DB write-up. FreePBX also says that starting on or before 21 August 2025 an unauthorised user began accessing multiple FreePBX 16 and 17 systems connected directly to the internet by exploiting this flaw, and CISA added it to its Known Exploited Vulnerabilities catalog on 29 August 2025; the card had described only a public exploit. (source: FreePBX GHSA-m42g-xg4c-5f3h; CISA KEV catalog)
The Hacker News (3 September 2026) reports researcher Chaotic Eclipse published FalconFlank, a public local privilege-escalation exploit demo that abuses CrowdStrike Falcon Sensor’s Office malicious-macros remediation path on fully updated Windows 11 25H2 and Windows Server 2025. The researcher said Falcon may already detect the demo code and that lab checks may need exclusions or obfuscation. A CrowdStrike spokesperson told THN the company is investigating, advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, said customers remain protected through Cloud Anti-malware for Microsoft Office Files, and pointed operators to the FalconFlank Tech Alert in the CrowdStrike support portal. Review the portal alert, apply CrowdStrike guidance, and treat the public exploit code as high-signal for endpoint labs.
BleepingComputer (3 September 2026) reports Hewlett Packard Enterprise patched a critical buffer-overflow remote code execution issue in ArubaOS-CX, tracked as CVE-2026-73749: an unauthenticated remote attacker can send crafted packets to an affected daemon and execute code with elevated privileges. HPE security bulletin hpesbnw05134en_us lists fixed builds by branch: 10.18.0001 → 10.18.1002+; 10.17.1021 and earlier → 10.17.1030+; 10.16.1051 and earlier → 10.16.1060+; 10.13.1180 and earlier → 10.13.1190+; 10.10.1180 and earlier → 10.10.1181+ (10.10.1181 is End of Maintenance and receives only critical internal fixes). The same bulletin covers about 23 further issues; Bleeping citing HPE places several authenticated management flaws (including CVE-2026-73750/73751/73752 and related) in the high range around 8.1–8.8. WA SOC advisory 20260909002 (9 September 2026, TLP:CLEAR) covers the same CVE-2026-73749 RCE (CVSS 9.8 Critical), lists the same fixed branches, and states it has not received reports of exploitation on Western Australian Government networks at the time of writing. Upgrade AOS-CX switches to the fixed release for your branch; restrict management-plane exposure until patched.
BleepingComputer (3 September 2026) and Wordfence (via The Hacker News, 4 September 2026) report active exploitation of CVE-2026-32475 in Elementor Pro for WordPress. Faulty validation of file-upload arrays in Elementor Pro forms (versions 4.2.1 and earlier) lets an attacker submit an empty first array element and a malicious PHP file as the second, so later files skip validation. The payload lands under /wp-content/uploads/elementor/forms/ and can be fetched to run commands. Elementor shipped 4.2.2 on 19 August 2026. Wordfence says it blocked about 190,000 exploit attempts against this CVE (and over 250,000 against Super Forms CVE-2026-14894 in the same wave — that CVE has its own desk card). Exploitation needs a published Elementor Pro Form widget with at least one File Upload field. Patchstack disclosed the issue earlier. Upgrade Elementor Pro to 4.2.2 or later; review uploads under elementor/forms for unexpected PHP; keep WAF rules current.
BleepingComputer (3 September 2026) reports France’s CNIL fined Hôpital privé de la Loire (HPL, Ramsay Santé group, Saint-Étienne) €500,000 for GDPR security and notification failures after a summer 2025 intrusion into the electronic patient record system exposed sensitive data of 524,867 patients plus 202,246 trusted third parties (about 727,000 people). CNIL findings cited include external physician access without VPN or multi-factor authentication, overly broad access once an account was compromised, lack of near-real-time monitoring that let exfiltration run for days, and failure to directly notify the trusted-third-party cohort (Articles 32 and 34 GDPR). HPL strengthened controls during proceedings. Practitioners: remote clinical access needs MFA and VPN; least privilege on EPR; detection that catches multi-day bulk extract; notify every category of affected individual. Correction (25 Oct 2026): removed a sentence that rested on the attacker's own account of how he got in and what he did with the data. (source: BleepingComputer)
The Hacker News (3 September 2026) summarises Group-IB research on BraZetsu, a modular Python-based Windows malware framework attributed to Portuguese-speaking operators tracked as Exilware. Unlike a simple infostealer, BraZetsu is described as a master toolkit for initial access brokers: it commercialises access to compromised hosts for Iberian and Latin American e-commerce and corporate targets, with modular staging and stealth that left some samples fully undetectable on VirusTotal at analysis time. Name blends Brazil with the Naruto character Zetsu. Defenders in those regions should hunt for the BraZetsu toolkit behaviours in Group-IB’s write-up, restrict script interpreters where policy allows, and treat brokered access listings as post-compromise inventory rather than the root cause.
Microsoft Threat Intelligence (2 September 2026) documents a human-operated campaign abusing Microsoft Teams external collaboration: actors in a separate Microsoft 365 tenant impersonate IT/helpdesk, coax users past external-tenant labels into granting interactive remote access (Teams request-control, Quick Assist, or similar RMM), then use PowerShell to silently install a malicious MSI from cloud storage that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, Active Directory reconnaissance, desktop capture, and WinRM lateral movement toward domain controllers and other high-value hosts. As background, Expel (20 August 2026) separately detailed a related Teams helpdesk-phishing delivery of SynkLoader (MSI presented as “PowershellCleaner” from an Azure blob endpoint; sender display name IT Service Desk on a *.onmicrosoft.com tenant), including a PhishLocker module that shows a fake Windows lock screen designed to trick the user into giving up their system login credentials, plus a tunneling module for follow-on access. ScamDrill (17 September 2026) and CyberSecurityNews (22 September) summarize the same pattern for SMB defenders. Not a Teams product CVE — social engineering of legitimate external chat and remote-support features. Distinct from desk card prey-0058-m365-vishing-20260903 (phone vishing + AiTM MFA-registration domains). Australia relevance: M365/Teams tenants with open external access — restrict to trusted domains, verify unsolicited IT chats out-of-band, control Quick Assist/RMM, and hunt MSI→Node.js under LocalAppData plus user-context WinRM.
Microsoft Security Blog — Impersonating IT support / Teams remote-session intrusion (2 Sep 2026)
Cyber Security Minister Tony Burke launched the pilot of Australia's Voluntary Security Labelling Scheme for Smart Devices (SLSSD) at the Connecting Technology Summit on 2 September 2026. The scheme is co-developed by the Department of Home Affairs and the Connected Technology Alliance (CTA), funded by Home Affairs, and sits under the 2023–2030 Australian Cyber Security Strategy. Labels give consumers an independently verified Level 1–4 security rating for consumer-grade smart-home IoT (TVs, doorbells/cameras, baby monitors, robot vacuums, solar inverters; not cars, medical devices, phones, tablets or PCs). Pilot vendors named: NetComm, Telstra, ASSA ABLOY/Lockwood, Electrolux; labs: Viden, Securus Consulting Group, Teron Labs, DEKRA, TÜV SÜD. Industry pilot phase from about October 2026; voluntary labels expected on products from 2027. Distinct from the mandatory Cyber Security (Security Standards for Smart Devices) Rules 2025 (commenced 4 March 2026) that require no default passwords, vulnerability reporting paths, and update-policy clarity, with a statement of compliance — the SLSSD badge is designed to surface that compliance. Primary: CTA Labelling Scheme page; wires: techpartner.news 3 Sep, ACS Information Age 8 Sep.
Connected Technology Alliance — Security Labelling Scheme for Smart Devices
Elastic Security Labs (2 September 2026) analyses REVSTEALER, an emerging Windows infostealer that hides backup C2 addresses in Polygon smart contracts, and documents four follow-on modules delivered by C2 tasking: ProManager (wallet-file and browser-extension theft, phishing overlays, password-aware input capture and payload delivery), WinUpdate (cryptocurrency-address replacement and mnemonic-shaped clipboard theft), SoftManager (reverse SOCKS5 proxy / backconnect over an encrypted WebSocket), and LockAppHost (XMRig miner deployment, competitor suspension, and persistence). The four modules share obfuscated configuration, VMProtect-style packing, and Polygon dead drops for replaceable settings including C2 endpoints and XMRig command lines. Elastic also covers CIS locale exclusion checks, sandbox scoring, credential harvesting, payload watermarking, and self-deletion. Observed distribution includes game-cheat social engineering — Elastic identified at least 17 YouTube channels promoting elitecheatsx.live and resight-cheats.net — plus builds whose names and metadata impersonate unrelated software (Slack, qBittorrent, SteelSeries GG, Blender, and others). Gen Threat Labs covered the family earlier in 2026. The Hacker News (6 September 2026) summarises the Elastic activity set. Primary: Elastic Security Labs Threat Command report.
The Hacker News (2 September 2026) reports Check Point Research tracking Chinese-speaking cluster Gambling Goblin since mid-2025 installing malicious Apache modules on compromised Brazilian government and education web servers. Modules reverse-proxy visitors to phishing pages that spoof Google Play, Microsoft Store and Amazon while stripping security headers, mainly to inflate SEO for online gambling. ANY.RUN had previously noted at least 20 .gov.br municipal and police portals abused in related distribution. Hunt for unexpected Apache modules/loadable objects, outbound reverse-proxy behaviour, and stripped CSP/HSTS on public sites.
