Cyber Daily Australia
Cyber Daily Australia is a daily open-source intelligence briefing on cybersecurity, with a particular focus on Australia. Each episode summarises the latest threats, incidents, vulnerabilities, and defensive developments drawn from publicly available sources. The show is aimed at listeners who need a concise, regular update on the cyber situation affecting Australian organisations and the wider region.
Episodes
Episode 22: OpenAI GPT-6 Cyber finds nearly a thousand Linux root paths, Metabase under active attack and ASD open-weight AI guidance, 6 November 2026
OpenAI named GPT-6 Cyber as the model behind a defensive autonomous pipeline that reproduced 1,724 Linux kernel vulnerabilities and produced 948 working local privilege escalation exploits plus candidate patches in a mid-October run, at about US$1.2 million in API costs, with humans reviewing before maintainer reports. Singapore's CSA warns Metabase CVE-2026-72898 is under active exploitation, Vul
Episode 21: Russia-linked hackers hijack phones through a poisoned analytics script, NSW Health breach hits dentists' data and fridge attacks reach France's blood service, 5 November 2026
An APT29-linked group has been compromising iPhones and Android phones through hacked websites, lookalike sites and a tampered analytics script, using already-patched exploit chains. The NSW Health breach involved dental providers' data from a voucher scheme website, Europe's refrigeration attacks have reached France's national blood service, and CISA confirmed exploitation of a WordPress core fla
Episode 20: Security tool update hijacked to backdoor Linux servers, Barracuda root flaws and LLMjacking bills reach US$1 million, 4 November 2026
An attacker hijacked the update channel of the cPGuard Linux security tool to backdoor hosting servers and steal password hashes, and attackers are exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 gateways. Barracuda disclosed a chainable path to root on its email and web appliances, Google and Mandiant say LLMjacking has cost some organisations US$1 million in AI charges, and Binance
Episode 19: Hackers switch off supermarket freezers, Google shuts a factory-built TV box botnet and ransomware hits Synology NAS, 3 November 2026
Attackers remotely switched off or overheated refrigeration in more than 115 supermarkets across six European countries, and Google took down a botnet of 1.3 million Android TV boxes it says the manufacturer backdoored at the factory. Synology warns of ransomware on outdated NAS devices, Microsoft details Teams help desk scams that ended in certificate abuse, and AI shows up in an infostealer that
Episode 18: FBI names North Korea for Binance theft, a maximum-severity LXD flaw and AI keys abused after Northflank breach, 2 November 2026
The FBI has formally attributed the record Binance theft to North Korea's TraderTraitor and published the laundering addresses. A maximum-severity flaw in Canonical LXD and MicroCloud lets an attacker pose as a trusted client, Northflank customers must rotate every secret after AI keys were abused, and Chainalysis, ChatGPT and GNU Savannah round out a busy day for AI-linked security. Weekend recap
Episode 17, Sunday Special: Australia's Cyber Threat Report 2025-26, 1 November 2026
ASD's seventh Annual Cyber Threat Report, released this week, says AI has amplified and sped up existing threats rather than creating new ones. This Sunday Special draws out five messages: patch in days, attackers log in rather than break in, medium businesses are taking the biggest cost rise, incidents are up and more serious, and the answer is an assumed-breach mindset plus the basics, with a sh
Episode 16: Binance breach hits US$6.3 billion, Ivanti VPN chain closed and a tampered Claude Code extension, 31 October 2026
Binance says about US$6.3 billion in assets was affected by a breach that began with a compromised engineer's laptop, and analytics firms link it to North Korea. Ivanti patched the last two flaws in an exploited Connect Secure chain, now on CISA's exploited list with a 2 November deadline, and a tampered Claude Code extension reached up to 5,000 developers through Cursor's marketplace. Drupal Comm
Episode 15: PHP2Shell hits Palo Alto firewalls, Cisco ASA zero-day and an unpatched Linux TCP flaw, 30 October 2026
Palo Alto Networks confirmed PHP2Shell exploitation against internet-exposed PAN-OS management interfaces, and CISA added the chained Linux flaw Fragnesia to its exploited list with a 31 October deadline. Cisco patched an exploited ASA and FTD VPN crash flaw, Talos detailed KeyDrift key theft on SD-WAN controllers, and a 9.8-rated Linux TCP flaw still lacks Ubuntu and RHEL fixes. In Australia, the
Episode 14: PHP2Shell reaches a US government network, Volt Typhoon's Silent Train exposed and Tailscale ships Tailworm fixes, 29 October 2026
A suspected China-linked attacker used a custom PHP2Shell exploit, with signs of AI-assisted tooling, to root 25 firewalls and reach a US government-affiliated network, and Lumen's Black Lotus Labs exposed Volt Typhoon's Silent Train covert network behind four zero-day campaigns. In Australia, a breach at booking platform RMS Cloud is fuelling phishing of holiday park guests. We also cover Tailsca
Episode 13: ASD cuts off an Amadey botnet, PHP2Shell enters CISA KEV and Microsoft pulls eMudhra roots, 28 October 2026
The Australian Signals Directorate says it cut a criminal's Amadey malware operation off from about 180,000 infected computers and destroyed a stolen 5 TB data haul before it could be sold. CISA has added the PHP2Shell flaws to its Known Exploited Vulnerabilities catalogue, and Microsoft has removed eMudhra root certificates from Windows after weak keys were found. We also cover Tailworm fixes for
Episode 12: PHP2Shell shells confirmed, Brotli emergency patches and GitHub secrets stolen through Actions logs, 27 October 2026
Attackers have now launched working shells through the PHP2Shell flaws on research honeypots, the clearest public proof yet that the exploits work. The Brotli compression flaw has triggered emergency fixes from Microsoft for .NET and rebuilt PHP packages for Windows, and a campaign called Gheist is using stolen GitHub tokens to dump repository secrets through GitHub Actions logs. We also cover the
Episode 11: PHP2Shell intrusion confirmed, Tailscale SSH flaws and booby-trapped agent files, 26 October 2026
PHP2Shell now has a confirmed intrusion: Unit 42 reports attackers reached a European government entity's password hashes and MFA secrets within two hours, with strong signs that an AI agent did the follow-up work, while a suspected North Korean campaign has Australian PHP hosts on its target list. A researcher has published 11 unpatched Tailscale and headscale findings, and AI coding agents can b
Episode 10, Sunday Special: AI Assurance and ISO/IEC 27090, 25 October 2026
This Sunday Special maps the frameworks organisations use to show their AI and AI agents are secure, from the NIST AI Risk Management Framework and ISO/IEC 42001 to OWASP's agentic Top 10, MITRE ATLAS, the EU AI Act and ASD's agent guidance. The centrepiece is ISO/IEC 27090:2026, the new international guidance on threats to AI systems, explained from ISO's public material. We also cover why agent
Episode 9: Fortinet AI-found fixes, PHP2Shell reality check and Proofpoint buys Varonis, 24 October 2026
Fortinet shipped critical fixes for FortiOS and four other product lines, found with frontier AI testing, and is withholding the details until 10 November; ASD has issued a critical alert. PHP2Shell is drawing millions of attempts but no confirmed successful compromise, and PHP flagged a narrower unpatched issue. CISA added exploited Arista VeloCloud and Collabora flaws to its catalogue, researche
Episode 8: PHP2Shell exploited at scale, GitLab max severity fix and ConnectWise AI agent attribution, 23 October 2026
PHP2Shell, the pair of critical PHP flaws, is now being exploited at scale, and Amazon says probing began four days before the patches; government sites in Australia, the UK and Europe went offline as a precaution. GitLab fixed a maximum-severity flaw reaching back to 2014, and Microsoft tied the ConnectWise cloud compromise to China-aligned Storm-0940 using ARTEX AI agents. LiteLLM traced its poi
Episode 7: PHP2Shell emergency patches, LiteLLM supply chain attack and SafePay advisory, 22 October 2026
PHP has released emergency fixes for PHP2Shell, two critical flaws in the PHP engine that allow unauthenticated remote code execution on web servers, after details leaked and attack attempts began before the patch. The LiteLLM Python package was compromised to deliver a credential stealer and backdoor, and the FBI and European partners warn the SafePay ransomware group has breached more than 600 o
Episode 6: eMudhra CA keys compromised, ransomware bypasses Palo Alto MFA and AI agents breach websites, 21 October 2026
The private keys for eight eMudhra intermediate certificate authority certificates have been compromised, prompting emergency blocks in all major browsers and an urgent Go security release. Palo Alto Networks says the Qilin and INC ransomware groups are exploiting a PAN-OS flaw to bypass multi-factor authentication and pivot to hypervisors, while researchers watched criminals use autonomous AI age
Episode 5: Canva data incident, Bullhorn outage and plugin supply chain attacks, 20 October 2026
Canva has confirmed that some enterprise customer records were exposed through Canny, a compromised third-party feedback tool connected to its Salesforce account, while recruitment software provider Bullhorn has taken its platform offline to contain a cyberattack. Supply chain compromises of the Rank Math PRO WordPress plugin and AOMEI Backupper lead the threat picture, alongside active exploitati
Episode 4: ConnectWise breach widens and OpenCode AI key theft, 19 October 2026
The ConnectWise Cloud Backup (formerly SkyKick) incident widened over the weekend: Huntress now sees attacker sign-in activity in almost 1,000 Microsoft Entra tenants, more than 300 of them successful, plus a failed targeted wave against policy, national security, trade and critical minerals organisations. OpenCode disclosed a breach that exposed AI provider keys saved by 1.4% of its Console users
Episode 3: ConnectWise backup credential abuse and Drupal critical patches, 18 October 2026
An attacker used a stolen ConnectWise Cloud Backup (formerly SkyKick) credential to sign in to at least 162 Microsoft 365 tenants, and ConnectWise has shut the service while customers disable the apps and hunt for planted credentials. Drupal shipped fixes for a critical remote code execution flaw in core and warned exploits may follow quickly. In Australia, Napoleon Perdis disclosed that about 339
Episode 2: BeyondTrust and Fortinet exploitation and spy ads on Australian networks, 17 October 2026
China-linked operators exploited a BeyondTrust Remote Support zero-day, and a Fortinet flaw was used to plant a memory-only implant on FortiGate firewalls; CISA has set Monday deadlines for both. In Australia, Citizen Lab found spyware-linked ads reaching government, energy and ANSTO networks, Qilin published data stolen from a NSW switchboard maker, and hijacked Shopify apps redirected shoppers a
Episode 1: BeyondTrust zero-day and edge-device exploitation — 16 October 2026
Good morning, and welcome to U51 Cyber and AI Security Pod, your daily cybersecurity situation report. This episode covers the twenty-four hours to eight thirty on the evening of Friday the sixteenth of October, twenty twenty-six, Melbourne time. Everything in this briefing comes from open, unclassified sources, and for each item we'll tell you how confident we are in the reporting. Here's how to
Recommended
The Good Girl Game Changers
Gourmet Express - 美食煮意
Grave Matters
The Rush Hour with Dobbo & Elliott
Triple M Rocks Footy AFL
7AFL Podcasts
Australia All Over
Christianityworks with Berni Dymet
Triple M Breakfast with Kaz & Tubes - Triple M Hobart 107.3
The Unplayable Podcast
Rise and Shine
Country Breakfast
