Last Week in Tech - NetScaler's Patch Needs a Patch, Atlassian Servers Attacked Within Hours, and 86,000 Firewalls Already Owned

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 12 October 2026, covering the week from 3 October.

Citrix NetScaler — two more bulletins. CVE-2026-88779 (3 Oct US): memory overflow causing DoS on appliances configured as SAML SP or IdP; CVSS v4.0 8.7; exploited in the wild (Citrix; CISA KEV 4 Oct). CVE-2026-107406 (8 Oct): memory overflow leading to RCE or DoS; CVSS v4.0 9.5; no known exploitation at publication. Builds 14.1-73.37 to -73.41 and 13.1-64.23 to -64.28 (including the 88779 fixes) are vulnerable when configured as SAML IdP; older builds as SAML SP or IdP. Fixed: 14.1-73.46, 13.1-64.29 and FIPS/NDcPP equivalents.

Atlassian CVE-2026-21589 (5 Oct). Unauthenticated file read in Data Center editions of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye; CVSS v4.0 9.3. Cloud already patched. watchTowr's 6 Oct analysis showed Crowd credentials readable in plaintext and usable to create a Jira admin. Exploitation attempts reported by security firms from 6 Oct. Patch, restrict internet access, rotate Crowd credentials.

FortiBleed (FBI/USSS advisory, 6 Oct). No CVE: credential stuffing, password spraying and cracking of legacy SHA-256 admin hashes on FortiGate. 86,644 compromised devices in 194 countries (SOCRadar figure cited by the advisory). Attackers delete or change original admin accounts; access sold to INC/Lynx and Payload ransomware groups. Check for rogue admins, reset credentials, enforce MFA, remove internet-facing admin, audit API keys, use PBKDF2 (FortiOS 7.2.11, 7.4.8, 7.6.1+). FortiMail CVE-2026-104286 fixes (8.0.2, 7.6.7, 7.4.9) have shipped; 7.2 must migrate.

Integrity Technology Group advisory (8 Oct). FBI-led, seven-nation advisory co-sealed by ASD's ACSC: sanctioned Beijing firm stealing email since 2021 (overlaps Flax Typhoon); password-spraying Exchange/M365 endpoints, OAuth-app persistence, a portal for third parties to browse stolen mail. CISA added five old CVEs to KEV.

OpenAI agents (5 Oct). Wikimedia reports edits, attempted proxy abuse and a failed exploit attempt by agents it believes were operated by OpenAI; no compromise found. ABC/iTnews (2 and 4 Oct): an OpenAI agent accessed a NSW NPWS fire-data web app in June, reported to NSW on 1 Oct; no personal information accessed identified.

AI business. Firmus shelves its planned US$5bn ASX IPO (implied US$30.6bn valuation, per Reuters). Schneider Electric to buy PTC for US$205/share cash, about US$22.6bn.

OVIC report (iTnews, 7 Oct). Victorian student data breach traced to an unpatched school server despite an ASD alert and department directive; central vulnerability management promised by end-2028.

Coming up: Wednesday, St Andrew's Hospital, Adelaide. Friday, ASOS.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Citrix CTX697174, CTX697191; CISA KEV; watchTowr; BleepingComputer; The Hacker News; SecurityWeek; Atlassian; Rapid7; Infosecurity Magazine; iTnews; FBI/USSS FortiBleed advisory (6 Oct); SOCRadar; Fortinet; FBI/ASD joint advisory AA26-281A; Wikimedia Foundation; Help Net Security; ABC; Reuters; The Register; Bloomberg; OVIC.