11 November 2026
ASD’s ACSC released its seventh Annual Cyber Threat Report since the last roundup, and its own announcement says the report “highlights the growing impact of artificial intelligence (AI) on the cyber threat landscape”. So AI is the story.
Is it? No.
Read to the end of the executive summary and ASD says it plainly; “AI capabilities have not introduced new cyber threats, but they have amplified existing ones”. Same holes, found faster. The advisories since mid-October say the same thing from the other side. Fortinet credits a run of its critical bugs to its own team, working with an AI model. WordPress credits two of its fixes to an AI company. None of them is a new kind of bug. They’re authentication bypasses, command injection and cross-site scripting, in the kit you already own.
So the order is; the ASD framework change and the threat report first, then the two ACSC alerts on PHP and Fortinet, then NSW Health, then the global patches that change what you should test. Each story ends with what to do. The patch list is at the bottom, ready to paste into a ticket.
Did ASD just retire the Essential Eight?
No. Not yet.
On 15 October ASD launched the ASD Essentials, which it calls “an evolution of Australia’s widely adopted Essential Eight framework”. It’s a series of chapters instead of one list. The first three are enterprise IT (the one ASD describes as “an evolution of the Essential Eight”), operational technology, and cloud for organisations running entirely on SaaS and PaaS. ASD says it’s for Commonwealth entities, critical infrastructure and large organisations.
The sentence that matters is this one; “Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations.” ASD will keep both frameworks on cyber.gov.au during the transition.
What to do: don’t tear up your Essential Eight program. Read ASD’s Essentials overview, work out which chapter applies to you, and ask whoever assesses you which framework they’ll accept and from when. If you’re being tested against the Essential Eight today, that test is still the right one.
What does the threat report say that you can use?
Three things.
Firstly; volume. ASD’s year in review counts over 82,000 cybercrime reports in 2025-26, one every six minutes, and more than 1,500 incidents responded to, up 20%. Second; cost. The average self-reported cost of cybercrime per report was $93,500 for businesses, up 16%. For medium businesses it was $141,300, up 45%. Third; how they get in. The executive summary lists compromised accounts and credentials as “one of the most frequently reported incident categories” across government, industry and critical infrastructure.
ASD also notified entities of potentially malicious activity more than 4,400 times, up almost 80%, and identified 362 incidents after those notifications.
What to do: check where you still have accounts with a password and nothing else, starting with email, VPN and anything with admin rights. Then ask a simpler question. If ASD rang your organisation tomorrow, who would take the call?
Is your PHP patched?
If you haven’t updated since 21 October, no.
The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two vulnerabilities that “can allow unauthenticated remote code execution”; CVE-2026-109618 and CVE-2026-109619. It rates the risk highest for Apache with mod_php, where it says an unauthenticated request can trigger the attack “before any application code runs”. ASD’s ACSC put out a critical alert the same day and said all versions from PHP 5 onwards may be affected. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October.
But lets face it; how many of your web applications are on a PHP version the project still patches? PHP 8.1 and older get nothing from the PHP project. It published minimal source backports for 7.4, 8.0 and 8.1 this once because of the severity.
What to do: find every PHP install, including the ones inside appliances and the marketing site nobody remembers commissioning. Update, or get your vendor’s backport. Then ask when those applications were last tested by a person. That’s what a web application penetration test is for.
Why did Fortinet tell you to patch without saying why?
Because the details were held back until 10 November.
ASD’s ACSC published a critical alert on 23 October covering FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. It said it had “no further details beyond Fortinet’s current public advice”. Patch first, explanation later.
The explanation arrived on Fortinet’s PSIRT page on 10 November, as 89 advisories, most of them for FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator and FortiOS. Nineteen are rated critical. I’m not going to list them all. Four to start with; unauthenticated code execution through the FortiManager and FortiAnalyzer GUI (CVE-2026-126170), unauthenticated code execution through FortiManager’s FGFM port (CVE-2026-126261), an authentication bypass in the FortiOS OSPF daemon (CVE-2026-126253), and unauthenticated code execution in FortiMail (CVE-2026-126147), which is one of eight FortiMail criticals. All 89 are marked “Known Exploited: No”. All four credit Fortinet’s own product security team “with the use of” a frontier AI model.
That’s the threat report’s point, made by a vendor. The defender got there first this time.
What to do: FortiOS goes to 8.0.2, 7.6.8, 7.4.13 or 7.2.14. FortiManager and FortiAnalyzer go to 7.6.8 or 7.4.12.
If you’re on 8.0, don’t stop at 8.0.2; it’s still affected by CVE-2026-126170, and Fortinet’s answer is an “upcoming 8.0.3” or the workaround in the advisory. Fortinet says the vulnerability “exists only when the JSON API is enabled”, and that it’s disabled by default, so check whether it’s enabled on any admin profile and turn it off if it is.
If you’re on 7.2, the advisory for CVE-2026-126229, another critical, says to migrate to a fixed release for both products. FortiMail goes to 7.6.7 or 7.4.9, and FortiMail 7.2 is a migrate as well. On FortiMail 8.0, 8.0.2 clears the criticals, but one high-severity advisory waits for an “upcoming 8.0.3”. Those are the highest fixed builds across all 89 advisories for FortiOS, FortiManager, FortiAnalyzer and FortiMail. For FortiAuthenticator, FortiClient and anything else you run, check your branch against Fortinet’s list.
Then confirm FortiManager and your admin interfaces aren’t reachable from the internet. If you can’t say for certain, have the external surface tested by someone who didn’t configure it.
What happened at NSW Health?
Not much is public.
iTnews reported on 4 November that NSW Police’s Cybercrime Squad is investigating “an alleged data breach at NSW Health” after being alerted at about 1pm on Friday 30 October. Cyber Security NSW told iTnews the breach affected “an isolated server”, that it had been declared a major incident, and that “no patient data has been impacted at this time”.
I won’t guess at the rest.
What to do: ask what your own “isolated” servers can actually reach. If the answer comes from a network diagram older than the server, test it.
Which global patches change what you test?
Five. Three of them sit on your perimeter.
WordPress core, CVE-2026-119977. WordPress 7.1.4 shipped on 28 October and fixes “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window”. CISA added it to KEV on 3 November. Sites with automatic background updates will have moved already. Check the ones that don’t.
Ivanti Connect Secure, CVE-2026-111357 and CVE-2026-118527. CISA added both on 30 October and says they can be chained with CVE-2026-104935, the authentication bypass from the last roundup. If you patched that one in October, go back to Ivanti’s advisory and check that your build also covers the two new CVEs.
SonicWall SonicOS SSLVPN, CVE-2026-19868. SonicWall’s advisory of 6 November says a user with valid credentials for another authentication method may “bypass SAML authentication controls”, including SAML-enforced MFA. It only applies if SAML is enabled for SSLVPN logins. SonicWall has investigated a report of potential exploitation, and CISA added it the same day. Last roundup it was NetScaler and SAML. This time it’s SonicWall and SAML.
Barracuda Email Security Gateway, CVE-2026-116606 and CVE-2026-111560. Barracuda’s advisory says the two combine into an authorisation bypass and root access where the admin interface is reachable. It was updated on 9 November to report exploitation “affecting a small number of organizations”. CISA added both on 10 November.
Microsoft Outlook, CVE-2026-124194. Microsoft’s November release marks it “Exploitation Detected”. A crafted message file, once opened, makes Outlook connect to an attacker’s server without the usual external-content warning and discloses the user’s NTLMv2 hash. The Preview Pane isn’t an attack vector. CISA added it to KEV on 10 November. That’s a phishing bug. Patch it before you rely on staff to spot the email.
What to do: VPNs, firewalls and mail gateways are your internet-facing kit, and every one of the admin-interface bugs above gets worse when that interface faces the internet. Patch, then check what’s exposed.
So what goes in the ticket?
This:
Patch and hunt list: 16 Oct to 11 Nov 2026 (sources: ACSC, vendors, Microsoft, CISA KEV)
CVE-2026-109618 PHP, unauthenticated RCE fixed 21-Oct; KEV 26-Oct
CVE-2026-109619 PHP, unauthenticated RCE fixed 21-Oct; KEV 26-Oct
CVE-2026-126170 Fortinet FortiManager/FortiAnalyzer GUI RCE critical; 8.0.2 still affected
CVE-2026-126261 Fortinet FortiManager, FGFM code execution critical; published 10-Nov
CVE-2026-126229 Fortinet FortiManager/FortiAnalyzer critical; 7.2 must migrate
CVE-2026-126253 Fortinet FortiOS, OSPF auth bypass critical; published 10-Nov
CVE-2026-126147 Fortinet FortiMail, unauthenticated RCE critical; 7.2 must migrate
CVE-2026-119977 WordPress core, RCE in upgrade window fixed 7.1.4; KEV 03-Nov
CVE-2026-111357 Ivanti Connect Secure exploited; KEV 30-Oct
CVE-2026-118527 Ivanti Connect Secure exploited; KEV 30-Oct
CVE-2026-19868 SonicWall SonicOS SSLVPN, SAML MFA bypass KEV 06-Nov
CVE-2026-116606 Barracuda ESG, auth bypass exploited; KEV 10-Nov
CVE-2026-111560 Barracuda ESG and others, command injection exploited; KEV 10-Nov
CVE-2026-124194 Microsoft Outlook, NTLMv2 hash disclosure exploited; KEV 10-Nov
And for anyone running PHP, the check:
php -v
php -i | grep -E "memory_limit|session.upload_progress.enabled"
You want 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Check the PHP that serves your website, not just the one on the command line, because they can read different config files. PHP’s 23 October advisory also suggests one line in php.ini until the next regular bugfix release, even on a patched version;
session.upload_progress.enabled = 0
There you have it. Fourteen lines, two commands and one config change.
If you’d like a senior-led, fully manual test of your perimeter or web applications, or a phishing site impersonating your brand taken down, get in touch.
References
- ASD’s ACSC, Annual Cyber Threat Report 2025-26 now available (news), published 27 Oct 2026: https://www.cyber.gov.au/news/asd-releases-seventh-annual-cyber-threat-report-2025-26
- ASD’s ACSC, Annual Cyber Threat Report 2025-26, published 26 Oct 2026, executive summary: https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/executive-summary
- ASD’s ACSC, Annual Cyber Threat Report 2025-26, year in review: https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/year-in-review
- ASD, ASD Essentials: evolving our approach to cyber security resilience, published 15 Oct 2026: https://www.cyber.gov.au/news/asd-essentials-evolving-our-approach-to-cyber-security-resilience
- ASD, ASD Essentials (series overview): https://www.cyber.gov.au/essentials
- ASD’s ACSC, Critical vulnerabilities in PHP, published 21 Oct 2026, last reviewed 22 Oct 2026: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
- PHP, Security advisory: Critical remote code execution vulnerabilities, update now, 21 Oct 2026, and Informational advisory: Session upload progress, 23 Oct 2026: https://www.php.net/archive/2026.php
- ASD’s ACSC, Critical vulnerabilities in Fortinet products, published 23 Oct 2026: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-fortinet-products
- Fortinet PSIRT, advisory list (entries published 10 Nov 2026): https://fortiguard.com/psirt
- Fortinet, FG-IR-26-267 Authentication bypass by primary weakness (CVE-2026-126253), 10 Nov 2026: https://fortiguard.com/psirt/FG-IR-26-267
- Fortinet, FG-IR-26-275 FGFM elevation before registration password is verified (CVE-2026-126261), 10 Nov 2026: https://fortiguard.com/psirt/FG-IR-26-275
- Fortinet, FG-IR-26-244 Authorization bypass through user-controlled key in dmserver (CVE-2026-126229), 10 Nov 2026: https://fortiguard.com/psirt/FG-IR-26-244
- Fortinet, FG-IR-26-229 Authentication bypass by spoofing (CVE-2026-126184), 10 Nov 2026 (used for the FortiManager and FortiAnalyzer fixed versions): https://fortiguard.com/psirt/FG-IR-26-229
- Fortinet, FG-IR-26-219 (CVE-2026-126170, improper encoding or escaping of output in the FortiManager and FortiAnalyzer GUI), 10 Nov 2026: https://fortiguard.com/psirt/FG-IR-26-219
- Fortinet, FG-IR-26-199 (CVE-2026-126147, path traversal in FortiMail), 10 Nov 2026: https://fortiguard.com/psirt/FG-IR-26-199
- iTnews, NSW Health server targeted in cyber incident, Ry Crozier, 4 Nov 2026: https://www.itnews.com.au/news/nsw-health-server-targeted-in-cyber-incident-630096
- WordPress, WordPress 7.1.4, 28 Oct 2026: https://wordpress.org/news/2026/10/wordpress-7-1-4
- CISA, Known Exploited Vulnerabilities Catalog, catalogue version 2026.11.10 (dates added for every KEV line above): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, 30 Oct 2026: https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog
- CISA, CISA Adds One Known Exploited Vulnerability to Catalog, 6 Nov 2026: https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog
- CISA, CISA Adds Six Known Exploited Vulnerabilities to Catalog, 10 Nov 2026: https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
- Ivanti, Security Advisory Ivanti Connect Secure (CVE-2026-104935) (linked, not re-read this session): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
- SonicWall PSIRT, SNWLID-2026-0014 SonicWall SonicOS Affected By Multiple Vulnerabilities, published 6 Nov 2026, updated 9 Nov 2026: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
- Barracuda, Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products, published 2 Nov 2026, updated 9 Nov 2026: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
- Microsoft MSRC, November 2026 Security Updates (CVRF), released 2026-11-10T08:00Z: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Nov