--- title: When Trusted Technology Becomes the Way In description: Australian organisations face escalating cyber risks as attackers exploit trusted technology. Immediate action is needed to secure software and systems against vulnerabilities. image: https://digitalfrontierpartners.com.au/hubfs/AI-Generated%20Media/Images/Cybersecurity%20Analyst%20Monitoring%20Global%20Threats.png --- [Skip to content](https://digitalfrontierpartners.com.au/news/when-trusted-technology-becomes-the-way-in#main-content) [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp)](https://www.digitalfrontierpartners.com.au/) - [Services](https://digitalfrontierpartners.com.au/news/when-trusted-technology-becomes-the-way-in#products) Show submenu for Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) - Resources Show submenu for Resources - [News](https://digitalfrontierpartners.com.au/news/tag/news) - [Case Studies](https://digitalfrontierpartners.com.au/news/tag/case-study) - [Research](https://digitalfrontierpartners.com.au/news/tag/research) - [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) - [About](https://digitalfrontierpartners.com.au/news/when-trusted-technology-becomes-the-way-in#about) Show submenu for About - [About Us](https://digitalfrontierpartners.com.au/about) - [Contact Us](https://digitalfrontierpartners.com.au/contact) Open main navigation Close main navigation - [Services](https://digitalfrontierpartners.com.au/news/when-trusted-technology-becomes-the-way-in#products) Show submenu for Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) - Resources Show submenu for Resources - [News](https://digitalfrontierpartners.com.au/news/tag/news) - [Case Studies](https://digitalfrontierpartners.com.au/news/tag/case-study) - [Research](https://digitalfrontierpartners.com.au/news/tag/research) - [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) - [About](https://digitalfrontierpartners.com.au/news/when-trusted-technology-becomes-the-way-in#about) Show submenu for About - [About Us](https://digitalfrontierpartners.com.au/about) - [Contact Us](https://digitalfrontierpartners.com.au/contact) - [Contact us](https://digitalfrontierpartners.com.au/contact) [Contact us](https://digitalfrontierpartners.com.au/contact) 27 October 2026, 2:32:16 pm AEDT # When Trusted Technology Becomes the Way In ![Picture of Digital Frontier Partners](https://digitalfrontierpartners.com.au/hs-fs/hubfs/500x%20DFP%20(3).png?width=50&name=500x%20DFP%20(3).png) [Digital Frontier Partners](https://digitalfrontierpartners.com.au/news/author/digital-frontier-partners) The defining cyber risk this week is not a single vulnerability or malware family. It is the growing ability of attackers to turn trusted technology against the organisations that rely on it. Critical flaws in widely deployed software, compromised supplier credentials, poisoned software packages and AI-assisted attacks are creating pathways into businesses without requiring attackers to defeat every layer of security individually. For Australian organisations, this means attention needs to extend beyond endpoints and employees to software runtimes, application identities, supplier integrations, development pipelines and AI-enabled systems. The most urgent developments this week include attacks targeting PHP installations, malicious LiteLLM packages, the continuing ConnectWise Cloud Backup compromise, actively exploited collaboration and network-management platforms, and AI-assisted attacks specifically targeting Australian e-commerce sites. --- **Executive Summary** Australian organisations face several immediate priorities. The **PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619**, expose affected PHP deployments to unauthenticated remote code execution and possible disclosure of information from worker memory. Widespread exploitation attempts have been reported, including activity before public disclosure, although successful compromise was not confirmed in the supplied reporting. Australia's ASD urged organisations to patch the PHP runtime, restart workers and isolate systems that cannot be updated. A significant software supply-chain incident also affected **LiteLLM 1.107.0**. Compromised packages and container images executed credential-stealing malware whenever Python started and installed a persistent backdoor. Simply uninstalling the affected package is insufficient. The source recommends isolating and rebuilding affected environments and rotating accessible secrets from a clean system. The **ConnectWise Cloud Backup** compromise remains another important concern. Microsoft attributed activity to China-aligned Storm-0940, which abused compromised ConnectWise application identities and AI-assisted tooling to access Microsoft 365 tenants. Multiple customer tenants were compromised, with some reportedly reaching privileged access within three hours. AI-assisted attacks also moved closer to home. Researchers identified exposed **Cairn** attack dashboards directing autonomous agents against more than 1,200 websites, including Australian e-commerce and payment systems. The agents tested vulnerabilities and attempted to establish persistent web-shell access. Some compromises were independently confirmed, although the extent of data theft remains unclear. --- **Critical Vulnerabilities and Active Exploitation** This week's vulnerability picture is broad, and patching internet-facing systems remains a priority. **PHP2Shell** should be high on remediation lists. CVE-2026-109618 and CVE-2026-109619 can enable remote code execution or expose worker memory. Fixed PHP releases include **8.2.35, 8.3.36, 8.4.27 and 8.5.12**, and affected workers should be restarted following upgrades. A separate unpatched PHP issue, **CVE-2026-115560**, remains relevant to environments using an uncommon session configuration The **Brotli decoder vulnerability CVE-2026-111497** creates a different challenge because vulnerable copies can be embedded across Node.js, browsers, Python packages, Electron applications and other products. Researchers demonstrated code execution using an official Node.js build, although the reporting contains no evidence of real-world exploitation. This makes dependency discovery and rebuilding affected containers important parts of remediation. Active exploitation has also been confirmed against: - **Arista VeloCloud Orchestrator CVE-2026-114625**, a CVSS 9.9 SQL injection vulnerability that can enable privilege escalation to local superuser functionality. - **Collabora CODE Server CVE-2026-110447**, exploited in affected Nextcloud environments to install web shells and search for credentials and other sensitive information. - **PAN-OS/Prisma Access CVE-2026-0257**, which ransomware operators are exploiting to obtain unauthorised VPN access despite MFA. Other serious vulnerabilities affecting GitLab, Ruby, ArubaOS, FortiSIEM, Linux KSMBD, Python Pillow and Siemens industrial products also require review, although active exploitation was not reported for all of them. **What organisations should prioritise** - Patch exposed PHP runtimes and restart affected workers. - Assess exposed collaboration, VPN and SD-WAN management systems. - Investigate actively exploited systems for evidence of compromise rather than treating patching as the final step. - Identify vulnerable software dependencies embedded inside containers and applications. - Restrict unsupported or currently unpatchable systems from unnecessary network access. --- **Supply-Chain Attacks Turn Trusted Software Against Users** The compromise of **LiteLLM 1.107.0** is one of the clearest examples this week of why software supply-chain security matters. Attackers used an exposed, unrevoked master key to obtain a privileged GitHub OAuth token and poison LiteLLM packages distributed through PyPI and container registries. The malicious release steals cloud, developer, browser and AI credentials and installs a persistent loader capable of retrieving additional code hourly. This is particularly important because removing the package alone may leave the compromise behind. Environments that executed the affected release should be treated as potentially compromised, rebuilt from trusted sources and have accessible credentials rotated from a clean system. Similar supplier and credential risks appeared elsewhere. Compromised **TeamUpdraft** connection keys were used to install malicious WordPress plugins and persistent administrator accounts, while **Railway** reported unauthorised access to systems holding customer environment variables, potentially exposing API keys and database credentials. Railway estimated up to**1.85% of workspaces** may have been affected and recommended secret rotation for all users. The recurring lesson is simple: trusted updates, packages and integrations should not automatically be treated as trusted execution. --- **AI-Assisted Attacks Reach Australian Targets** AI's role in cyber attacks is becoming increasingly practical. The **Cairn** campaign targeted more than 1,200 websites, including Australian e-commerce and payment systems. Autonomous agents tested SQL injection, unsafe file uploads and authentication bypasses and attempted to install persistent web shells. Some compromises were independently verified, while the scale of any resulting data theft remains unclear. Another operation reportedly used the **Phantom** framework and commercial AI models against 62 organisations, with human operators approving attack steps. Meanwhile, Microsoft attributed the ConnectWise Cloud Backup campaign to Storm-0940, which used the **ARTEX** AI framework alongside stolen application credentials to automate password spraying, reconnaissance and OAuth abuse. The important distinction is that AI is accelerating existing attack methods rather than making human involvement disappear. The supplied reporting still describes operators approving attack steps and cautions against treating laboratory demonstrations of rapid compromise as observed real-world incident timelines. For businesses deploying their own AI agents, the same principle works in reverse: give agents separate identities, restrict permissions and require approval before consequential actions. --- **Ransomware and the Edge-System Problem** Ransomware groups continue exploiting ageing or unpatched perimeter infrastructure. **SafePay** has reportedly affected at least **600 organisations**, including Australian victims. Reported activity includes compromised credentials, exploitation of exposed systems, disruption of backups, encryption and data theft. **Qilin and INC** operators are also exploiting PAN-OS/Prisma Access CVE-2026-0257 to bypass authentication controls before moving towards virtualisation and backup infrastructure. The separate **k0t** campaign reportedly exposed more than **70,000 credentials**, with Asia-Pacific among the most affected regions These attacks reinforce the value of treating firewalls, VPNs and remote-access appliances as privileged systems, particularly because a compromised edge device can undermine controls deeper inside an organisation. --- **Cyber Risk Is Becoming Physical Risk** Cyber incidents affecting operational technology continue to demonstrate consequences far beyond data theft. Attacks reportedly affected more than **700 European retail stores** through compromised refrigeration controllers, with temperatures reportedly manipulated as high as **50°C**, resulting in spoiled stock and reported fires. The reporting identifies obsolete Danfoss and Dixell/Copeland equipment, although it does not establish which specific vulnerabilities caused individual incidents. For Australian retailers and facilities operators, the relevance is straightforward. Remote refrigeration, building-management and similar controllers should be reviewed for internet exposure, outdated firmware and unnecessary third-party access. Siemens also disclosed vulnerabilities affecting Industrial Edge, SIMATIC and SCALANCE products. Some older products do not have fixes available, making network isolation and restricted access particularly important for affected operational technology. --- **Identity Risk Now Starts Before Someone Is Hired** Australia's sanctions against individuals and companies associated with North Korean overseas IT-worker schemes introduce another dimension to cyber security: recruitment. Australian authorities warned employers about the use of stolen Australian identity documents, AI-generated interview responses and face-swapping filters. The advice is particularly relevant where remote workers or contractors may receive access to repositories, production environments or sensitive corporate systems. Cyber security therefore increasingly begins before an account is created. Independent identity verification, sanctions screening and tightly controlled initial access should form part of remote hiring and contractor onboarding.   **Final Thoughts** This week's intelligence shows how quickly the boundaries of cyber security are expanding. A vulnerable PHP runtime can expose a web application. A poisoned Python package can compromise every credential available to a development environment. A trusted supplier identity can become a pathway into Microsoft 365. AI agents can accelerate reconnaissance and exploitation. An outdated refrigeration controller can turn a digital intrusion into physical loss. For Australian businesses, the priority is therefore broader than simply**"patch faster"**. Organisations need visibility over the software, suppliers, identities, credentials and automated systems they trust, and a plan for quickly removing that trust when something goes wrong. **Modern cyber resilience depends not only on keeping attackers out, but on limiting how far a compromised trusted system can take them.**   [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) ###### Visit Us On: [linkedin-in icon](https://www.linkedin.com/company/digitalfrontierpartners/posts/?feedView=all) [Follow us on Facebook](https://www.youtube.com/watch?v=-BsUxioXzCk&t=6s) --- [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp)](https://digitalfrontierpartners.com.au/) Level 4, 350 Collins St, Melbourne VIC, Australia 3000 +61 [1800 288 817](https://www.google.com/search?q=digital+frontier+partners&oq=digital+&gs_lcrp=EgZjaHJvbWUqDwgAECMYJxjjAhiABBiKBTIPCAAQIxgnGOMCGIAEGIoFMhUIARAuGCcYrwEYxwEYgAQYigUYjgUyBggCEEUYOTIMCAMQABhDGIAEGIoFMgwIBBAAGEMYgAQYigUyBggFEEUYPDIGCAYQRRg8MgYIBxBFGDzSAQg0MzQ1ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8#) Company   - [Home](https://digitalfrontierpartners.com.au/hp) - [About Us](https://digitalfrontierpartners.com.au/about) - [Careers](https://digitalfrontierpartners.zohorecruit.com.au/jobs/Careers) - [Contact Us](https://digitalfrontierpartners.com.au/contact) --- Resources - [News](https://digitalfrontierpartners.com.au/news) - [Research](https://digitalfrontierpartners.com.au/news) - [Weekly Cyber Report](https://digitalfrontierpartners.com.au/news) - [Case Studies](https://digitalfrontierpartners.com.au/news) --- Policies - [Privacy Policy](https://digitalfrontierpartners.com.au/news/privacy-policy) - [Information Security Policy](https://digitalfrontierpartners.com.au/news/information-security-policy) - [Quality Policy](https://digitalfrontierpartners.com.au/news/quality-policy) Products and Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise Artificial Intelligence (AI)](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) --- Industries - [Local Government](https://digitalfrontierpartners.com.au/localgovernment-cybersecurity) - [Financial Services Cyber Security](https://digitalfrontierpartners.com.au/financialservices) - [Financial Services Artificial Intelligence](https://digitalfrontierpartners.com.au/financial-services-artificial-intelligence) - [Mid Market Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-artificial-intelligence) - [Aged Care Roster Optimisation](https://digitalfrontierpartners.com.au/aged-care-rostering-optimisation) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Digital Frontier Partners", "url" : "https://digitalfrontierpartners.com.au/news/author/digital-frontier-partners" }, "dateModified" : "2026-10-27T03:32:16.770Z", "datePublished" : "2026-10-27T03:32:16.000Z", "headline" : "When Trusted Technology Becomes the Way In", "image" : [ "https://digitalfrontierpartners.com.au/hubfs/AI-Generated%20Media/Images/Cybersecurity%20Analyst%20Monitoring%20Global%20Threats.png" ], "mainEntityOfPage" : { "@id" : "https://digitalfrontierpartners.com.au/news/when-trusted-technology-becomes-the-way-in", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://digitalfrontierpartners.com.au/hubfs/DFP-Logo.webp" } } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://digitalfrontierpartners.com.au/#organisation", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AU", "addressLocality" : "Melbourne", "addressRegion" : "VIC", "postalCode" : "3000", "streetAddress" : "Level 4, 350 Collins Street" }, "description" : "Digital Frontier Partners provides enterprise technology advisory, AI enablement, workforce optimisation and cybersecurity services, helping organisations align strategy, value and risk.", "email" : "contact@digitalfrontierpartners.com", "knowsAbout" : [ "Enterprise AI enablement", "Artificial intelligence strategy", "AI governance and risk", "Workforce optimisation", "Cybersecurity", "Technology due diligence", "Digital transformation" ], "logo" : { "@type" : "ImageObject", "contentUrl" : "https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp", "height" : 342, "width" : 1200 }, "name" : "Digital Frontier Partners", "telephone" : "+61 1800 288 817", "url" : "https://digitalfrontierpartners.com.au/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://digitalfrontierpartners.com.au/#website", "@type" : "WebSite", "inLanguage" : "en-AU", "name" : "Digital Frontier Partners", "publisher" : { "@id" : "https://digitalfrontierpartners.com.au/#organisation" }, "url" : "https://digitalfrontierpartners.com.au/" } ```