The health secretary is quietly taking steps that public health experts fear will reduce immunization rates further.

© Annabelle Gordon/Reuters

For years, the Essential Eight has been the go-to checklist for Australian organisations defending against cyber attacks. That is now changing. The Australian Signals Directorate (ASD) has launched ASD Essentials, a new cyber security framework that evolves the Essential Eight into a broader set of guidance covering enterprise IT, operational technology and cloud environments. The shift is more than a rebrand. It changes how organisations measure progress, where they focus effort and how they handle environments the original framework was never designed for.

Why ASD Essentials Is Replacing the Essential Eight

ASD points to its Annual Cyber Threat Report 2024-2025, which shows Australian organisations facing increasingly sophisticated threats. At the same time, modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud and emerging technologies. A fixed list of controls struggles to keep up with that variety. The new framework takes a threat-informed, principles-based approach, giving organisations flexibility to achieve security outcomes without being tied to specific technologies.

5 Key Changes Under ASD Essentials

1. Phased priorities replace maturity levels. Instead of climbing maturity levels, organisations will work through phased priorities, directing effort to their highest-risk assets first. 2. Outcomes over checklists. The framework moves away from prescriptive security requirements toward principles and actions that help organisations assess whether intended security outcomes are actually being achieved. 3. New building blocks. It introduces cyber security principles, actions and domains, focusing uplift efforts on critical business functions and systems. 4. Environment-specific chapters. Each chapter applies the same underlying model but accounts for the threats, risks and operational realities of the environment it covers. 5. Risk-informed decisions. There is a stronger emphasis on decision-making supported by threat intelligence and each organisation's own context.

The First Three ASD Essentials Chapters

The series launches with three chapters:

• Essentials for enterprise IT is the direct evolution of the Essential Eight.
• Essentials for operational technology (OT) supports Australian critical infrastructure operators protecting their operational technology environments from cyber threats.
• Essentials for cloud supports organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).

ASD has also made AI-focused guidance available, helping organisations consider AI-enabled systems within their technology environments. The framework includes overview publications and supplemental publications alongside the chapters.

Who Should Pay Attention

The guidance is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium-sized businesses that do not operate at enterprise scale can still apply it where relevant. ASD says the framework remains consistent with its best-practice advice and the Australian Government Information Security Manual. Industry consultation played a central role in its development, and ASD plans to keep engaging with industry, government and critical infrastructure stakeholders as technologies and threats change.

What ASD Essentials Means for Compliance Today

For now, nothing changes on the compliance front. Organisations should continue meeting their current regulatory obligations until regulators communicate any associated changes. ASD is in discussions with regulatory bodies about the impact and expected timeframes of the transition and says it will advise on expectations in due course. During the transition period, both the Essential Eight and ASD Essentials will remain available on cyber.gov.au, along with supporting resources and implementation guidance. For security teams, the practical takeaway is to start reviewing the new chapters now, map current Essential Eight controls against the new principles, and identify which critical business functions and systems would sit at the top of a phased priority plan.

An anonymous reader quotes a report from BleepingComputer: A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners' consent. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to researchers, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324) to install the Pawns.app software. Hikvision and Dahua DVR/NVR devices were also targeted, though the specific vulnerabilities exploited were not identified. In some cases, the report says the attackers configured SSH key authentication to maintain backup access to the compromised systems.

Read more of this story at Slashdot.

As his new movie The Debut closes the London film festival, we count down the best of the actor’s shy, sly and sometimes hairy outings

A doppelganger role can be a trap for an actor: either the two roles are not sufficiently distinct, or they are too hammily different, and either way the result can look like a film school graduation project. But Jesse Eisenberg gives a stylish split-personality turn in Richard Ayoade’s adaptation of the Dostoevsky novella. He plays Simon, a nerdily shy and self-effacing computer programmer in a grim futureworld, ignored by his employers and by co-worker Hannah (Mia Wasikowska), with whom he is hopelessly in love. But then his carbon copy, James, arrives, also of course played by Eisenberg. James is a confident alpha-achiever who impresses his bosses and entrances Hannah – to Simon’s gibbering despair.

Continue reading...

© Photograph: Linda Nylind/The Guardian

© Photograph: Linda Nylind/The Guardian

© Photograph: Linda Nylind/The Guardian

A massive trove of assets (character rigs, model sheets, storyboards, etc.) from Cartoon Network has been leaked. The total is at least 200GB. YouTuber Joeybar looks through the collection [~8 min.]

Aaron Sorkin’s attempt to return to the success of The Social Network is a strangely dated and incomplete look at a world that needs a sharper eye

In retrospect, David Fincher’s 2010 film The Social Network was a landmark for a quiet, even counterintuitive reason. Before the film was released, some questioned whether Aaron Sorkin, a writer not exactly known for his mastery of, nevermind obsession with, the technical sphere, was the right man to tell the origin story of Facebook. And while Sorkin may well have converted Mark Zuckerberg into terms he could better understand – namely, a motormouthed wiseass who deep down wants to impress a smart, serious-minded girl – he and Fincher also made one of the first internet-centric movies to treat online life as a natural extension of IRL dynamics, rather than the otherworldly tech portal seen in so many 90s internet movies.

Granted, that’s the whole deal with Facebook: its viral spread of social networking, something so simple and addictive that aunts, grandpas and coworkers everywhere could understand it. Yet understanding its simultaneous extension and distortion of the real world wasn’t a given; four years later, for example, 2014’s Men, Women and Children was widely derided for taking an alarmist approach to the internet as a haven for adults seeking an affair, teenagers nursing porn addictions and fame-hungry strivers of all ages. The Social Network, on the other hand, is remarkably nonjudgmental about the basic mechanics of Facebook, rooting its nascent flaws in the human weaknesses that birthed it. In retrospect, the movie only feels outdated to the extent that it underestimates Zuckerberg’s grasping for power and the potential for grim carelessness that his online kingdom was built on.

Continue reading...

© Photograph: Leah Gallo/Sony Pictures/AP

© Photograph: Leah Gallo/Sony Pictures/AP

© Photograph: Leah Gallo/Sony Pictures/AP

It's the software engineers who are losing their jobs to AI, not the weed trimmers, pawn shop workers, garbage men, and grocery store workers. In these novels and in this economy, even the extralegal jobs, despite being precarious on their head, have become more stable than most.

The European Union’s ability to detect and respond to EU cybersecurity incidents faces significant gaps, particularly in information-sharing and coordination between national and EU-level bodies, according to a new report by the European Court of Auditors (ECA). The auditors said the EU has made progress in developing a cybersecurity cooperation framework, but several measures needed to support an effective response to significant and large-scale incidents are still incomplete. Cybersecurity incidents can disrupt public services, businesses, critical infrastructure and the EU’s internal market. While member states remain primarily responsible for responding to such incidents, the EU has a role when attacks cause major disruption, significant financial losses or substantial harm, or when incidents affect several countries and exceed the response capacity of a single member state.

EU Cybersecurity Incidents Face Information-Sharing Gaps

The ECA identified insufficient information exchange as a major weakness in the EU’s cybersecurity response system. The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises. However, the cooperation between two key EU cyber networks has not yet been formally defined. The auditors said this affects cooperation between the CSIRTs network, which brings together national teams responsible for handling cyber incidents, and EU-CyCLONe, which supports cooperation during EU-level cyber crises. Information-sharing is also affected by differences in national security laws and the ongoing implementation of updated EU cybersecurity rules, including the NIS 2 Directive. According to the auditors, these factors can make it harder for EU networks to identify threats early and coordinate an effective response. “The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” said George-Marius Hyzler, the ECA Member responsible for the audit. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”

European Cybersecurity Alert System Still Delayed

The audit also found that the European Cybersecurity Alert System was not operational at the time of the assessment. Two hubs examined by the auditors, ATHENA and ENSOC, had not started operating because of procurement delays. The system also lacked several elements needed for operation, including cooperation agreements, a common classification system and technical standards. The findings come as the EU continues to invest in cybersecurity. Under the 2021-2027 EU budget, €1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU’s main source of cybersecurity funding.

Overlap Among EU Cybersecurity Bodies

The ECA also identified overlapping responsibilities among some EU bodies involved in monitoring cybersecurity threats. The European Commission’s cyber situation centre, established in 2022 and largely supported by external providers, carries out work that the auditors said partly duplicates existing capabilities at the European Union Agency for Cybersecurity (ENISA). These capabilities include monitoring threats and developing cybersecurity situational awareness. The auditors called for better coordination to reduce duplication and strengthen the overall effectiveness of the EU’s cybersecurity framework.

Funding Checks Raise Security Concerns

The report also highlighted weaknesses in checks on some organisations receiving EU cybersecurity funding. These checks are intended to reduce risks linked to intrusion or influence by non-EU states and prevent sensitive security information from being shared with non-EU authorities. However, while grant beneficiaries are responsible for assessing the ownership and control of third parties receiving financial support, the European Cybersecurity Competence Centre does not verify those assessments. The ECA warned that this could expose sensitive infrastructure, operational data and security-critical technologies to security risks. The audit covered the period from 2022 to 2025 and assessed whether EU actions effectively supported the detection of and response to significant and large-scale cybersecurity incidents. Audit missions were conducted in Ireland, Greece and Italy.

“Free” movies and TV could cost you your privacy, bandwidth, and control of your home network.

We’ve warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it.

An earlier report identified CyberFlix TV, available through SuperBox’s custom app store, as containing Popanet proxy functionality that registers the device with a server controlled by the proxy operator.

Law enforcement agencies have warned that “foreign entities” are using residential proxies to conceal their identities and make their activity appear to come from someone else’s home network.

The FBI defines a residential proxy as follows:

“A residential proxy is an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere. Legitimate IP addresses assigned by an Internet Service Provider (ISP) to consumers’ Internet of Things (IoT) devices, such as TV streaming devices, digital picture frames, smartphones, tablets, and routers are used to route traffic. Once an internet-connected device is compromised, the device’s IP address can be used by threat actors to mask their online illegal activity, making the consumer appear responsible.”

Residential proxy networks rent out ordinary home IP addresses to customers. That makes their traffic appear as if it originates from a legitimate consumer connection rather than a data center, helping cybercriminals evade IP-based fraud controls and reputation systems.

Besides affecting connectivity, this can mean that a household’s public IP address becomes associated with activity it did not initiate, ranging from credential stuffing and account abuse to attempts to bypass enterprise security controls.

Plume’s more recent research warns that these proxy networks can also function as malware-delivery platforms. In other words, attackers may not only use a compromised streaming box as an exit node. They may use the proxy connection to reach the box itself and install additional malicious software.

The reported SuperBox configuration is especially troubling because it disables or weakens multiple Android safeguards. Researchers found exposed Android Debug Bridge (ADB) access, root-level privileges without authentication, and the removal of protections that would normally restrict untrusted app installation or prompt users to approve risky actions.

Many people assume that placing a streaming device behind a home router prevents outside access. Normally, network address translation and a firewall do make unsolicited inbound connections more difficult. But proxy-enabled devices can maintain an encrypted outbound connection to a remote server, creating a channel that the home router treats as legitimate traffic initiated from inside the network.

How to stay safe

The safest option is not to connect devices or install apps that promise unauthorized access to free movies and TV. You could be bringing a proverbial Trojan horse into your home.

If you own a SuperBox device or have installed CyberFlix TV, disconnect the device from your network. A factory reset may not be enough to make it safe to use again, so you should replace it.

When a device’s business model depends on monetizing your connection, its security choices can put your IP address, bandwidth, privacy, and local network at risk.

Network segmentation can reduce exposure for ordinary Internet of Things (IoT) devices, but it is not a complete answer here. A product that intentionally establishes a persistent proxy channel and offers weak device-level protection should not be trusted on a household network, even on a separate guest network.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Rising sea temperatures mean reefs don’t have enough time to bounce back between intense heat waves, a new report warns.

© Jason Gulley for The New York Times

Gunra ransomware has expanded its operations through a structured ransomware-as-a-service (RaaS) affiliate program, prompting the FBI, CISA and other agencies to issue a joint advisory warning organizations about the threat. The Gunra ransomware variant uses a double-extortion model, encrypting victim data while threatening to publish stolen information on a dedicated leak site if ransom demands are not met. The FBI first observed Gunra in April 2025 as a double-extortion ransomware variant derived from leaked Conti ransomware source code.

Gunra Ransomware Shifts to Affiliate Model

By early 2026, the group had expanded through a formal ransomware-as-a-service affiliate program advertised on dark web forums. The program provides affiliates with a management panel, configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed Gunra operating under new branding aliases, including Golden Community, while recruiting penetration testers and ethical hackers as initial access brokers. Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting. Victims observed on the group’s dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.

VPN Vulnerabilities Used for Initial Access

According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways. The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. The Republic of Korea’s National Police Agency also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access. After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB. In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent. They later used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.

Data Theft Precedes Encryption

The double-extortion ransomware operation involves stealing sensitive information before encrypting systems. The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information, and internal email communications. In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint. Compressed archives containing sensitive information were also transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes. For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the .ENCRT extension for encrypted files. A documented sample from July 2025 used the .CRYPT extension. The ransomware also uses Windows Management Instrumentation to delete volume shadow copies before encryption, while one victim had backup and archived data deleted from both primary and disaster recovery infrastructure.

Agencies Urge Patching and Network Segmentation

The authoring agencies recommend that organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. They also advise implementing and testing offline, immutable backups stored in physically separate and segmented locations. Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems. The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework. The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.

Oracle has released its July 2026 Critical Patch Update, delivering one of its largest quarterly security releases to date. The latest Oracle security patch addresses more than 1,400 vulnerabilities across hundreds of products, with the company indicating that artificial intelligence likely played a significant role in identifying most of the flaws.  According to Oracle, the July 2026 Critical Patch Update contains 1,449 security patches, covering 1,434 unique Common Vulnerabilities and Exposures (CVEs) across 334 products.  

July 2026 Critical Patch Update Covers Hundreds of Oracle Products 

The latest Oracle security patch spans a wide range of enterprise products and platforms. Among the affected products are Database Server, Oracle APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite.  The July 2026 Critical Patch Update also includes security fixes for Enterprise Manager, Financial Services Applications, Food and Beverage Applications, Fusion Middleware, Analytics, HealthCare Applications, Hospitality Applications, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Applications, Siebel CRM, Supply Chain, Systems, Utilities Applications, and Virtualization.  By addressing vulnerabilities across such an extensive product lineup, the Oracle security patch aims to reduce the risk posed by security weaknesses that could affect organizations running Oracle technologies in production environments. 

Hundreds of Vulnerabilities Can Be Exploited Remotely 

A notable aspect of the July 2026 Critical Patch Update is the number of flaws that attackers could potentially exploit without requiring authentication. Oracle stated that roughly 600 of the patches fix vulnerabilities that can be exploited remotely by unauthenticated attackers. In addition, hundreds of the addressed security flaws have been assigned critical severity ratings, emphasizing the importance of applying the latest Oracle security patch without delay. Among Oracle's products, the highest number of vulnerabilities were addressed in: 

• E-Business Suite: 410 vulnerabilities 
• Fusion Middleware: 355 vulnerabilities 
• Communications: 168 vulnerabilities 
• PeopleSoft: 84 vulnerabilities 

These figures highlight that some of Oracle's most widely deployed enterprise applications received a significant share of the security fixes included in the quarterly update.

AI-Driven Vulnerability Discovery Appears to Have Played a Major Role 

One of the most notable aspects of the July 2026 Critical Patch Update is Oracle's growing use of artificial intelligence for security research. Only a few dozen of the vulnerabilities included in the release were credited to external security researchers. This indicates that the overwhelming majority of the discovered flaws were identified internally, likely with the assistance of AI-driven vulnerability analysis. Earlier this year, Oracle disclosed that it has access to leading artificial intelligence systems, including Anthropic's Claude Mythos and OpenAI's most capable models. According to the company, these AI technologies are being used to accelerate vulnerability discovery and improve the speed and accuracy of security patch development.  Oracle also said it is applying this AI-driven vulnerability approach across its own software and cloud services, Oracle Health offerings, and the open source components that it both develops and depends on.

Organizations Urged to Apply the Oracle Security Patch Promptly 

The release of the July 2026 Critical Patch Update comes amid continued efforts by threat actors to exploit vulnerabilities in enterprise software before organizations can deploy security updates.  Oracle product vulnerabilities have previously been targeted in real-world attacks. The company cited examples that include the exploitation of a PeopleSoft zero-day vulnerability as well as a recently patched Oracle E-Business Suite (EBS) vulnerability. Given the number of remotely exploitable and high-severity issues resolved in the Oracle security patch, organizations using affected Oracle products are advised to install the updates as soon as possible. Prompt deployment can help reduce exposure to attacks that take advantage of publicly known vulnerabilities before systems are secured. With 1,449 security patches addressing 1,434 unique CVEs across 334 products, the July 2026 Critical Patch Update represents one of Oracle's most extensive quarterly security releases.  

A data breach at Paidwork, a platform that pays people small amounts to complete online microtasks, has exposed personal and financial information of more than 23 million users.

According to public breach reports, the intrusion took place in March 2026, with the stolen database first advertised on a cybercrime forum in April as an 11 GB dump allegedly taken from Paidwork’s production systems.

The exposed data reportedly includes full names, email and home addresses, phone numbers, dates of birth, gender, education details, bank account numbers, transaction records, device and IP information, profile photos, personal interests, and passwords stored as hashes.

That is a lot of sensitive information to hand over to a site that, for many users, pays only a few cents per task.

Why this kind of breach matters

For cybercriminals, a dataset like this is a goldmine for targeted phishing, account takeover, and identity fraud. Banking details and transaction histories can be abused directly, while combinations of email addresses, password hashes, and personal details make credential stuffing and social engineering much easier. Even if passwords were hashed with bcrypt, weak or reused passwords can still be cracked and tried elsewhere.

Many Paidwork users likely signed up with their “throwaway” email and a reused password, thinking the risk was low because the amounts involved were tiny. But attackers do not care how much you earned. They care how much they can make by abusing your data.

Data for pennies, risk for years

More than anything, this breach is a reminder to think critically about who you give your personal information to.

Before you hand over your full name, home address, date of birth, and bank details to a site that pays a few cents per task, ask yourself whether the trade-off is worth it.

If any service wants sensitive data, check what security and privacy commitments it makes, whether it offers meaningful support in case of a breach, and whether you can limit what you share to the minimum needed. When in doubt, keep high-value data like banking details and copies of ID reserved for organizations that genuinely need them and can be held accountable when they fail to protect them.

Check if your data was exposed

While Paidwork has not publicly acknowledged the alleged breach, the stolen data is reportedly circulating in criminal circles, and we have indexed it in our Digital Footprint Scanner so you can check whether your information was exposed.

Use our Digital Footprint Scanner to check whether your email address appears in known breach data, including data associated with this incident. If it does, treat it as a prompt to take action rather than a cause for panic:

• Change your password on Paidwork (if you still use the service) and on any other accounts where you reused the same or a similar password.
• Enable multi-factor authentication (MFA) wherever possible, especially on email, banking, and other important accounts, and consider using a password manager to generate and store unique passwords for every site.
• Monitor bank statements for unexpected withdrawals or suspicious activity.
• Be prepared for phishing emails, texts, and phone calls. Cybercriminals can use the leaked information to make their scams more convincing.
• Consider an identity monitoring or identity theft protection service.

---