Cybersecurity News This Week: Four Risks Business Leaders Should Act On Now

The latest cybersecurity news has a clear message for Australian businesses: attackers are increasingly targeting identity, trusted suppliers and internet-facing systems rather than relying on obvious malware. The good news is that the most effective responses remain practical and achievable.

Introduction

Between September 14 and September 21, 2026, several developments stood out for small and mid-sized organisations. Cisco warned that a critical zero-day in its Secure Email Gateway was being actively exploited. Microsoft detailed a campaign using passkey and single sign-on lures to compromise cloud identities. A large breach at image-sharing service Gyazo highlighted the continuing cost of exposed customer data, while fresh activity in software supply chains showed that malicious code can evade traditional install-time checks.

There was also an important regulatory development in Europe. The European Union’s Cyber Resilience Act reporting platform became operational for mandatory reporting of actively exploited vulnerabilities and severe incidents affecting products with digital elements sold into the EU.

These stories are globally relevant, including for Australian organisations that use cloud services, imported technology, software-as-a-service platforms or offshore suppliers. The common thread is that cyber risk is now closely tied to ordinary business operations. Security is not just an IT concern. It affects payments, customer trust, business continuity, procurement and compliance.

1. Cisco email gateway zero-day shows why perimeter devices need priority patching

Cisco disclosed a critical SQL injection vulnerability in its Secure Email Gateway software. The flaw, tracked as CVE-2026-76461, affects virtual and physical appliances and can allow an unauthenticated remote attacker to execute commands with root privileges. Cisco said it became aware of active exploitation in September and published its advisory on September 14.

The vulnerability does not require a complicated chain of attacks. An attacker can send a specially crafted email through an affected gateway and exploit the device’s email parsing logic. Cisco stated that there were no workarounds available, making software updates the primary response for affected customers. The Cisco security advisory lists the affected products and fixed releases. citeturn1search10turn0search11

Why it matters for businesses

Email security appliances are often treated as background infrastructure. They sit at the edge of the network, process large volumes of external content and may have broad visibility into business communications. A compromise could provide a foothold for credential theft, internal reconnaissance, malware delivery or disruption of email services.

The wider lesson is just as important as the Cisco incident. Attackers continue to prioritise internet-facing devices because one unpatched appliance can bypass many controls inside the network. Small businesses may be especially exposed if updates are handled by a managed service provider but no one confirms the work was completed.

Practical recommendations

• Identify every internet-facing appliance, including email gateways, firewalls, VPNs, remote management tools and virtual appliances.
• Check Cisco’s advisory and confirm the exact software version, not just the product family.
• Ask your IT provider for written confirmation that patches were applied and services restarted successfully.
• Review email gateway, firewall and identity logs for unusual administrator activity, unexpected outbound connections and new accounts.
• Maintain an emergency patching process for vulnerabilities that are both critical and actively exploited.

A normal monthly patch cycle is not enough when a vendor reports active exploitation. Businesses should have a separate process for high-risk vulnerabilities that can be assessed and acted on within hours, not weeks.

2. Passkey-themed phishing is turning trusted authentication into an attack surface

Microsoft has described an active campaign in which attackers impersonate internal IT staff and tell employees that they must update a passkey, multifactor authentication setting or single sign-on configuration. The victim may receive a phone call, text message, email or Teams message before being directed to a fake sign-in page or a legitimate authentication page using a device code flow.

Once access is obtained, the attacker can register a new authentication method, inspect the victim’s cloud applications and collect information from Microsoft 365. Microsoft observed activity involving SharePoint, OneDrive, Exchange and Microsoft Graph, with some collection automated and spread over hours or days rather than completed in a single burst. The Microsoft Security research recommends investigating identity events as a connected sequence, from the original unusual sign-in through to new authentication methods and abnormal file access. citeturn1search0

This story comes as Microsoft begins rolling out passkeys as the default authentication experience for some Entra ID users. Passkeys are designed to resist phishing, but the rollout itself creates a useful social engineering theme. Employees may reasonably expect messages about new sign-in procedures, which gives criminals an opportunity to create urgency and confusion. Microsoft’s passkey deployment guidance explains the planned changes and preparation steps. citeturn1search1

Why it matters for businesses

Multifactor authentication remains essential, but not every form of MFA provides the same protection. Attackers can manipulate users into approving a sign-in, entering a device code or registering an unauthorised authentication method. An employee can therefore follow what appears to be a legitimate security instruction and still hand over access.

For business leaders, this is a reminder that security awareness training must reflect current attacks. Telling staff to watch for suspicious emails is too broad. They need to know that a phone call claiming to be from IT can be part of the attack, and that genuine-looking Microsoft pages do not automatically mean the request is safe.

Practical recommendations

• Establish a simple rule that IT staff will never ask employees to approve an unexpected MFA request or read out a verification code.
• Require employees to verify authentication changes through a known phone number, service desk portal or face-to-face channel.
• Restrict who can register new authentication methods and alert on registrations following unusual sign-ins.
• Disable device code authentication where there is no clear business requirement.
• Prefer phishing-resistant methods such as passkeys or FIDO2 security keys, while still training users about social engineering around enrolment.
• Monitor unusual downloads from SharePoint and OneDrive, new mailbox rules, suspicious app consent and access from unmanaged devices.

The objective is not to discourage modern authentication. It is to manage the transition properly and make the safe process easier than the attacker’s process.

3. The Gyazo breach reinforces the business cost of exposed customer data

Image-sharing platform Gyazo confirmed that attackers exploited a server vulnerability and stole data linked to approximately 23.6 million user records. The incident was reported during the past week and is another example of how a vulnerability in an online service can become a large privacy and trust issue.

The reported breach details indicate that the attackers were able to access a large volume of records through a server flaw. The case is still a reminder that the consequences of a breach are not limited to the organisation that runs the affected service. Customers, partners and downstream businesses may also face phishing, impersonation and privacy risks when their details are exposed. citeturn0search10turn0search7

Why it matters for businesses

Many organisations store customer information in platforms that are not considered core business systems. Image hosting, marketing, document sharing, customer support, payroll and logistics services can all hold names, email addresses, addresses, account identifiers or other sensitive information.

A supplier breach can create operational and legal questions even when your own network was not compromised. Customers may still expect your business to explain what happened, what information was involved and what you are doing to reduce the risk. In Australia, privacy obligations and contractual commitments may also influence notification and response requirements.

The incident also highlights a common weakness: collecting and retaining more data than the business needs. Every additional field stored by a supplier increases the potential impact of a compromise.

Practical recommendations

• Create an inventory of the data held by external platforms and identify which suppliers store personal or commercially sensitive information.
• Ask important suppliers how they manage vulnerability disclosure, patching, access control, logging, backups and incident notification.
• Review contracts to confirm notification timeframes, cooperation obligations and responsibility for customer communications.
• Remove obsolete accounts and delete data that is no longer needed for business, legal or operational reasons.
• Prepare a supplier-breach playbook covering who investigates, who communicates with customers and who assesses privacy obligations.

Vendor assurance does not need to become a large compliance project. Start with the services that hold the most sensitive information or that would cause the greatest disruption if unavailable.

4. Software supply chain controls are improving, but they cannot replace internal discipline

Recent reporting has highlighted malicious packages and supply chain attacks that exploit trusted developer tools and package registries. One current concern is malware that hides its behaviour in normal runtime activity instead of relying on an obvious installation script. That approach can reduce the chance of detection by controls focused only on package installation.

At the same time, npm has expanded protective measures for account recovery and package publishing. It now places a temporary security hold on all accounts after a successful recovery-code sign-in, pausing publishing and other sensitive changes for 72 hours. GitHub has also introduced staged publishing and malware scanning features intended to reduce the damage caused by compromised maintainer accounts. The npm security update and trusted publishing changes describe these measures. citeturn1search3turn1search2

Why it matters for businesses

A business does not need to publish software to be exposed to software supply chain risk. Many organisations install open source libraries through a web application, use third-party plugins in a content management system or rely on software built by a supplier. A compromised package may steal credentials, alter transactions or provide access to internal systems.

For smaller organisations, the practical challenge is visibility. Developers may use packages that never appear in a central software inventory, while business teams may install browser extensions, automation tools or AI integrations without involving IT.

The answer is not to stop using open source software. It is to make software provenance, approval and monitoring part of normal operations.

Practical recommendations

• Maintain a current inventory of applications, plugins, package dependencies and automation tools.
• Pin approved dependency versions and review changes before production deployment.
• Use trusted publishing, short-lived tokens and multifactor authentication for developer and package registry accounts.
• Scan dependencies for known vulnerabilities and malicious packages, but do not rely on scanning alone.
• Restrict build systems’ access to production credentials and rotate secrets after a suspected compromise.
• Require suppliers to explain how they monitor and respond to software supply chain incidents.

For businesses without an internal development team, the same principle applies to outsourced software. Ask who can change the code, how changes are reviewed and how quickly the supplier can notify you of a compromise.

5. Europe’s new reporting platform raises the bar for cyber governance

The European Union’s Cyber Resilience Act Single Reporting Platform became operational on September 11, 2026. The platform allows manufacturers and, when applicable, open source software stewards to report actively exploited vulnerabilities and severe incidents involving products with digital elements made available in the EU market. The ENISA platform guidance confirms that mandatory notifications are submitted through the platform from September 11. citeturn1search5

Australian businesses that sell connected products into Europe may be directly affected. Others may be affected indirectly because their suppliers, technology partners or distributors must meet new reporting and product security expectations.

Why it matters for businesses

Regulation increasingly expects businesses to demonstrate that security is managed throughout the product lifecycle. That includes vulnerability handling, incident response, supplier coordination, customer communications and evidence of decisions made during an incident.

Even where a particular law does not apply, the underlying expectations are becoming standard commercial practice. Customers, insurers and larger partners increasingly ask for evidence of patch management, access controls, security testing and incident response.

Practical recommendations

• Determine whether your products, services or suppliers are affected by European cyber product rules.
• Assign a clear owner for vulnerability disclosure and incident reporting decisions.
• Keep an up-to-date record of critical products, versions, suppliers and customer contacts.
• Test your incident response plan, including legal, privacy, communications and technical roles.
• Preserve decisions and evidence during incidents so the business can demonstrate what it knew and when it acted.

Good governance is not bureaucracy for its own sake. It shortens response times and reduces confusion when an incident affects customers or operations.

What This Means For Your Business

This week’s news does not point to one single threat that every business must fear. It shows a pattern: attackers are exploiting trust, speed and complexity. They are targeting security appliances, authentication workflows, cloud repositories, suppliers and software development processes because these systems sit close to valuable business information.

The most useful response is to prioritise a small number of actions. Confirm that internet-facing systems are patched. Review who can register authentication methods and approve application access. Make sure employees know how to challenge an urgent request from someone claiming to be IT. Identify which suppliers hold sensitive information and test how your business would respond if one of them were breached.

Then turn those actions into repeatable processes. A monthly security meeting, a current asset list, a tested backup, a supplier register and a clear incident contact list can make a major difference. Businesses do not need perfect security to reduce risk, but they do need visibility, ownership and a willingness to act quickly when credible warnings appear.

The organisations that handle cyber risk best are not necessarily the largest. They are the ones that know what matters most, make sensible controls easy for staff to follow and treat cybersecurity as part of business resilience.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.