Cybersecurity News This Week: Why Internet-Facing Systems and AI Need Executive Attention

A fresh wave of cybersecurity warnings this week has delivered a familiar message for Australian businesses: attackers are moving quickly, and the systems that keep staff, customers and suppliers connected are increasingly attractive targets.

From exploited firewall and remote access flaws to weaknesses in infrastructure management and the growing risks of poorly governed artificial intelligence, the most important stories are not only technical. They affect business continuity, customer trust, insurance, compliance and the cost of recovery.

The biggest immediate risk: internet-facing security appliances under attack

Two separate developments this week highlighted the danger of security appliances that sit on the edge of a business network. These systems are designed to protect organisations, but when attackers find a way around authentication or gain access to management functions, they can become a direct route into the wider environment.

The first warning concerns Citrix NetScaler appliances. Security researchers and technology providers reported active exploitation of two unpatched vulnerabilities affecting certain NetScaler ADC and NetScaler Gateway configurations. One of the flaws, CVE-2026-19490, is an authentication bypass issue with a reported CVSS score of 9.3. It may affect appliances configured for services such as SSL VPN, ICA Proxy, RDP Proxy or an AAA virtual server.

The issue matters because remote access infrastructure is often exposed to the public internet by design. A vulnerable appliance can provide attackers with a foothold before they need to defeat endpoint security, trick an employee or compromise a cloud identity. Reports this week also suggested that some organisations were being privately advised to take affected appliances offline while awaiting or applying remediation.

Citrix previously published a security bulletin identifying fixed builds and affected configurations. Businesses should compare their deployed versions and settings against the Citrix security bulletin, rather than assuming a standard patch cycle has addressed the risk.

A second warning involved Check Point products. According to a recent vendor advisory, CVE-2026-85102 was being exploited against some Security Gateway and Spark Firewall customers, while a newly disclosed management vulnerability, CVE-2026-93616, was also being exploited in limited attacks. Both vulnerabilities were rated as critical, and fixes were made available through Check Point hotfixes.

For smaller organisations, the practical lesson is straightforward: security appliances require the same urgency as servers and laptops. They are not set-and-forget devices.

Recommended actions:

• Build an inventory of every firewall, VPN gateway, remote access appliance and security management server, including equipment managed by an external IT provider.
• Check vendor advisories for exact software versions, configurations and hotfix requirements. Do not rely only on the product name.
• Restrict management interfaces so they are not reachable from the public internet unless there is a clear operational requirement.
• Review authentication, administrator accounts and recent login activity for unusual locations, impossible travel or unexpected certificate-based access.
• Confirm that incident response plans include the possibility of taking a remote access platform offline and switching to an approved temporary process.

The Check Point advisory provides a useful example of why active exploitation should change the priority of patching. A vulnerability with proof of exploitation is no longer a future risk. It is an operational issue that needs ownership, deadlines and evidence of completion.

Infrastructure management systems are becoming a high-value target

A separate industry report this week examined vulnerabilities affecting network devices, servers, firmware and other infrastructure components. The report tracked 158 security advisories across 17 vendors between August 25 and September 17, including 42 critical-rated advisories and 71 vulnerabilities that could be exploited remotely without authentication.

The report also identified vulnerabilities that were later added to the US Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalogue. The underlying trend is important for businesses of all sizes: attackers are increasingly targeting the tools used to configure, monitor and control infrastructure, not just the end-user devices connected to it.

For a small or mid-sized business, this may include a managed switch, wireless controller, backup console, hypervisor, storage appliance, domain controller, monitoring platform or cloud management account. Many of these systems are operated by a small IT team, an outsourced provider or a business owner who may not have a complete view of the asset estate.

The risks extend beyond data theft. A compromised management platform can allow an attacker to change settings, disable controls, create accounts, alter backups or move laterally between systems. In some cases, the management tool has more authority than the individual devices it controls.

This is one reason patching programmes should not be limited to Windows and popular office applications. Infrastructure products can have longer maintenance cycles, less visible ownership and more complicated change requirements. That combination creates gaps that attackers can exploit.

Recommended actions:

• Ask your IT provider for a current list of network, storage, backup, virtualisation and security management systems.
• Identify which management interfaces are exposed to the internet, reachable through a VPN or accessible from ordinary user networks.
• Use separate administrator accounts for infrastructure management and prohibit shared credentials wherever possible.
• Require multi-factor authentication for cloud consoles, remote management platforms and privileged accounts.
• Test whether backups remain available if an attacker compromises the primary management environment.

The Infrastructure Trust reporting is a reminder that vulnerability management is partly an accountability exercise. Someone should be able to answer what the business owns, who maintains it, which version is installed and how quickly a critical issue can be fixed.

Australian businesses are being urged to treat AI governance as a security issue

Australia’s national cyber authority also published a high-priority alert this week about the risks of AI misalignment for Australian organisations. The warning broadens the cybersecurity conversation beyond malware and stolen passwords. It recognises that artificial intelligence can create security problems when systems act outside business expectations, follow unsafe instructions, expose sensitive information or make decisions without appropriate human oversight.

AI tools are already being used by businesses for customer support, document analysis, marketing, software development, recruitment, finance and internal knowledge management. Many deployments begin informally, with staff signing up for a public service or connecting a tool to company data before security, privacy and legal teams have reviewed the arrangement.

The risk is not limited to a malicious AI system. Misalignment can arise when a tool has access to more information than it needs, when instructions are ambiguous, when employees paste confidential material into an external service or when an AI agent can take actions without approval.

For managers, this creates a governance challenge. A business may have a written policy that says staff must protect confidential information, but that policy may not explain whether employees can upload customer records, source code, pricing details, contracts or personal information to an AI service.

The ASD’s ACSC alert is particularly relevant to small and medium businesses because it frames AI risk as an organisational issue, not something that can be left entirely to developers or software vendors.

Recommended actions:

• Create a simple register of approved AI tools, including who owns each tool and what information it can access.
• Define clear rules for confidential, personal, commercially sensitive and regulated information.
• Require human approval before an AI system sends external messages, changes records, approves transactions or makes decisions affecting customers or staff.
• Review the permissions granted to AI assistants, browser extensions and workflow automation platforms.
• Train employees to recognise prompt injection, misleading outputs, data leakage and fabricated references.

AI can still deliver significant benefits. The practical goal is not to block every new tool. It is to make sure the business knows what the tool can see, what it can do and who is accountable when the result is wrong.

The supply chain remains a business risk, not just a technology risk

Recent incidents involving marketing platforms, embedded website components and third-party services continue to show how an attack on one provider can affect many customers at once. A breach does not need to begin inside your own network to create risk for your business. It may start with a supplier’s API key, a compromised script, a cloud configuration or a software update.

One recent incident involving the Brevo communications platform demonstrated how attackers used a compromised Cloudflare API key to alter web content and inject malicious ClickFix instructions into pages and scripts used by customers. The incident was reported earlier in September, but its implications remain relevant this week because many businesses still rely on third-party code embedded in websites, forms, marketing platforms and customer portals.

ClickFix attacks are especially concerning because they attempt to persuade a visitor to perform a dangerous action themselves. Instead of exploiting a technical weakness silently, the attacker presents a fake verification screen and encourages the user to copy and run a command. This blends social engineering with supply-chain compromise and can bypass some traditional expectations about how malware reaches a device.

For a business, the affected party may not be the organisation that owns the compromised service. It may be a customer visiting a company website, an employee using a web form or a supplier whose integration is connected to a business process.

Recommended actions:

• Maintain a record of third-party scripts, plugins, widgets, analytics tools and marketing integrations used on public websites.
• Ask suppliers how they protect API keys, restrict administrative access and detect unauthorised changes.
• Remove unused integrations and rotate long-lived credentials, especially keys embedded in source code or shared between environments.
• Monitor websites for unexpected redirects, new scripts, altered content and suspicious file changes.
• Train staff and customers never to copy and run commands because a website, browser prompt or support message tells them to do so.

Supplier risk should also be included in contracts and business continuity planning. Your organisation may not be able to prevent a vendor breach, but it can reduce the impact by limiting permissions, separating systems and knowing how to disable an integration quickly.

What the latest warnings say about patching and response speed

The common thread across this week’s news is not a single software brand or a particular criminal group. It is the speed at which a seemingly narrow technical issue can become a business incident. Internet-facing systems can be scanned continuously. Attackers do not wait for a quarterly meeting before testing a newly disclosed weakness.

A mature security programme therefore needs two speeds. Routine maintenance keeps systems supported, patched and monitored. Emergency response deals with vulnerabilities that are being exploited now, especially where the affected system provides remote access, administrative control or a connection to sensitive data.

For many smaller organisations, the challenge is not a lack of concern. It is a lack of time, visibility and clear ownership. That is why a short, documented process can make a substantial difference.

Recommended actions:

• Set a severity threshold that triggers an emergency change process for actively exploited vulnerabilities.
• Assign a named owner for every internet-facing system and require confirmation when remediation is complete.
• Keep offline or otherwise protected backups and test restoration regularly.
• Centralise key logs where possible, especially authentication, administrator, firewall, VPN and cloud activity.
• Practise a basic incident scenario involving a compromised VPN, unavailable website or suspected supplier breach.

Businesses operating in Australia should also know how to escalate suspected incidents. The Australian Cyber Security Centre provides reporting and mitigation guidance, while managed service providers and specialist incident response firms can help organisations assess exposure and preserve evidence.

What This Means For Your Business

This week’s cybersecurity news is a useful prompt to focus on fundamentals. The highest-value actions are often practical rather than expensive: know what is exposed, patch systems that are under active attack, protect privileged access, limit supplier permissions and make sure backups can actually be restored.

Business leaders should ask their IT team or provider five questions: Which internet-facing systems do we operate? Which critical vulnerabilities affect them? When were they last checked? What would we do if remote access had to be disabled? Which third parties can change content or access business data?

The answers will not eliminate risk, but they will turn uncertainty into a manageable plan. Security is not a one-off project. It is an operating discipline that protects revenue, reputation and the ability to keep serving customers when something goes wrong.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.