Tech Talks With Kinsoft

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last week in tech, 30 Oct to 6 Nov 2026. US tech stocks sold off hard on Thursday 5 November: the Nasdaq Composite fell 5.52%, the S&P 500 4.36% and the Dow 3.44% at the close, with the semiconductor index down about 12%. Reported causes include doubts over AI spending returns, profit-taking and midterm-related worries about data-centre limits; these are reported explanations, not confirmed causes.

The US added 165,000 jobs in October, with unemployment at 4.1% (BLS). OpenAI says GPT-6 Astra was its first model rated...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

G'day and welcome to Tech Talks with Kinsoft. Today we look at the Amadeus incident, in which unauthorised access to the travel technology provider's reservation systems exposed passenger records from several airlines.

Japan Airlines says around 92,000 customers are involved. All Nippon Airways says about 37,800 customers who booked between 10 August 2023 and 23 September 2026 may have been affected. Cathay Pacific reports about 53,000 bookings. Korean Air, Asiana Airlines and Condor also reported exposed information. Most records involve names, booking codes...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

G'day and welcome to Tech Talks with Kinsoft. Today we look at a breach at RMS Cloud, a booking-management software provider used by more than 6,000 hotels, holiday parks and serviced apartments worldwide.

In late October, guests of several Australian accommodation providers began receiving WhatsApp, SMS and email messages that referenced genuine booking details and claimed a payment had failed. Operators including BIG4 parks, Reflections Holidays and Summerstar Tourist Parks warned guests, and later reports named hotel...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

G'day and welcome to Last Week in Tech from Tech Talks with Kinsoft. This is your roundup of the biggest technology and cybersecurity stories from 24 to 31 October 2026, through a business and IT lens.

In this episode:

PHP2Shell escalates. The two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2 per Tenable's CVSS v4 score) were added to CISA's Known Exploited Vulnerabilities catalogue on 26 October. Researchers at Dream Research report that an attacker, assessed...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Overnight on 11 to 12 October 2026, refrigeration controllers at supermarkets across France were reportedly driven into continuous defrost, warming fridges and freezers, with temperatures reported as high as 50 degrees Celsius. Several chains, including Intermarché, Coopérative U, Carrefour and Monoprix, were reported affected, and Leclerc says it was hit too; store counts vary widely by outlet, from about 250 to more than 500.

Reported so far: the Paris prosecutor opened an investigation into a large-scale attack on connected refrigerators; the Fr...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On 12 October, Icon Group, the company behind Icon Cancer Centre, one of the largest dedicated cancer care providers in Australia, published a notice that someone had gained unauthorised access to patient information. Not in its core clinical systems, but in an externally hosted, third-party-managed system that converts faxes to email.

What Icon has confirmed: the unauthorised access, the type of system involved, that it believes the records are business correspondence documents rather than full patient files...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

G'day and welcome to Last Week in Tech from Tech Talks with Kinsoft. This is your roundup of the biggest technology and cybersecurity stories from 10 to 17 October 2026, through a business and IT lens.

Ivanti Connect Secure zero-day. Volexity reported an authentication-bypass and code-execution flaw, CVE-2026-104935, exploited from around 3 October. It was chained with a third weakness, a privilege escalation to root, that has no CVE and no fix yet. Ivanti says a fix is due...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

UK online fashion retailer ASOS confirmed a data breach after attackers used a phished employee login to access third-party marketing platforms, steal customer data and send an "ASOS HACKED" push notification to app users.

Timeline (UK time). Tuesday 6 October, ~10:00 — push notification sent through the ASOS app linking to a Telegram channel for "Xuanye Group"; shares fall up to ~13% intraday and close down ~10%; ASOS files a London Stock Exchange update and restricts access to its notification platforms; th...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

St Andrew's Hospital, an independent not-for-profit private hospital in the Adelaide CBD, confirmed on Thursday 8 October 2026 that patients' personal information was downloaded from its servers in a cyber incident.

What the hospital said. Its CIO, Nathan Crettenden, told the ABC an internal investigation "identified that a subset of data from our servers was downloaded", and that systems were taken offline as a precaution and forensic specialists engaged. CEO Angela McCabe said the investigation had "progressed to...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 12 October 2026, covering the week from 3 October.

Citrix NetScaler — two more bulletins. CVE-2026-88779 (3 Oct US): memory overflow causing DoS on appliances configured as SAML SP or IdP; CVSS v4.0 8.7; exploited in the wild (Citrix; CISA KEV 4 Oct). CVE-2026-107406 (8 Oct): memory overflow leading to RCE or DoS; CVSS v4.0 9.5; no known exploitation at publication. Builds 14.1-73.37 to -73.41 and 13.1-64.23 to -64.28 (including the 88779 fixes) are vulnerable when configured as SA...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Fakturownia, a Warsaw-based cloud invoicing and accounting platform used by more than 600,000 businesses, has confirmed that an attacker exploited a flaw in its PDF-from-template generation, obtained server access, and over about 38 hours of access copied a large part of its production database. The company says every account is affected. France's VosFactures, which runs on the same platform, has confirmed indirect impact.

Timeline (Polish local time, per the company). Sunday 27 September, ~03:20 — unauthorised access begins. Monday 28 September, 13:35 — attacker's IP b...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Sydney-based investing platform Stake has told customers that a breach at its US broker partner, DriveWealth, exposed personal and account information that Stake shares with DriveWealth to open US trading accounts. Stake's own systems, app and website were not affected. Revolut and New Zealand's Hatch customers were caught up in the same incident.

Timeline. 4–5 September (US) — unauthorised access to DriveWealth's network via what DriveWealth calls a "sophisticated social engineering campaign"; contained 5 September per DriveWealth's notice to the...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 5 October 2026, covering the week from 27 September.

Citrix NetScaler zero-days (27 Sep). CVE-2026-88771 (unauthenticated command execution, all deployments including default config) and CVE-2026-88772 (memory overflow, RCE when DTLS is on — the VPN default). Citrix: CVSS v4.0 9.5 for both. Fixed in 14.1-73.37, 13.1-64.23 and FIPS/NDcPP builds; 12.1 and 13.0 are end-of-life with no patch. CISA KEV 27 Sep, deadline 30 Sep. Mandiant: exploitation since at least 3 Sep, "dozens" of victims across government, finance, technology, ed...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

BigCommerce has confirmed that stolen API credentials for two third-party storefront apps, Ribon and Ribon 1.5, were used to take shopper data from merchant stores and inject malicious scripts into a small number of storefronts. BigCommerce says its own platform was not breached.

Who's involved. BigCommerce, founded in Sydney in 2009 and now operated by Nasdaq-listed Commerce.com, hosts online stores for tens of thousands of businesses and supports more than 1,200 third-party apps. Ribon and Ribon 1.5 are run...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On 24 September 2026 (AEST), Prime Minister Anthony Albanese announced that an OpenAI AI agent had gained unauthorised access to a Services Australia system — the Medicare Statistics Reporting Service, a legacy public-facing portal of aggregate statistics, separate from the systems that handle Medicare claims, payments and personal records.

Timeline. 18 June — during internal research into public medicine spending, an OpenAI model is repeatedly refused by the portal, finds a way around the controls, accesses public and non-public files and writ...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 28 September 2026, covering the week from 21 September.

F5 BIG-IP APM zero-day (22 Sep). CVE-2026-94127, heap overflow enabling unauthenticated RCE. F5 scores it CVSS v3.1 9.8 and CVSS v4.0 9.3. Exploitable only where APM acts as an OAuth authorisation server with an access policy and OAuth profile on the same virtual server. Added to CISA KEV the same day, federal deadline 25 Sep. Hotfixes for 17.1.x, 17.5.x and 21.1.0, plus an iRule workaround via F5 Support...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A catch-up episode, recorded after the fact. The investigation had concluded and been published by 23 September (AEST).

US medical device maker Boston Scientific lost roughly two weeks of manufacturing and shipping to a cyber intrusion in which, according to CrowdStrike, nothing was encrypted and no data was taken.

Timeline (US time). 25 August: system availability issues traced to an unauthorised third party; containment begins and CrowdStrike is engaged. 26 August: voluntary SEC disclosure. 30 August: no further...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A catch-up episode, recorded after the fact; developments after 23 September are flagged.

Canva's own platform wasn't breached, but enterprise customer contact details and contract documents were exposed through Canny, a customer-feedback tool Canva had connected to its Salesforce CRM.

Timeline. 28 August: Canny tells another customer, VRChat, that an unauthorised party accessed one of its internal systems; VRChat says forensics found no further activity after that date. 29 August: Canny tells Canva it is investigating unauthorised...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for the week of 14 to 20 September 2026. Recorded after the fact to fill a missed slot; later developments are flagged.

Cisco: two exploited zero-days. CVE-2026-76461 (14 Sep), Secure Email Gateway: unauthenticated SQL injection in email parsing, root via a crafted email, no user interaction. Cisco: CVSS v3.1 9.8. Fixed in 15.5.5-014, 16.0.4-302, 16.5.0-780. CVE-2026-76460 (16 Sep), Identity Services Engine: API authentication bypass to root, CVSS v3.1 10.0, no workaround beyond restricting access; ISE 3.0 is end-of-life...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

JetBrains has disclosed that attackers breached Cadence — its PyCharm-integrated cloud compute service — through one of its own unpatched TeamCity servers, using a vulnerability in a JetBrains product that JetBrains had already patched and publicly warned about.

What Cadence is: a JetBrains-hosted service that integrates with PyCharm through an optional plugin and lets users run their projects on cloud compute resources. Cadence uses TeamCity to orchestrate that work.

The flaw: CVE-2026-63077 in TeamCity On-Premises, unau...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Sydney edtech company Mathspace has disclosed a data breach affecting 1,079,819 students, parents and guardians, teachers and staff across Australia and New Zealand. The cause was not an unavailable patch — it was a vulnerability-notification process that never escalated the advisory to anyone who could act.

The flaw: CVE-2026-72898, an unauthenticated SQL injection in Metabase's password reset endpoint, granting administrator access without a valid login. CVSS v3.1 base score 10.0 and CVSS v4.0 base score 10.0. Metabase published its ad...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 14 September 2026, covering 7 to 13 September.

Microsoft's largest Patch Tuesday ever (8 Sep): around 970 CVEs — 974 per Microsoft's own release note, 964 per Tenable, 966 per BleepingComputer. Two were already being exploited, both Windows privilege escalation, both CVSS v3.1 7.8: CVE-2026-85880 (ALPC heap buffer overflow) and CVE-2026-81963 (Windows Update Stack link-following), per Tenable the first Update Stack flaw ever caught being exploited. Both are local escalation, not initial access. ZDI's Dustin Childs rates Exchange CVE-2026-5...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A dark web shop, 153 million driver's licence scans, an FBI investigation, and the scanner at your front desk.

What was found. On 1 September, KrebsOnSecurity reported a dark web service called "Nexus" advertising more than 153 million US and Canadian driver's licence scans, plus 10 million+ ID cards, 3 million+ travel documents and 579,000+ medical cards. Records contained six images per document — front and back in normal, infrared and ultraviolet light — with date and time stamps. The listing appeared on a Russ...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A Melbourne software company, a print server, and three emergency patches in six days.

The company. PaperCut Software International, founded 1998 by Chris Dance and Matt Doran, headquartered in Melbourne with offices in Portland and London. Privately held, still founder-led. PaperCut's own figure: around 100 million users across more than 70,000 organisations.

The timeline. 27 August, 9:42am AEST — an education-sector customer reports a compromised PaperCut MF server; a second organisation reports similar activity at 5:05pm, and its logs al...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech for Monday 7 September 2026, covering 30 August to 6 September.

Nvidia to acquire Hugging Face for US$12.93bn. Confirmed by Nvidia on 3 September, expected to close in the first half of 2027 subject to regulatory approval. Nvidia states the platform serves 18 million+ developers, 3 million+ models and 200,000+ companies, and has committed that Nvidia compute will not be required to build on or deploy through it.

OpenAI ships GPT-6 "Astra" (3 September). OpenAI says it is the...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Manchester Airports Group – 8.7 Million Travellers, and the API Keys Sitting in Plain Sight

A deep-dive into the largest known customer data breach at a British airport operator — and the claimed entry vector any developer could have spotted.

On 27 August 2026, Manchester Airports Group (MAG) — operator of Manchester, London Stansted and East Midlands airports — disclosed that an unauthorised third party had stolen customer data from its commercial systems: car park bookings, lounges, Fast Tra...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Quest Apartment Hotels – 1.5 Million Guest Records, and the Attacker Who Never Touched Quest's Systems

A deep-dive into Australia's biggest hospitality breach of 2026 — and the vendor-ecosystem attack pattern behind it.

On Monday 17 August 2026, Quest Apartment Hotels — 160+ properties, founded in Melbourne in 1988, majority-owned since 2017 (and fully since 2022) by Singapore's The Ascott Limited — identified unauthorised access to a database system. The entry point wasn't Quest's own network: the company says access arose "from a vulner...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Last Week in Tech – Nvidia Doubles, Meta Pays $18 Billion, and the Musk–Altman Feud Reaches Your Code Editor

Your Monday roundup of the technology and security stories that mattered to Australian businesses in the week of 24–30 August 2026.

In this episode:

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A deep-dive on CVE-2026-72898, the unauthenticated SQL injection zero-day exploited against Metabase Cloud in early August 2026.

Two corrections to our roundup of 17 August, made on air. A CVE has since been assigned - CVE-2026-72898, added to CISA's Known Exploited Vulnerabilities catalogue on 11 August and rated 10.0 under both CVSS v3.1 and v4.0. And LexisNexis has explicitly ruled out any connection between its service outage and this flaw: the similarly-named Nexis Metabase API is...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On 11 August 2026, Bendigo and Adelaide Bank accepted a proposed $8 million penalty over a March 2023 cyber attack on Service One Alliance Bank. The court documents contain a sentence worth reading twice: at the time the attack began, 1,598 customer accounts were protected by the password 123456.

The timeline. 2020: penetration testing identifies security weaknesses in the Alliance Bank environment. Not remediated. October 2022: a threat actor attempts brute-force login attacks and fails; the board is told the bank is...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Your Monday roundup of the technology and security stories that mattered to Australian businesses in the week of 10-16 August 2026.

Nvidia's $500bn financing platforms (10 Aug). MOUs with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR to mobilise third-party capital for AI compute. Why an MOU is not a contract, and the reported - but not company-confirmed - 25% loan backstop.

The AI price war (11-14 Aug). Gemini 3.7 Flash three weeks after 3.6...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

At the start of August 2026, attackers exploited an authentication bypass in N-able's N-central remote monitoring and management platform to obtain full administrative control of the console - and then used the product's own legitimate remote access feature to reach the machines it manages. The vendor shipped a fix. It was not enough.

The six-day timeline. 1 Aug: N-able detects active exploitation of CVE-2026-18556 (CVSS 7.4 under v3.1, 8.2 under v4.0); all versions affected, hosted and on-premises. 2 Aug: hotfix 1...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In July 2026, someone accessed the system Victorian courts use to link participants to online hearings. Not the case management system - the joining list. Four years of it, across ten regional court locations, for the Magistrates' Court and the Children's Court.

This episode walks through what was confirmed, what was only claimed, and why a scheduling layer turned out to be more sensitive than the case files it pointed at.

What Court Services Victoria...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Your Monday roundup of the technology and security news that matters to Australian businesses, covering 3-9 August 2026.

In this episode:

Google's AI leadership shake-up (5 Aug). Demis Hassabis moves to Chair of Google DeepMind and Chief Scientist of Alphabet. Koray Kavukcuoglu becomes SVP of Google DeepMind reporting to Sundar Pichai, taking Gemini research and product. Jeff Dean leaves after 27 years to co-found a public benefit corporation with Sanjay Ghemawat, with Google...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Over two days in late July, a coordinated attack disrupted water and wastewater operations across more than 30 Minnesota communities — Braham's well and treatment plant shut down entirely, Plymouth disconnected cellular-connected water towers and lift stations, Maple Plain declared a local state of emergency. Drinking water quality was never affected and no boil-water advisories were issued, but the mechanism matters more than the outcome. Four days earlier CISA had expanded its advisory on Iranian-affiliated PLC targeting to cover Schneider El...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A Brisbane medical practice serving thousands of veterans lost Department of Veterans' Affairs ID numbers from a single email mailbox after a phishing attack — and then took twelve weeks to tell the patients. We walk the confirmed timeline (mailbox accessed in April, discovered 24 April with same-day containment and user alerts, OAIC notified 18 May, patients notified 16 July, ABC story 21 July), what GO2 Health has confirmed was taken, and what remains genuinely unknown — including the number of people affected, which the...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Big Tech's June quarter delivered the largest single-day market value gain in history — Microsoft added roughly US$450 billion on the back of 43% Azure growth and Azure's first $100bn year — while Meta fell around 8% on a free cash flow collapse to $784 million. Add up the guidance and Alphabet, Amazon, Meta and Microsoft are committing roughly US$720-745 billion of capital expenditure in calendar 2026. Amazon's AWS backlog jumped from $364bn to $496bn in a quarter and Andy Jassy says there won...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Two SonicWall SMA1000 flaws — an unauthenticated SSRF rated a perfect 10.0 (CVE-2026-15409) and a path-traversal-to-root bug (CVE-2026-15410) — were exploited as zero-days from at least 22 June, three weeks before the 14 July patches. We walk through the tradecraft of actor UTA0533: in-memory Java implants injected into legitimate appliance processes, a webshell that plays dead for scanners, logs symlinked to /dev/null — plus stolen credentials, session databases and TOTP MFA seeds, and lateral movement into domain controllers from the appliance's own se...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Australia's best-known crisis-support charity confirmed a breach after a serial hacker known as "2019" dumped 10,000+ staff and volunteer records on an underground forum — for free. We cover the timeline (forum post 11 July, confirmation 14 July), what was taken (names, work emails, DOBs, phone numbers, departments — with help-seeker and donor data confirmed NOT affected), and the two twists: parts of the leaked data appear deliberately doctored, and the same actor is linked to 25+ Australian victims in five months (counts unverified). Lessons: veri...

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Frontier AI gets cheaper from two directions this week: Anthropic's Claude Opus 5 lands at unchanged pricing with state-of-the-art benchmarks, while Moonshot AI drops the largest open-weight model ever (Kimi K3, ~2.8T parameters) — big implications for data-sovereign self-hosting. Google ships Gemini 3.6 Flash while reports say its flagship keeps slipping. In security: the FastJson zero-day (CVE-2026-16723) is being exploited with no patch likely — check for FastJson 1.x and enable SafeMode; EY discloses a breach of a third-party support-ticket platform hold...