Tuesday 30 June 2026

Someone Just Dumped a Live Zero-Day Arsenal on the Internet — and Attackers Are Already Using It

An anonymous researcher dropped a repo of live zero-days, Oracle's PeopleSoft flaw keeps claiming new victims, and Bendigo Bank races to build Australia's first AI-powered security operations centre.

Lead story

Someone Just Dumped a Live Zero-Day Arsenal on the Internet — and Attackers Are Already Using It

An anonymous researcher published what's being called an "exploitarium" — a public repository packed with zero-day exploits — and at least two of the vulnerabilities inside are already being actively exploited in the wild. The Register broke the story Monday evening, and the security community has been scrambling ever since.

This isn't a responsible disclosure. There was no vendor notification, no patch window, no CVE coordination. Someone just dropped a loaded weapon on the internet and walked away.

Why this is different from a normal PoC drop. Proof-of-concept code gets published all the time, usually after a patch is available or after a grace period expires. This is the opposite: vulnerabilities that vendors apparently didn't know existed, now weaponised and in the hands of anyone who can find a GitHub repo. The barrier between "theoretical threat" and "commodity exploit" just collapsed for however many flaws are in the collection.

The timing is particularly uncomfortable. It lands in the same news cycle as a separate disclosure of a critical libssh2 flaw (CVE-2026-55200, CVSS 9.2) that also now has a public proof-of-concept — meaning defenders are simultaneously patching a known-critical library bug and trying to figure out what unknown bugs just got handed to attackers.

What's in the repo? Details are still emerging. The Register's reporting confirms at least two flaws are under active attack, but the full scope of the exploitarium — how many vulnerabilities, which products, what severity — remains unclear as researchers pick through it. That uncertainty is part of the problem. Defenders can't prioritise what they can't yet enumerate.

The broader pattern. This sits alongside a separate, uncomfortable trend: the anonymous publication of CVE-2026-55200's PoC for libssh2, which affects every release up to 1.11.1. libssh2 is embedded in a remarkable number of tools — anything that makes SSH connections as a client, including deployment pipelines, configuration management tools, and monitoring agents. The bug allows a malicious SSH server to trigger memory corruption on the connecting client with no credentials and no user interaction required. Patch or isolate before you connect to anything you don't control.

For Australian organisations, both stories carry weight. The ACSC's revised cyber defence framework — which replaced the Essential Eight just last week — explicitly calls for faster vulnerability response and continuous exposure management. An anonymous zero-day dump is exactly the kind of scenario that framework is designed for: you can't wait for a formal advisory when exploitation is already underway.

Watch for: vendor statements identifying which of their products are affected by the exploitarium disclosures; any attribution attempts on the anonymous researcher; and whether platforms like GitHub act to take the repo down or leave it up on responsible-disclosure grounds. The latter is genuinely complicated — some of the most important security research lives in exactly this format.

The uncomfortable truth is that the gap between "security researcher" and "threat actor" has never been thinner, and today's news is a reminder that the ecosystem doesn't have a great answer for what happens when someone decides the rules don't apply to them.

Also today

Bendigo Bank Wants Australia's First AI-Powered SOC

Bendigo Bank has announced plans to build what it's calling Australia's first fully agentic security operations centre — a SOC where AI agents handle triage, investigation, and response workflows rather than just flagging alerts for human analysts. The bank is reshaping its entire security operations and support stack around the initiative. It's an ambitious claim, and the detail will matter: "agentic SOC" can mean anything from a few automated playbooks to genuinely autonomous threat response. But the direction of travel is clear — Australian financial institutions are betting that AI can close the analyst shortage gap faster than hiring can. The ACSC's updated cyber defence framework, published last week, explicitly supports continuous monitoring as a core capability.

iTnews ↗

ShinyHunters' Oracle PeopleSoft Rampage Claims Nissan and NAIC

The ShinyHunters extortion group has now been linked to breaches at both Nissan and the US National Association of Insurance Commissioners, both via the same Oracle PeopleSoft zero-day. Nissan is warning that payroll records and Social Security numbers for current and former employees may have been exposed. NAIC is putting a brave face on it — claiming only publicly available data, outdated logs, and configuration files were taken — though ShinyHunters claims 3.1 TB. The PeopleSoft vulnerability appears to be a single entry point enabling a multi-victim campaign, which is a pattern worth watching: one zero-day, many enterprise targets. Australian organisations running Oracle PeopleSoft should treat this as an active threat and verify their patch status immediately.

Bleeping Computer ↗

Critical libssh2 Flaw Gets a Public PoC — Patch Before You SSH Anywhere

A public proof-of-concept is now circulating for CVE-2026-55200, a critical memory-corruption bug in libssh2 scoring 9.2 on the CVSS 4.0 scale. The flaw sits on the client side: a malicious or compromised SSH server can trigger code execution on anything connecting to it, with no credentials and no user interaction needed. Every libssh2 release up to and including 1.11.1 is affected. The library is embedded in a wide range of tools — deployment pipelines, config management systems, monitoring agents — making the blast radius hard to fully assess. With a PoC already public, exploitation is a matter of when, not if. Check your dependency trees and update.

The Hacker News ↗

Mustang Panda Turns Zoho WorkDrive Into a Command Channel

China-aligned espionage group Mustang Panda has been caught running two active campaigns against Indian government networks and hydropower infrastructure, using legitimate Zoho WorkDrive as its command-and-control channel. Acronis Threat Research Unit found compromised machines belonging to senior administrative staff and coordinated with Zoho on the disclosure. The technique — hiding C2 traffic inside a trusted cloud service — is increasingly standard for nation-state actors: it blends in with legitimate traffic and makes network-based detection very hard. The same logic applies to any cloud-heavy environment, including Australian government agencies and critical infrastructure operators who rely on similar collaboration platforms.

The Hacker News ↗

Researchers Show Claude Code Can Be Hijacked by a Booby-Trapped Repo

Security researchers have demonstrated a new class of attack against AI coding assistants: plant indirect prompt injection instructions inside a seemingly normal code repository, and Claude Code will spawn a reverse shell on the developer's machine. The attack requires no special privileges — just convincing a developer to open a malicious project. It's a sobering illustration of how agentic AI tools inherit the trust level of whoever is running them. When your coding assistant can execute terminal commands, a poisoned README becomes a potential attack vector. With AI coding tools now deeply embedded in developer workflows across Australian tech firms and government agencies, this class of vulnerability deserves serious attention from security teams.

SecurityWeek ↗

Microsoft Pulls 119 Edge Extensions Hiding Malware in Images

Microsoft has removed 119 malicious extensions from the Edge Add-ons store, all tied to a single threat actor active since at least 2021. The operation, dubbed StegoAd, hid its payloads inside ordinary image and font files using steganography — the malware only activated days after installation, making it nearly invisible to automated scanning at submission time. Once awake, the extensions stole credentials and ran ad fraud. The campaign's longevity is the most alarming part: five years of activity before a coordinated takedown. Browser extension security remains a blind spot for most enterprise security teams, and a review of installed extensions — across both Chrome and Edge — is overdue for most organisations.

The Hacker News ↗

SCOTUS Ruling Guts Geofence Warrants — A Win for Everyone's Location Privacy

The US Supreme Court has ruled that police must obtain a warrant before requesting geofence data tied to individual mobile phones, a significant victory for digital privacy advocates. The court stopped short of declaring all geofence warrants unconstitutional, but the ruling substantially raises the bar for law enforcement access to location histories held by Google and other tech giants. Dissenting justices warned of "seismic" Fourth Amendment implications. While the ruling is US-specific, it matters globally: the same location data infrastructure underpins services used by Australians, and the Australian Privacy Act's upcoming reforms are grappling with similar questions about what location data can be collected and retained by third parties.

Ars Technica ↗

Google Warns EU Data-Sharing Rules Could Expose User Search Data to Hackers

Google's top security engineers have gone public with a warning: the EU's pro-competition proposals to force Google to share Search data with rivals and open up Android's AI layer could create serious security vulnerabilities. The company argues that mandated data-sharing interfaces expand the attack surface in ways regulators haven't fully modelled. Critics will note that Google has obvious commercial reasons to resist these rules, but the underlying technical argument — that interoperability mandates can introduce security risk if not carefully designed — is legitimate. Australia's own competition regulators are watching EU digital market interventions closely as they consider similar platform accountability measures under the Digital Platform Services Inquiry.

WIRED Security ↗

Rocket Lab Acquires Iridium in an $8 Billion All-Stock Deal

New Zealand-founded, US-listed Rocket Lab has agreed to acquire satellite communications company Iridium in an all-stock deal valuing Iridium at around $8 billion. Iridium's 66-satellite constellation provides global low-Earth-orbit voice and data coverage — including in polar regions where other satellite networks don't reach. For Rocket Lab, it's a dramatic pivot from launch provider to vertically integrated space company, putting it in direct competition with Amazon's Kuiper and SpaceX's Starlink on the connectivity side. Rocket Lab has deep ties to New Zealand and Australia, where it operates its Māhia launch site; the Iridium acquisition gives it a global customer base to match its launch ambitions.

TechCrunch ↗

Tidal Cuts Off Royalties for AI-Generated Music

Streaming platform Tidal has announced it will stop paying royalties on tracks it identifies as 100% AI-generated, and will begin labelling such tracks with a visible icon from July 15. The platform says its priority is ensuring revenue flows to human creators, and will also use automated tools to remove AI music that impersonates specific artists. It's a notable policy stance from a platform that has built its identity around artist-first economics. The harder question — how reliably detection tools can identify AI-generated music without false positives — remains unanswered. Australian musicians and labels, who have been vocal in pushing for AI transparency rules, will be watching closely to see if the policy holds up in practice.

The Verge ↗

Weak RSA Keys With Suspiciously Many Zeros Are Showing Up in the Wild

A research project scanning real-world cryptographic keys has turned up a new class of weak RSA keys: moduli with an unusually high number of zero bits, making them unexpectedly easy to factor. The badkeys project — which checks public keys against known vulnerability patterns using data from Certificate Transparency logs, internet-wide TLS and SSH scans, and PGP keyservers — found these sparse moduli occurring in production deployments, not just theory. It's not clear yet what's generating them, but the implications are serious: if a key is weak, everything it was used to protect is potentially retrospectively compromised. This connects directly to the broader post-quantum migration conversation — if classical RSA keys can be weak in unexpected ways, the urgency of auditing your cryptographic posture increases.

Schneier on Security ↗

Sources consulted