Tech Talks With Kinsoft

Last Week in Tech for the week of 14 to 20 September 2026. Recorded after the fact to fill a missed slot; later developments are flagged.

Cisco: two exploited zero-days. CVE-2026-76461 (14 Sep), Secure Email Gateway: unauthenticated SQL injection in email parsing, root via a crafted email, no user interaction. Cisco: CVSS v3.1 9.8. Fixed in 15.5.5-014, 16.0.4-302, 16.5.0-780. CVE-2026-76460 (16 Sep), Identity Services Engine: API authentication bypass to root, CVSS v3.1 10.0, no workaround beyond restricting access; ISE 3.0 is end-of-life. Both added to CISA KEV on disclosure.

Brevo supply-chain attack (14 Sep). A long-lived Cloudflare API key hard-coded in Brevo's source code was used to deploy a Worker injecting script into Brevo sites and customer-embedded JavaScript. Live for roughly 4–5.5 hours; Sansec estimates 100,000+ sites. Visitors saw a fake "verify you are human" ClickFix page; WordPress sites with Brevo widgets were targeted with a backdoor plugin. Check WordPress sites for unknown plugins.

AWS permanent data loss (15 Sep). AWS says data held only in its Bahrain region (me-south-1), or only in one UAE availability zone, cannot be recovered after damage from strikes beginning in March. Revisit single-region backup and DR plans.

Salesforce Koa (Dreamforce, 15–17 Sep). Salesforce's own CRM reasoning model, built on Nvidia Nemotron with synthetic data; US regions only at first. Later: on 24 Sep Zenity Labs disclosed "SalesBleed", three since-fixed Agentforce flaws.

AI pacing. OpenAI published a misalignment disclosure framework and six incident reports (16 Sep). Ursula von der Leyen said the EU will invite leading labs to discuss how to "pace the frontier".

Australia's Privacy Act overhaul. Consultation on the Attorney-General's Department's exposure draft closed 18 Sep. Proposals include a broader personal information definition, a "fair and reasonable" test, a right to erasure on large platforms, and a 72-hour deadline to notify the OAIC of an eligible breach. The small-business exemption stays; no new direct right to sue.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Rapid7; Help Net Security; The Hacker News; The Register; Triskele Labs; Cisco advisories; SecurityWeek; Sansec; Brevo post-mortem; AWS Health Dashboard; InfoQ; Salesforce; Nvidia; The Register (SalesBleed); OpenAI; Axios; TNW; Attorney-General's Department; Allens.

JetBrains has disclosed that attackers breached Cadence — its PyCharm-integrated cloud compute service — through one of its own unpatched TeamCity servers, using a vulnerability in a JetBrains product that JetBrains had already patched and publicly warned about.

What Cadence is: a JetBrains-hosted service that integrates with PyCharm through an optional plugin and lets users run their projects on cloud compute resources. Cadence uses TeamCity to orchestrate that work.

The flaw: CVE-2026-63077 in TeamCity On-Premises, unauthenticated remote code execution via the agent polling protocol, allowing an attacker to bypass authentication checks and execute arbitrary operating system commands. CVSS v3.1 base score 9.8, as assigned by JetBrains in the CVE record. Fixed in 2025.11.7 and 2026.1.3.

Timeline. 27 July 2026: JetBrains publishes the advisory and fixed versions. 5 Aug: CISA adds it to the Known Exploited Vulnerabilities catalogue. 7 Aug: JetBrains publishes a second post warning of active exploitation in the wild. 8 Aug: attackers access JetBrains' own Cadence environment through an unpatched TeamCity server — twelve days after the patch shipped, and one day after JetBrains' own exploitation warning. 23 Aug: JetBrains discovers the exploitation. 24 Aug: the affected server is taken offline, closing the stated affected period of 8 to 24 August. 28 Aug: public disclosure; the investigation concluded on 3 September.

Not an orphaned server. The exploited host was the production API server for Cadence — a live, customer-facing service. JetBrains' explanation: "The server should have been patched as part of our response to the vulnerability, but it was not."

What was accessed: usernames, real names, email addresses, last login timestamps and last accessed IP addresses; a full 2024 backup of the Cadence server containing credentials, configuration, artifacts and logs; multiple AWS IAM users and secrets, including IAM users belonging to JetBrains employees; and files in S3 buckets within JetBrains AWS accounts. JetBrains states the attacker "may have accessed source code synchronized from PyCharm projects" — flagged as unconfirmed. In its 3 September update, JetBrains confirmed the actor obtained access that could have reached storage containing data associated with current Cadence users, including email addresses, project source code and credentials. No affected-user count has been published, and no threat actor has claimed the intrusion.

Remediation guidance, in JetBrains' words: "Revoke and rotate all credentials and secrets that may have been used to run Cadence executions." And: "Treat all executions, including their inputs and outputs in your Cadence project, as potentially untrusted."

Three things to take from it. First, treat your build system as production infrastructure — it holds deployment credentials and runs code automatically; put the console behind a VPN or IP allowlist. Second, inventory your long-lived secrets and give them an expiry: static AWS IAM keys work from anywhere, generate no login alert, and keep working until rotated — and a key frozen in a two-year-old backup has had two years to be forgotten. Third, patching is a delivery, not a decision. JetBrains decided to patch, announced it and warned the world, and the remediation still did not reach one production server. Close the ticket when you can produce a verified version number for every affected instance, not when the patch is approved.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: JetBrains Cadence security incident disclosure (28 August 2026, updated 3 September); JetBrains TeamCity advisory for CVE-2026-63077 (27 July 2026) and active-exploitation notice (7 August 2026); CISA KEV catalogue.

Sydney edtech company Mathspace has disclosed a data breach affecting 1,079,819 students, parents and guardians, teachers and staff across Australia and New Zealand. The cause was not an unavailable patch — it was a vulnerability-notification process that never escalated the advisory to anyone who could act.

The flaw: CVE-2026-72898, an unauthenticated SQL injection in Metabase's password reset endpoint, granting administrator access without a valid login. CVSS v3.1 base score 10.0 and CVSS v4.0 base score 10.0. Metabase published its advisory and patched versions on 6 August 2026; confirmation it had already been exploited in the wild as a zero-day followed on 8 August; CISA added it to the Known Exploited Vulnerabilities catalogue on 11 August.

Timeline. 6 Aug: advisory published; Mathspace's internal notification process fails to identify and escalate it. 10 Aug: earliest unauthorised access, four days after the patch became available. 27 Aug: the attacker downloads data from the Australian reporting database. 29 Aug: Mathspace patches, 23 days after the advisory, but does not perform the compromise checks Metabase recommended for potentially exposed instances. 3 Sep: a historical access log review confirms the breach, five days after patching; Metabase is taken offline and all API keys and database credentials rotated. 4 Sep: notifications to the OAIC, ASD's ACSC, New Zealand's Privacy Commissioner and NCSC, and Australian state and territory education departments. 5 Sep: public disclosure. 6 Sep: individual notifications begin. Twenty-four days from intrusion to detection; two days from detection to disclosure.

Data involved: user ID, username, first and last name, email address, country, time zone, user type, email verification status, last active date, last login date and date joined — not every field for every person. Explicitly not exposed: academic records, learning activities, results and assessments, passwords including hashes, authentication tokens, SSO credentials and API credentials. No password resets are being required, and as at its 8 September update Mathspace had seen no evidence the data has been published, distributed, sold or otherwise misused.

Attribution, read carefully: Mathspace states the identity of the attacker remains unknown and no group has claimed the breach. Separately, BleepingComputer has reported that ShinyHunters added Metabase to its leak site on 11 August and links the group to the wider campaign against Metabase instances — that is reporting about a campaign, not a confirmed attribution for Mathspace. Whether a ransom was demanded is unknown; asked by Information Age, Mathspace pointed back to its blog post.

What to take from it. First, shadow infrastructure needs an owner — if a self-hosted tool isn't on an asset inventory with a named owner subscribed to that vendor's advisories, it isn't being patched. Second, patching is not the finish line: if an internet-reachable system was exploitable, assume compromise until the logs prove otherwise. Third, internal tools hold external data — Metabase had no customer logins and no public front door, and was still the pivot to a million records because it was internet-reachable and connected to production data warehouses.

Mathspace's disclosure was unusually detailed and self-critical, naming its own process failures. Melbourne barrister Peter A Clarke, who writes on privacy law, called it excellent and said it provided real information to customers rather than the usual boilerplate.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Mathspace incident disclosure (Alvin Savoy, CTO, 5 September 2026, updated 8 September); BleepingComputer; ACS Information Age; Cyber Daily; The Hacker News; Metabase advisory GHSA-vwf4-m7j8-wcjf; CISA KEV catalogue.

Last Week in Tech for Monday 14 September 2026, covering 7 to 13 September.

Microsoft's largest Patch Tuesday ever (8 Sep): around 970 CVEs — 974 per Microsoft's own release note, 964 per Tenable, 966 per BleepingComputer. Two were already being exploited, both Windows privilege escalation, both CVSS v3.1 7.8: CVE-2026-85880 (ALPC heap buffer overflow) and CVE-2026-81963 (Windows Update Stack link-following), per Tenable the first Update Stack flaw ever caught being exploited. Both are local escalation, not initial access. ZDI's Dustin Childs rates Exchange CVE-2026-55007 (8.1, malicious Visio attachment) the month's most important patch, and calls Windows DNS Server CVE-2026-69730 (9.8) the spiritual successor to SigRed. September's Windows Server updates break Remote Desktop Services — test first.

Magento and Adobe Commerce "StyleSmuggler": CVE-2026-75650, CVSS v3.1 10.0, unauthenticated RCE. Exploited from 4 Sep, disclosed by Sansec 5 Sep, patched 7 Sep (APSB26-146), added to CISA KEV 8 Sep. A Magento-written log file is poisoned with PHP, then executed when Magento renders the standard Payment Transaction Failed Reminder email — nobody needs to open it. Sansec's first victim ran 2.4.6-p15 with July and August updates applied, the current patch level for that line; Disrex Group confirmed two more, one on 2.4.8 running Sansec's own protection product. Patching does not remove an installed backdoor — any store online between 4 Sep and patching needs a compromise assessment, a session flush, and rotation of the encryption key, admin passwords and all env.php credentials.

Ten CVEs into CISA KEV in three days, almost all edge devices. 9 Sep: Cisco Secure Firewall Management Center auth bypass to root, CVE-2026-20079 (10.0), with Cisco confirming exploitation from August; Citrix NetScaler auth bypass CVE-2026-19490 (9.3); Fortinet heap overflow CVE-2025-25249 (7.3), linked by SOCRadar to a PivotC2 campaign that infected 178 devices. 10 Sep: MikroTik RouterOS CVE-2026-67277 and CVE-2026-86060 — CERT Polska warned of full administrative takeover via internet-exposed SSH without authentication, calling it MikroTrick. Zero-day status unverified.

Oracle Q1 FY2027 (10 Sep): revenue US$19.3bn (+30%), cloud US$11.6bn (+62%), infrastructure US$7.4bn (+121%), backlog US$664bn against roughly US$640bn expected, with 300,000+ GPUs delivered. On 11 Sep shares rose as much as 7.8% intraday, then reversed to close around 2% down. S&P estimates roughly half the backlog is tied to OpenAI, calculated against the prior US$638bn figure; Moody's has flagged counterparty risk.

Apple (9 Sep): the iPhone Duo foldable starts at US$1,999, on sale 23 October. iPhone 18 Pro from US$1,199 and Pro Max from US$1,299 ship in 65+ countries from 18 September. All run the A20 Pro, Apple's first 2nm chip. There is no standard iPhone 18 this cycle — the affordable models move to spring 2027, pushing mid-tier fleet refreshes out two quarters.

The AI cost gap: DeepSeek's V4.1-Flash (10 Sep) has MIT-licensed open weights at US$0.15 per million input tokens and US$0.60 per million output off-peak, though its benchmarks are vendor-published and not independently reproduced. The Information reported on 6 September that Anthropic has signed compute agreements worth up to US$517bn — an estimated maximum across many deals, not published by Anthropic.

Coming up: Wednesday, a Sydney edtech breach affecting over a million people. Friday, the developer-tools vendor that missed its own patch.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Microsoft Security Update Guide; Tenable; BleepingComputer; Sansec; Adobe APSB26-146; Disrex Group; CISA KEV catalogue; CERT Polska; Oracle investor relations; The Information.

A dark web shop, 153 million driver's licence scans, an FBI investigation, and the scanner at your front desk.

What was found. On 1 September, KrebsOnSecurity reported a dark web service called "Nexus" advertising more than 153 million US and Canadian driver's licence scans, plus 10 million+ ID cards, 3 million+ travel documents and 579,000+ medical cards. Records contained six images per document — front and back in normal, infrared and ultraviolet light — with date and time stamps. The listing appeared on a Russian-language forum on 31 August. The FBI's New Orleans field office opened an investigation the day Krebs published and confirmed it publicly to Reuters on 2 September. The Nexus site went offline hours after publication. Four class actions were filed on 2 September in the US District Court for the Eastern District of Louisiana.

The important qualifier. The lawsuits name identity-verification vendor IDScan.net, but the company has NOT confirmed a breach. It says it is working to validate the information, has not reached conclusions on the nature or scope of any incident, and has secured systems, preserved logs, engaged outside counsel and forensics, and contacted law enforcement. Krebs's evidence is correlative: he found his own licence and nine of a dozen consenting volunteers' licences, and every timestamp matched a moment the person handed a licence to a business — usually a car rental counter. IDScan.net's documentation describes infrared and ultraviolet document scanning, matching the image types in the dump. Compelling, but not proven.

A correction worth noting. Early coverage listed brands from IDScan.net's public customer page. Caesars Entertainment stated on 2 September that it has not been a client, stopped using the relevant product in February 2025, had no active accounts at the time, and did not authorise data retention.

Also unknown: when collection began (the "over a year" claim comes from the seller's own advertisement), and whether the dataset still circulates. There is no legitimate service where an individual can check exposure.

What Australian businesses should do. If you photograph or scan customer ID — real estate, recruitment, RTOs, conveyancing, gyms, venues, car hire, AML checks — this is your risk profile. Four questions: (1) Do you still hold documents you no longer need? Australian Privacy Principle 11.2 requires destruction or de-identification once the permitted purpose has passed. (2) If you use a third-party verification product, where is the image stored, for how long, and what do your contract terms actually say about retention, deletion on termination, sub-processors and breach notification? (3) Could you record a verification event instead of keeping an image? (4) If your ID store were breached tomorrow, could you say how many documents, whose, and how old?

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: KrebsOnSecurity; Reuters; BleepingComputer; SecurityWeek; CSO Online; TIME; OAIC (Australian Privacy Principle 11).

A Melbourne software company, a print server, and three emergency patches in six days.

The company. PaperCut Software International, founded 1998 by Chris Dance and Matt Doran, headquartered in Melbourne with offices in Portland and London. Privately held, still founder-led. PaperCut's own figure: around 100 million users across more than 70,000 organisations.

The timeline. 27 August, 9:42am AEST — an education-sector customer reports a compromised PaperCut MF server; a second organisation reports similar activity at 5:05pm, and its logs allow the full chain to be reconstructed. PaperCut declares a P0 and publishes an advisory deliberately stripped of technical detail. 28 August, 2:10am — Emergency Patch Release 1 for versions 25 and 26; version 24 later that day; CVEs assigned; Emergency Patch Release 2 the same day after watchTowr and Huntress bypass the first fix. 29 August — Defused honeypots see the attacks pivot to database-table dumping. 31 August — both CVEs added to the CISA Known Exploited Vulnerabilities catalogue with a 14 September federal deadline; a Metasploit module is published. 1 September — Emergency Patch Release 3, fixing two regressions and adding hardening. Install it even if you patched earlier.

The vulnerabilities. CVE-2026-81578, authentication bypass in the web management interface (CWE-306), 8.8 High under CVSS v4.0. CVE-2026-82078, unsafe dynamic class loading in the database connector (CWE-470), 9.4 Critical under CVSS v4.0. Chained, they give unauthenticated remote code execution: an Apache Tapestry routing quirk lets an attacker display a public page while invoking an admin component, rewrite the external user-lookup settings, and abuse the bundled Apache Derby driver to reach an attacker-controlled H2 database whose initialisation parameter creates a JavaScript-backed trigger that spawns a process.

What is not known. No attribution by anyone — not PaperCut, not Huntress, not watchTowr, not CISA. No ransomware gang has claimed it. No victim count, record count or data-category list has been published. Shadowserver tracked 800+ internet-exposed servers as at 1 September; that is an exposure count, not a compromise count.

What to do. Patch to Emergency Patch Release 3. Assume compromise if the server was internet-facing and unpatched after 26 August — patching does not evict an existing intruder. Hunt PaperCut's indicators: suspicious activity from pc-app.exe, missing or truncated server.log, and the "no suitable driver found for jdbc:no:x" and "Database error looking up cardID" errors. There are no published network indicators. Then ask why a print server was internet-facing at all.

Also timely: the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, released for consultation around 1 September, proposes a hard 72-hour notification deadline to the Information Commissioner.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: PaperCut security bulletin and Chris Dance's incident blog; Rapid7; BleepingComputer; Cyber Daily; SecurityWeek; CISA Known Exploited Vulnerabilities catalogue; iTnews.

Last Week in Tech for Monday 7 September 2026, covering 30 August to 6 September.

Nvidia to acquire Hugging Face for US$12.93bn. Confirmed by Nvidia on 3 September, expected to close in the first half of 2027 subject to regulatory approval. Nvidia states the platform serves 18 million+ developers, 3 million+ models and 200,000+ companies, and has committed that Nvidia compute will not be required to build on or deploy through it.

OpenAI ships GPT-6 "Astra" (3 September). OpenAI says it is the first model to meet the Critical cybersecurity threshold under its own Preparedness Framework — 100% on ExploitBench versus 78.5% for the prior model, and 39% versus 5.5% on a fresh-vulnerability variant. OpenAI says the model found and disclosed two previously unknown zero-days during evaluation. The shipped model refuses advanced offensive tasks. Separately, OpenAI committed US$1bn in subsidised defensive AI access for critical infrastructure, government, nonprofits and open-source maintainers; eligibility, subsidy level and post-subsidy pricing are not yet disclosed.

Broadcom Q3 FY2026 (2 September). Revenue US$29.59bn, up 86% year on year; free cash flow US$13.67bn. CEO Hock Tan, quoted in the release, put AI semiconductor revenue at US$16.7bn, up 221% year on year, with Q4 expected at US$21.7bn. Longer-range AI revenue projections circulating this week came from earnings-call commentary, not the written release.

CISA adds seven exploited flaws in one day (2 September). Four sit in AI and DevOps infrastructure — Kestra, JFrog Artifactory, Berri LiteLLM and Starlette. Microsoft reports attackers harvesting LiteLLM database tables for provider API keys and proxy-issued virtual keys, and advises monitoring AI workloads according to their control-plane role. Also on the list: Sangoma Switchvox (CVSS v4.0 9.3), a VoIP platform sold to SMBs, patched 14 July, first seen exploited 30 August. Fixed version 8.4.0.2.

Elementor Pro under mass exploitation. Critical arbitrary file upload patched 19 August in version 4.2.2. Wordfence has blocked over 190,000 exploit attempts, and roughly two-thirds of Elementor's 10 million installations were still vulnerable as at 4 September. Indicator of compromise: any .php file under /wp-content/uploads/elementor/forms/.

Chrome's sixth zero-day of 2026. V8 type confusion, fix shipped 3 September, added to CISA KEV 4 September. Fixed builds 152.0.7977.82/.83. Relaunch Chrome.

Coming up: Wednesday, the PaperCut zero-day chain. Friday, 153 million driver's licence scans on the dark web.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: NVIDIA newsroom; OpenAI; SecurityWeek; Broadcom investor relations; CISA KEV catalogue; Microsoft Security Blog; The Hacker News; Wordfence; BleepingComputer.

Manchester Airports Group – 8.7 Million Travellers, and the API Keys Sitting in Plain Sight

A deep-dive into the largest known customer data breach at a British airport operator — and the claimed entry vector any developer could have spotted.

On 27 August 2026, Manchester Airports Group (MAG) — operator of Manchester, London Stansted and East Midlands airports — disclosed that an unauthorised third party had stolen customer data from its commercial systems: car park bookings, lounges, Fast Track and Wi-Fi sign-ups. Roughly 8.7 million customers were affected. For most, the exposure was an email address; parking, lounge and Fast Track customers also lost phone numbers, UK postcodes and vehicle registration plates. No payment data was held in the affected system, and no airport operational systems were touched — flights ran normally.

On 30 August, extortion group FulcrumSec claimed the attack to BleepingComputer: ~86GB stolen, entry via API credentials for third-party marketing platform Iterable allegedly exposed in client-side JavaScript, plus ~200,000 records about upcoming travel. Those claims are unverified — but BleepingComputer independently validated sample data against one traveller's real purchase history, and the samples were far richer than MAG's disclosure: booking references, prices, parking dates and historical spend.

In this episode:

- The confirmed facts versus the criminal's claims — and why the distinction matters

- MAG's response: containment, ICO notification within UK GDPR's 72-hour window, suspending Manage My Booking, and contacting every affected customer

- Why postcode + number plate + parking dates is near-perfect phishing bait

- Four lessons for Australian businesses: your marketing SaaS stack is attack surface; never ship API keys in client-side code; data minimisation decided this breach's severity years in advance; and assume the true scope is worse than your first assessment

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: BleepingComputer (27 and 30 Aug 2026); Infosecurity Magazine (27 Aug 2026); Security Affairs (30 Aug 2026); MAG data-security incident page; TTG Media (28 Aug 2026, ICO confirmation).

Quest Apartment Hotels – 1.5 Million Guest Records, and the Attacker Who Never Touched Quest's Systems

A deep-dive into Australia's biggest hospitality breach of 2026 — and the vendor-ecosystem attack pattern behind it.

On Monday 17 August 2026, Quest Apartment Hotels — 160+ properties, founded in Melbourne in 1988, majority-owned since 2017 (and fully since 2022) by Singapore's The Ascott Limited — identified unauthorised access to a database system. The entry point wasn't Quest's own network: the company says access arose "from a vulnerability through a third-party service provider" holding Quest guest data. Two days later, on 19 August, Quest disclosed publicly and emailed affected guests under the signature of Ascott Australasia managing director David Mansfield.

What was taken: records predating June 2025 — full names, email addresses and contact details, street addresses in some records, and a small number of dates of birth. No financial or payment card data. Quest hasn't published a number; ACS Information Age reports more than 1.5 million records were potentially involved.

What we don't know: the vendor's identity, the specific vulnerability (no CVE published), and how the attacker got in — Quest has declined to answer. No threat actor has claimed responsibility and no ransom demand is public.

The response: containment and remediation completed before disclosure; OAIC, ACSC and other authorities notified; external cyber and privacy advisers engaged; all affected guests contacted.

In this episode:

• Why the vendor ecosystem is now the preferred way in — and how this breach follows Origin Energy, Partnered Health and Lifeline in a bruising winter for Australian data holders
• - The phishing second wave: why names + contact details + dates of birth are "the raw ingredients for convincing phishing and identity fraud" (Kash Sharma, BlueVoyant)
• - Five lessons for Australian businesses: map the vendors that touch your customer data; treat data retention as attack surface; know your Notifiable Data Breaches obligations; contract for security before the incident; and warn customers about branded scams that follow

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: ABC News (19 Aug 2026); Information Age / ACS (19–20 Aug 2026); The Register (19 Aug 2026); Cyber Daily (20 Aug 2026); SmartCompany; Australian Cyber Security Magazine; Quest Apartment Hotels statement; 7NEWS.

Last Week in Tech – Nvidia Doubles, Meta Pays $18 Billion, and the Musk–Altman Feud Reaches Your Code Editor

Your Monday roundup of the technology and security stories that mattered to Australian businesses in the week of 24–30 August 2026.

In this episode:

• Nvidia's record quarter (26 Aug). Revenue US$96.2bn, up 106% year-on-year; data centre US$89bn (~93% of the company); Q3 guided to ~US$108bn and CFO Colette Kress forecasting ~70% growth for fiscal 2028. What an accelerating AI capex cycle means for your cloud pricing and FY27 budget.
• - Meta's teen-harm settlement (26 Aug). Up to ~US$17bn — Meta itself puts it at ~US$18bn over ten years, ~US$12.7bn guaranteed — settling the multistate lawsuit filed by 33 state attorneys-general, without a finding of liability, but with enforceable product changes: two-hour daily limits and a midnight–6am curfew for under-18s, likes hidden by default on children's accounts, cosmetic filters banned for minors, most school-hours notifications off. A template for how Australia's under-16 social media ban could be enforced, and a warning on design-liability risk.
• - OpenAI to cut Cursor off (29 Aug). After SpaceX's US$60bn acquisition of Cursor-maker Anysphere closed on 14 Aug, OpenAI proposed ending model access on 12 November, citing its litigation history with Elon Musk's companies. Cursor says OpenAI models are ~5% of traffic. Concentration risk in AI dev tooling: know which models your tools depend on.
• - Alibaba's Wan 3.0 (24 Aug). Document-to-video AI at ~US$6 per 30-second clip — and the data-sovereignty question to ask before marketing uploads anything.
• - Security round. Citrix NetScaler CVE-2026-8452 (8.8 CVSS v4.0) — disclosed in June as denial-of-service, reclassified to unauthenticated RCE, added to CISA's KEV on 26 Aug with web shells found on compromised appliances; Zimbra CVE-2026-73570 (8.9 CVSS v3.1) — single-email command injection, 270+ servers confirmed compromised, ~8,200 still unpatched; and Boston Scientific's still-unattributed cyberattack halting order shipping and manufacturing worldwide.

Coming up: Wednesday, the Quest Apartment Hotels breach. Friday, Manchester Airports Group in full.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: CNBC, Fortune and Kiplinger on Nvidia Q2 FY2027 results (26 Aug 2026); CNN Business, Bloomberg and Al Jazeera on the Meta settlement (26–27 Aug 2026); CNBC and the OpenAI blog on Cursor model access (29 Aug 2026); Seeking Alpha on the SpaceX–Anysphere close (14 Aug 2026); Dataconomy and Winbuzzer on Alibaba Wan 3.0 (24–25 Aug 2026); Help Net Security, SecurityWeek, BleepingComputer and CISA KEV on Citrix CVE-2026-8452; The Hacker News, runZero, Shadowserver and CCB Belgium on Zimbra CVE-2026-73570; TechCrunch, The Register and BleepingComputer on Boston Scientific (26 Aug 2026).