> ## Content Index > Fetch the complete content index at: https://www.onedot61.au/llms.txt > Use this file to discover other available public pages before exploring further. # Signal Check with OneDot61 | 27th October 2026 - URL: https://www.onedot61.au/signal-check-with-onedot61-27th-october-2026/ - Published: 2026-10-27T06:24:08.000Z - Updated: 2026-10-27T07:28:52.000Z - Description: What's been in the news? - Author: OneDot61 - Tags: Insights, #blog ## Signal Check at a glance - **PHP flaws knocked government sites offline:** A critical pair of PHP flaws took websites offline while they were patched, and AI helped find at least one of them. [More](#php-flaws-knocked-government-sites-offline) - **Fortinet released critical updates:** Fortinet shipped critical updates across five product lines. [More](#fortinet-released-critical-updates) - **AdFection spyware delivered through online ads:** Researchers showed online ads delivering spyware, and Australian organisations were among those targeted. [More](#adfection-spyware-delivered-through-online-ads) - **Business email compromise scam money recovered:** Victoria Police recovered $118,000 for a family business. [More](#business-email-compromise-scam-money-recovered-by-police) - **Privacy policies must cover automated decisions from 10 December:** A new privacy-policy rule takes effect on 10 December. [More](#privacy-policies-must-cover-automated-decisions-from-10-december) - **AI agents tricked by a repeat after me prompt:** Researchers got six agent frameworks to run attacker-written tool calls simply by asking the model to repeat them. [More](#ai-agents-tricked-by-a-repeat-after-me-prompt) - **Protocol pivoting between AI agents:** A researcher showed that a malicious prompt can be passed on to other agents that trust it. [More](#protocol-pivoting-between-ai-agents) - 馃槃 *Rumours that PHP stands for "Patch Here, Promptly" remain unconfirmed.* [Explore](https://www.onedot61.au/portfolio/) our vendors to secure your business or [contact us](https://www.onedot61.au/contact/). --- ## PHP flaws knocked government sites offline **Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed on 22 October, and patches came out the same day.** OpenAI says Calif found one of them using an AI model, and that Wiz independently found and reported both. Government News reported that sites including abs.gov.au and cyber.gov.au went offline for updates, and ASD said there was no indication those sites had been affected by the flaws. **Why it matters:** NZ's NCSC noted that end-of-life PHP versions remain exposed unless they're patched manually or a vendor provides a backport, and that patching won't clean a system that's already been compromised. **Links:** [ACSC alert](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php?ref=onedot61.au) 路 [NCSC NZ](https://www.ncsc.govt.nz/news/ncsc-encourages-immediate-patching-against-php-vulnerability/?ref=onedot61.au) 路 [Government News](https://www.governmentnews.com.au/government-websites-taken-offline/?ref=onedot61.au) 路 [OpenAI](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/?ref=onedot61.au) 路 [Calif write-up](https://calif.io/php2shell/?ref=onedot61.au) ## Fortinet released critical updates **Fortinet released critical updates for multiple versions of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator.** Fortinet expects to publish full advisories on 10 November 2026\. Fortinet's own post lists the fixed versions and says the fixes include issues found through its AI-assisted security testing. **Why it matters:** FortiSASE was updated automatically, but FortiManager may need manual updates, so it's worth confirming they were applied. **Links:** [ACSC alert](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-fortinet-products?ref=onedot61.au) 路 [Fortinet post with fixed versions](https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products?ref=onedot61.au) ## AdFection spyware delivered through online ads **Citizen Lab reported that the firm Discover-Tech used targeted online ads to deliver no-click spyware.** The ABC reported that ANSTO and its own staff were among the Australian targets, and both said they found no compromise; the ABC wiped the exposed devices as a precaution. **Why it matters:** Simply loading an ad can be an attack path, which is relevant to browser hardening and ad-blocking policy. **Links:** [Citizen Lab report](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=onedot61.au) 路 [ABC, 19 Oct](https://www.abc.net.au/news/2026-10-19/nuclear-agency-targeted-in-cyber-attack-infecting-devices/107283804?ref=onedot61.au) 路 [ABC, 23 Oct](https://www.abc.net.au/news/2026-10-23/abc-staff-targeted-adfection-cyber-attack/107300806?ref=onedot61.au) ## Business email compromise scam money recovered by police **Scammers took over a real email thread with a supplier and persuaded a Melbourne family business to pay $118,000 into a fraudulent account.** Victoria Police said it has received 107 reports of this scam since July, and it worked with the AFP-based JPC3 to block the funds and return the money. **Why it matters:** Police advise calling the supplier on a trusted number before acting on any change to bank details. **Link:** [Victoria Police](https://www.police.vic.gov.au/police-help-recover-118000-victim-swindled-scam?ref=onedot61.au) ## Privacy policies must cover automated decisions from 10 December **From 10 December 2026, APP entities must explain in their privacy policy when a computer program makes or informs decisions that could significantly affect a person's rights or interests.** The OAIC has published a fact sheet, a flowchart and updated APP 1 guidelines to help. **Why it matters:** The policy must describe the kinds of personal information used and the kinds of decisions involved, so IT teams may need to inventory where automated decisions happen. **Link:** [OAIC](https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making?ref=onedot61.au) ## AI agents tricked by a repeat after me prompt **Researchers got six agent frameworks, including LangGraph, AutoGen and CrewAI, to run attacker-written tool calls simply by asking the model to repeat them.** The same paper confirmed 253 bugs across 118 open-source MCP servers, but it hasn't been peer-reviewed. **Why it matters:** Teams building AI agents should check sensitive actions separately and not rely on the model's own refusal. **Link:** [CSO Online](https://www.csoonline.com/article/4233811/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt.html?ref=onedot61.au) ## Protocol pivoting between AI agents **A researcher showed that a malicious prompt given to one internal AI agent can be passed on to other agents that trust it, through MCP and related protocols.** Google and Rapid7 have fixed flaws he found, and the article notes that many agent architectures have dropped the zero trust principle. **Why it matters:** A Rapid7 expert quoted in the article advises treating anything an AI model passes to a tool like input from a stranger on the internet. **Link:** [Ars Technica](https://arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/?ref=onedot61.au) --- [Explore](https://www.onedot61.au/portfolio/) our vendors to secure your business or [contact us](https://www.onedot61.au/contact/).