OpenAI hacks Australia health, Astrana Health breached, TeamCity flaw exploited

Super Cyber Friday : "Hacking Microsegmentation for Machine Workloads" LIVE on YouTube for Department of Know

Super Cyber Friday : "Hacking Microsegmentation for Machine Workloads"

LIVE on YouTube for Department of Know

In todays cybersecurity news...

OpenAI program hacks Australia’s government health portal

Described as the first known case of its kind in the world, this incident, which occurred in June involved an AI agent infiltrated a statistics portal belonging to Australia’s universal healthcare scheme Medicare. This was revealed by Australian Prime Minister Anthony Albanese, speaking at the UN on Wednesday. He revealed he had a “very frank discussion” with OpenAI CEO Sam Altman for taking “too long” to disclose the breach and said there would be “legal consequences”.

Other rogue AI hacking events predate Hugging Face

As a necessary follow up to the story, as well as the Hugging Face story, the The Seattle Times reported on Wednesday, on other incidences of “hacking and trying to break into government and university websites without being instructed to do so, that took place in May and June, before the OpenAI’s Hugging Face breach. In these new incidents, AI systems had been directed to perform “relatively mundane data collection.” Researchers stated that when OpenAI’s systems struggled to gather data from websites, they resorted to hacking techniques to get the information. Specifically targeted were the University of New Mexico’s digital library, and U.S. Government data aggregator Data USA.

( Seattle Times , Transluce )

Astrana Health suffers data breach

Astrana is a “California-based physician-centric healthcare management company that provides back-office services, including claims and billing.” The breach impacted its subsidiary Astrana Health Management, according to a filing with the SEC. “Hackers used social engineering to access the company’s servers, impersonating Astrana Health personnel and spoofing its main phone number to employees.” No threat actor or news of ransomware has been released, nor has a clear description of the types of data stolen, referring to it currently as “certain private and confidential information.”

Ransomware gangs now exploiting critical TeamCity flaw

Cybersecurity and Infrastructure Security Agency is warning federal agencies that ransomware gangs are now exploiting a critical JetBrains TeamCity vulnerability that had been patched in July. The flaw (CVE-2026-63077) is “a critical authentication bypass vulnerability that lets attackers with HTTP(S) access execute arbitrary operating system commands…by way of the TeamCity agent polling protocol. The vulnerability was added to the KEV catalog on August 5.

Big thanks to our sponsor, Nudge Security

CISA presents improvement plan for CVE program

The Cybersecurity and Infrastructure Security Agency published a paper on Wednesday that lays out its plan for improving the Common Vulnerabilities and Exposures (CVE) program. The paper describes a “quality era” for the program, as a follow on from the “growth era” that preceded it. The plan calls for “advancing data quality across four key dimensions: transparent and effective program governance, broad and active participation across the global software community, data infrastructure that supports CVE operational functions and reliable CVE record content.”

Corp MDM Android spyware targets logistics firms

Spyware named Corp MDM is targeting companies in the logistics sector, and uses spoofed Google Play pages to distribute an Android Package Kit (APK) file that’s looks like a system service. The delivered app has the package name “com.corp.mdm,” which is designed to “exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service.” “It is suspected that the threat actor behind the campaign used artificial intelligence during the development phase, given the presence of bugs that interfere with its capabilities.”

Hackers exploit critical Roundcube flaw in code injection attacks

According to the Canadian National Centre for Cyber Security , this high-severity Roundcube Webmail vulnerability was patched in May, but is now being actively exploited in attacks. It is described as “a pre-authenticated SQL injection in a built-in plugin that handles database-driven user lookups and maps users to email addresses.” Exploitation of this flaw can “let threat actors with no privileges bypass authentication, inject and execute malicious database commands, and steal data from Roundcube’s database in high-complexity attacks that don’t require user interaction.”

Ryuk ransomware operator sentenced

Karen Vardanyan, a 35 year-old Armenian national has been sentenced to two years in U.S. federal prison after pleading guilty in July to charges related to multiple ransomware attacks. Following this will be three years of supervised release and restitution of $1.2 million to his cyberattack victims. Vardanyan was accused of being a core member of the Ryuk ransomware gang, which in 2020, at the height of the pandemic, heavily targeted hospitals across the country. The U.S. Department of Justice said Vardanyan and his team received at least $15 million in ransoms from their attacks over the years.

Spotify , Apple Podcasts , YouTube , RSS link , Amazon Music , add as an Alexa Skill , or "Cybersecurity Headlines" on your favorite podcast app.

Cybersecurity Headlines

To view or add a , sign in

More articles by CISO Series