Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. Left unfixed, the flaw would allow hackers to easily take over and compromise millions of websites and the information held on their servers. In response, multiple European governments and operators including the Port of Rotterdam have taken websites offline.
Updating WordPress, Drupal or a plugin will not close the PHP flaws that took government websites offline this week. The vulnerable code sits in the PHP engine underneath them, so every server, appliance and hosting platform running PHP has to be found and updated.
Attackers have used a stolen credential from a Microsoft 365 backup service to sign in to hundreds of customer tenants. Because backup tools need broad access to mail, files and directories, the attackers inherited that access.
Data concerns have delayed or derailed AI projects at 86 per cent of organisations in the past 12 months. That is despite 95 per cent naming better use of data to improve business outcomes as a top priority.
A quarter of enterprise security breaches will trace back to AI agent abuse by 2028, Gartner predicts. It blames unmanaged machine privileges and legacy credential practices.
Australian organisations will no longer be able to summarise their cyber security posture with a single Essential Eight maturity level. The Australian Signals Directorate (ASD) has released a principles-based replacement that rates security area by area.
Origin Energy has seen no evidence that customer data taken in its July cyber incident has been published online, but chairman Scott Perkins has told shareholders the risk remains and affected customers must stay alert to scams.
A practitioner's observation: After forty years of designing and implementing records systems for some of Australia’s most highly regulated organisations, I have something to say, and I think the profession needs to hear it.
An autonomous agent powered by OpenAI’s advanced artificial intelligence (AI) models went rogue during a security test and hacked multi-billion dollar tech startup, Hugging Face, last week. The agent didn’t just exploit vulnerabilities in Hugging Face’s systems to achieve what it perceived as a strategic gain. It also exploited vulnerabilities within OpenAI’s infrastructure.
Federal and state agencies wanting to run AI inside their own security perimeter have a new sovereign hosting option. Macquarie Government has launched an Azure cloud, security and AI practice built for Protected-level government requirements.
Western Sydney University has given every staff member enterprise-grade Microsoft 365 Copilot access. It is the first university in New South Wales and the second in Australia to do so.
Configuration-led approaches to Microsoft 365 governance are no longer sufficient, according to new research from Info-Tech Research Group. The spread of AI tools such as Copilot is making the weaknesses harder to ignore.
The alleged hacker who claimed access to two million Origin Energy customer records says a private settlement has been reached with the company and no data will be published. Origin has separately confirmed that customer data was accessed and disclosed.
A Sydney-based Microsoft specialist Informotion has been ranked alongside global systems integrators including Accenture, Avanade, Capgemini and TCS in a new analyst assessment
Enterprises are collecting the right volume of data in only a reported 2 per cent of legal matters. AI prompts, system responses and AI-generated outputs are creating a new class of discoverable records that traditional discovery tools were not built to handle.
Qantas has dodged penalties that could have run into billions of dollars after simple human error was found to be the cause of the massive 2025 data breach that affected millions of customers, and ISO27001 compliance failed to prevent.
Picture two finance managers in the autumn of 2027, one in Manchester and one in Lyon, doing exactly the same thing: exporting an invoice as a tidy, letterheaded PDF and emailing it to a domestic business customer. In Manchester, this is still a perfectly ordinary invoice and will remain one until April 2029. In Lyon, it stopped being one a year earlier.
