On 21 October 2026, the PHP project released urgent fixes for two critical vulnerabilities, now widely known as PHP2Shell. PHP runs a large share of the web, including every WordPress site, so this one reaches well beyond technical teams. If your business has a website, it is quite likely affected. This article covers what we […]
Information security and cyber
The Patch Was Published on 6 August. Mathspace Applied It on 29 August. The Breach Was on the 10th.
On 6 August 2026 Metabase published a critical security advisory and patched versions. On 10 August an attacker was inside Mathspace’s self-hosted Metabase instance. On 27 August they downloaded a database. On 29 August Mathspace applied the patch. On 3 September, reviewing historical access logs, Mathspace worked out what had happened. 1,079,819 people in Australia […]
1,205 Data Breaches: What Australia’s Worst Year on Record Tells You
The OAIC recorded 1,205 notifiable data breaches in 2025, the highest since the scheme began. The number that matters isn’t the headline. It’s the 489 that weren’t attacks.
Software Supply Chain Security: The Assets Nobody Put on the Register
The software you buy, the components inside it, and the machines that build it. Most asset registers cover the first and stop there.
ISO Clause 5.1 Leadership and Commitment: No Document Required, Plenty Expected
Clause 5.1 asks top management to demonstrate leadership but requires no document. Three ways to evidence it, from a signed policy to the audit interview.
The Contract Said No Offshoring. Nobody Checked.
Most supplier contracts in Australia now include a clause that says something like “data must not leave Australia without our written approval”. It reads well in a tender and it ticks a box in a security questionnaire. The federal courts have just shown, twice, how little that clause is worth if nobody checks it. What […]
ISO/IEC 27090 Is Out: What It Adds If You Already Hold ISO 27001 or ISO 42001
ISO and IEC published ISO/IEC 27090:2026 on 14 October 2026. It is the ISO 27000 family’s standard on security threats to AI systems, from the same committee that looks after ISO 27001. If your business already holds ISO 27001 or ISO 42001, or is working towards either, it is worth knowing what it adds and […]
ASIC Fined a Licensee $1.35 Million for the System It Didn’t Have
Fortnum had a cyber policy, a self-assessment and a risk register. The court still ordered a $1.35m penalty. What was missing, mapped to ISO 27001.
Leverage: The Insider Threat Your Access Reviews Don’t Catch
Kompromat is a Russian word for an old trade: leverage over people with access. How coercion works on insiders, and the ISO 27001 controls that blunt it.
Everyone Heard 2030. The First Post-Quantum Milestone Is the End of 2026.
Quantum computing arrives in most boardrooms as a 2030 problem, which is a comfortable place to file it. Four years is somebody else’s budget cycle. The date worth writing down is nearer than that. ASD’s recommended transition timeline puts the first milestone at the end of 2026, and what it asks for is not a […]
- « Previous Page
- 1
- 2
- 3
- 4
- 5
- 6
- …
- 8
- Next Page »
