October brought renewed attention to cybersecurity in New Zealand’s healthcare sector following further breaches involving sensitive personal information. Internationally, the premature disclosure of critical PHP vulnerabilities forced an urgent response from software developers and left organisations worldwide trying to patch their systems as attackers began exploiting the flaws.
We also examine an unusual wave of attacks against supermarket refrigeration systems across Europe, where disruption rather than financial gain appeared to be the objective.er’s Cybersecurity Highlights cover a Microsoft 365 phishing campaign affecting New Zealand users, a North Korean operative who secured work at a local business, and key findings from the NCSC’s 2026 Cyber Threat Report.
Happenings
[Global] Critical PHP Vulnerabilities Exploited following Premature Disclosure
Two critical vulnerabilities affecting PHP that could allow unauthenticated attackers to execute malicious code on affected servers were disclosed in October, impacting organisations worldwide due to the wide use of PHP to power websites and web applications.
A coordinated disclosure of the vulnerabilities was scheduled, but did not go as planned. Information about the vulnerabilities circled online before the agreed disclosure date, forcing developers to bring their security release forward by a day. Software distributor Chainguard released patched PHP container images more than six hours before the embargo expired, and shortly after the early disclosure security research firm Calif accidentally published a video demonstrating working exploits. These mistakes allowed attackers to examine the fixes and exploits, and begin to abuse the vulnerabilities while many organisations were still waiting for updates, which in many cases were in components of software that could not be directly updated without vendor released patches.
Evidence of exploitation emerged even before the disclosures, with Amazon Threat Intelligence identifying an exploitation attempt four days before the public release, followed by widespread scanning and exploitation attempts once technical details became available. It is currently unclear how the attackers obtained knowledge of the vulnerability before any of the public leaks. Later in the month, Dream Research identified an attack campaign that combined the PHP vulnerabilities with a Linux kernel privilege escalation flaw to compromise 25 Palo Alto Networks firewall and management servers.
Affected PHP runtimes should be updated, including those embedded in third-party applications, appliances, and container images. Previously exposed systems where patch deployment was delayed should be investigated for suspicious web requests, unexpected process execution, and unauthorised file changes, and while web application firewall protections can reduce exposure while patches are deployed, they do not fully mitigate the underlying vulnerabilities.
[NZ] Fisher & Paykel Healthcare Cyber Security Breach
Medical device manufacturer Fisher & Paykel Healthcare disclosed a cyber security incident that occurred in October, where attackers gained unauthorised access to two employee email accounts and a subset of company files. Some of the accessed files were identified to contain personal information, but the number of affected individuals or the specific information that was accessed has not been publicly disclosed. In an official statement, Fisher & Paykel confirmed that its products, manufacturing operations, and supply chain were unaffected, with no evidence that systems holding patient information had been compromised. They reported that there is no evidence of ransomware or malware on systems, and they believe the incident has been contained. They have notified the relevant authorities and are in the process of contacting affected individuals.
Further details were released in October about the August 2026 ransomware attack against Dunedin-based clinical research provider Zenith Technology (ZenTech) where attackers stole up to 67.1 GB of data, including sensitive personal and health information associated with clinical trials. The Ministry of Justice (MoJ) confirmed that the compromised information in this attack included Coroners Court records, which they are currently investigating to understand how these came to be in ZenTech’s possession, as there was no contractual relationship with the Ministry who control these records.
These breaches are the latest in a string of high-profile cyber incidents involving New Zealand healthcare-related organisations, including attacks against Pinnacle Midlands Health Network in 2022, Health New Zealand’s Central region in 2024, and Manage My Health in December 2025. The growing number of cyber incidents involving New Zealand’s healthcare sector has prompted additional scrutiny of how sensitive information is protected, particularly when held by private providers.
Following the Manage My Health breach, the Privacy Commissioner recommended changes to the Privacy Act that would make third-party service providers directly accountable for inadequate security safeguards, even when they process information on behalf of another organisation. The Government consulted on introducing mandatory cybersecurity requirements for critical infrastructure including healthcare services in early April 2026, although no final regulatory decisions have been announced.
[Global] Microsoft Disrupts Major Phishing-as-a-Service Marketplace
Microsoft uncovered and disrupted a large Chinese-language cybercriminal marketplace supplying phishing tools and infrastructure to attackers worldwide. Working with international partners, Microsoft seized or redirected infrastructure supporting the services, disabled more than 20,000 associated accounts, and blocked over 100,000 domains used for impersonation and fraud.
The operation involved YAM Store, which sold access to compromised or fraudulently obtained Microsoft and Google cloud environments, alongside phishing kits such as CoGUI and Iron Man that enabled attackers to impersonate legitimate organisations and steal credentials or financial information. Active since January 2026, the services have facilitated more than one billion malicious emails and text messages targeting over 75,000 organisations worldwide, with the Iron Man phishing kit alone provided more than 2,300 ready-made templates designed to impersonate trusted organisations across different countries. The services assisted attackers to exploit compromised Microsoft 365 environments to host malicious content and support further phishing campaigns.
We recommend using phishing-resistant authentication and geo-restrict sign-ins where possible, particularly for privileged Microsoft 365 accounts.
[Global] Citrix NetScaler Vulnerability Active Exploitation
Vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, which are commonly used to provide remote access to corporate networks, were actively exploited throughout October. Citrix originally disclosed eight vulnerabilities in late September, including three that were rated critical that enable unauthenticated attackers to execute malicious code on affected appliances. Google Threat Intelligence Group and Mandiant confirmed exploitation of the vulnerabilities began before their disclosure, and that the vulnerabilities allow attackers to gain root-level access, install malicious web shells, and use compromised appliances to access internal networks.
Although these vulnerabilities were remediated in a patch release, four additional high and critical rated vulnerabilities were identified in October leaving previously patched systems exposed that request requiring additional patching. The New Zealand National Cyber Security Centre (NCSC) released an urgent October announcement urging organisations to confirm appliances were not vulnerable, apply security updates, and investigate exposed appliances for signs of compromise. Citrix issued a warning that patching alone would not remove malicious files or existing attacker access.
Techniques and Updates
Food Chain Attacks
Attackers remotely manipulated refrigeration systems at approximately 700 French supermarkets, altering settings to extend defrost cycles for up to eight hours causing significant food spoilage, equipment damage, and financial losses – without any apparent direct financial benefit to the attackers.
The attacks targeted operational technology (OT) used to remotely manage commercial refrigeration equipment, including systems manufactured by Danfoss, Copeland, and Dixell, with many of the affected systems running outdated firmware or with management interfaces exposed to the internet. Similar refrigeration failures occurred at several US military facilities in August, with the Pentagon subsequently investigating them as suspected cyberattacks. In November, a wave of similar attacks affected supermarkets in at least 11 European countries.
No group or nation-state has claimed responsibility for the attacks, but Security researchers at SentinelOne have identified Russian-aligned groups as possible perpetrators, citing their history of attacks against operational technology and food-processing facilities. The European Commissioner for Agriculture and Food described the attacks as a deliberate attempt to disrupt food supply chains and undermine consumer confidence, while France’s national cybersecurity agency has warned that attacks against exposed refrigeration controllers may still be ongoing.
Microsoft Security / Updates
Microsoft expanded Entra Universal Continuous Access Evaluation (CAE) in Global Secure Access during October, introducing additional security signals that can trigger reauthentication. The capability is currently in public preview and can respond when a device becomes noncompliant, is disabled, or when a user is identified as high risk, allowing Global Secure Access to interrupt connections without waiting for existing access tokens to expire.
New Intune controls were introduced for managing AI agent runtime protection through Microsoft Defender for Endpoint, allowing supported Windows devices to detect and potentially block malicious instructions or actions performed by locally running AI agents, including threats involving prompt injection. The Intune management template became generally available in late October, although Microsoft identifies the underlying endpoint protection capability as being in Preview.
Microsoft expanded Purview Endpoint Data Loss Prevention capabilities making protection for FTP and SFTP file transfers generally available on managed Windows devices. Organisations can now monitor transfers involving sensitive information and apply restrictions to prevent unauthorised file uploads through these protocols, with events recorded in Activity Explorer to support investigation. Organisations already using Endpoint DLP should consider extending their existing policies to cover these additional transfer methods, particularly where FTP or SFTP is used to exchange files with external systems.
The October security updates addressed more than 1,400 vulnerabilities, including an actively exploited Windows Shell vulnerability that allowed attackers to bypass Mark of the Web security protections that identify files downloaded from untrusted sources and can trigger additional warnings or restrictions when opened. A publicly disclosed vulnerability that could allow attackers with local access to bypass Windows Defender Application Control restrictions and execute unauthorised applications was also patched in the cycle.
Windows 11 version 26H2 was released in September, and received a new security baseline configuration introducing:
- Administrator protection, limiting elevated privileges to individual tasks rather than maintaining them throughout a session.
- Stronger User Account Control (UAC) protections, requiring administrators to verify their credentials before approving elevated actions, reducing the risk of unauthorised privilege escalation.
- Updated TLS settings, removing support for the outdated TLS 1.1 protocol.
- An option to prioritise for Microsoft’s built-in printer drivers to reduce exposure to third-party vulnerabilities.
We recommend testing the baseline before wider deployment to identify any compatibility issues with existing applications and systems.