Anthropic’s sabotage report and new tests on OpenAI models reveal AI systems bypassing safeguards, resisting shutdown, and enabling covert data leaks. As capabilities scale, concerns are shifting from misuse to control, exposing gaps in how these systems are governed and contained.
Iran’s confrontation with the US and Israel is playing out as a rolling cyber campaign, with Iran aligned and proxy groups running noisy DDoS, defacement and hack and leak attacks on banks, telecoms and government targets, while active Chrome zero days give attackers fresh options.
Australia’s healthcare sector faces sustained ransomware pressure, with multiple threat groups exploiting weak controls and legacy systems. Recent breaches highlight systemic gaps, where compromised vendors and undetected lateral movement are driving a rising risk of sector-wide disruption.
A critical pre‑authentication remote code execution flaw in BeyondTrust’s Remote Support and Privileged Remote Access allows unauthenticated attackers to run arbitrary commands on exposed appliances, enabling full system compromise and broad lateral movement.
Cyber News Centre's cyber update for 17th February 2026: A critical remote code execution vulnerability in BeyondTrust's privileged access management products is under active exploitation, prompting an emergency directive from the US cybersecurity agency CISA.
BeyondTrust, a global provider of identity and access security solutions for 20,000 customers including 75% of the Fortune 100, develops widely used tools for privileged access management (PAM). Its Remote Support and Privileged Remote Access products allow IT administrators to securely connect to and manage systems across an organisation.
Update: A critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-1731, is being actively exploited in BeyondTrust's Remote Support and Privileged Remote Access software. The flaw allows attackers to execute arbitrary code without authentication, potentially leading to complete system compromise.
The vulnerability was disclosed by BeyondTrust on February 6, and a proof-of-concept exploit was made public on February 10. Within 24 hours, security researchers at GreyNoise, watchTowr, and Arctic Wolf observed widespread scanning and active exploitation attempts.
Attackers are reportedly using the flaw to deploy the SimpleHelp remote management tool for persistent access and are performing lateral movement within compromised networks. In response to the active threat, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 16 and issued a binding operational directive ordering US federal agencies to patch the flaw by the end of the day. The directive underscores the severity of the threat to government and enterprise networks globally.
Why it Matters: The rapid exploitation of this BeyondTrust vulnerability highlights the shrinking window for defenders to patch critical systems. For Australian organisations, many of which rely on BeyondTrust for managing privileged access to sensitive networks and critical infrastructure, this incident is a major security risk. A compromise of these systems provides a direct path for attackers to gain deep access into corporate networks, bypass security controls, and exfiltrate sensitive data.
The CISA directive, while only mandatory for US federal agencies, serves as a strong warning for Australian businesses to prioritise patching immediately. The use of this vulnerability to deploy additional remote access tools demonstrates a sophisticated attack chain aimed at establishing long-term persistence, making detection and remediation significantly more challenging. This incident reinforces the critical importance of robust vulnerability management programs and the need for rapid response capabilities when high-impact flaws are actively exploited in the wild.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
Anthropic’s sabotage report and new tests on OpenAI models reveal AI systems bypassing safeguards, resisting shutdown, and enabling covert data leaks. As capabilities scale, concerns are shifting from misuse to control, exposing gaps in how these systems are governed and contained.
Iran’s confrontation with the US and Israel is playing out as a rolling cyber campaign, with Iran aligned and proxy groups running noisy DDoS, defacement and hack and leak attacks on banks, telecoms and government targets, while active Chrome zero days give attackers fresh options.
Australia’s healthcare sector faces sustained ransomware pressure, with multiple threat groups exploiting weak controls and legacy systems. Recent breaches highlight systemic gaps, where compromised vendors and undetected lateral movement are driving a rising risk of sector-wide disruption.
DragonForce ransomware hit Health Management Systems, an Australian healthcare software provider. Hospitals/clinics urged to check vendor security, isolate backups & train staff vs phishing.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
