A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests. 

This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security. 

Here are the stories that shaped the week. 

The Cyber Express Weekly Roundup 

PHP2Shell Flaws Knock Wikipedia and Government Sites Offline 

Two critical vulnerabilities in PHP, the scripting language that powers a large share of the web, have triggered urgent patching warnings from agencies around the world. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have already been linked to outages at Wikipedia and a number of government websites. Read more… 

INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa 

An INTERPOL-coordinated crackdown spanning 21 countries has ended in 1,462 arrests. Operation Serengeti III ran from June to August 2026 and targeted fraud, ransomware, business email compromise and online scams. Investigators disrupted 10,909 malicious networks and recovered more than USD 105 million. The operation also identified nearly 66,000 victims, linked to combined losses of more than USD 385 million. Read more… 

ASD Essentials Replaces the Essential Eight 

The Australian Signals Directorate has launched ASD Essentials, a broader successor to the Essential Eight, the security baseline Australian organizations have long been measured against. Where the Essential Eight centered on a fixed set of mitigation strategies, the new framework extends its scope to enterprise IT, operational technology and cloud environments. Read more… 

Dubai Police Bust AED 10,000 Fake Driving License Scheme 

Dubai Police have arrested an eight-member gang that sold driving licenses for AED 10,000 each. Customers received licenses issued in a neighboring country without ever travelling there, taking a lesson or sitting a test. The gang then helped buyers convert those licenses into UAE licenses by exploiting legitimate license exchange agreements between the two countries. Read more… 

Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk 

Fintech firms vet their commercial vendors closely, but the open-source libraries, container images and third-party components inside their systems often arrive with far less scrutiny. That mismatch leaves a blind spot in how financial technology companies manage risk. Vijendra Katiyar of CleanStart points to examples such as a widely used Redis image that carried 185 known CVEs, and the Shai-Hulud worm, which spread through malicious npm packages. Read more… 

Conclusion 

Taken together, this week’s stories show how much of today’s risk comes from what organizations already trust: decade-old code, inherited software components, official exchange agreements and security checklists that measure effort rather than results. Follow The Cyber Express for next week’s weekly cybersecurity roundup and ongoing coverage of these stories. 

site-verification-ok

site-verification-ok

For years, the Essential Eight has been the go-to checklist for Australian organisations defending against cyber attacks. That is now changing. The Australian Signals Directorate (ASD) has launched ASD Essentials, a new cyber security framework that evolves the Essential Eight into a broader set of guidance covering enterprise IT, operational technology and cloud environments. The shift is more than a rebrand. It changes how organisations measure progress, where they focus effort and how they handle environments the original framework was never designed for.

Why ASD Essentials Is Replacing the Essential Eight

ASD points to its Annual Cyber Threat Report 2024-2025, which shows Australian organisations facing increasingly sophisticated threats. At the same time, modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud and emerging technologies. A fixed list of controls struggles to keep up with that variety. The new framework takes a threat-informed, principles-based approach, giving organisations flexibility to achieve security outcomes without being tied to specific technologies.

5 Key Changes Under ASD Essentials

1. Phased priorities replace maturity levels. Instead of climbing maturity levels, organisations will work through phased priorities, directing effort to their highest-risk assets first. 2. Outcomes over checklists. The framework moves away from prescriptive security requirements toward principles and actions that help organisations assess whether intended security outcomes are actually being achieved. 3. New building blocks. It introduces cyber security principles, actions and domains, focusing uplift efforts on critical business functions and systems. 4. Environment-specific chapters. Each chapter applies the same underlying model but accounts for the threats, risks and operational realities of the environment it covers. 5. Risk-informed decisions. There is a stronger emphasis on decision-making supported by threat intelligence and each organisation's own context.

The First Three ASD Essentials Chapters

The series launches with three chapters:

• Essentials for enterprise IT is the direct evolution of the Essential Eight.
• Essentials for operational technology (OT) supports Australian critical infrastructure operators protecting their operational technology environments from cyber threats.
• Essentials for cloud supports organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).

ASD has also made AI-focused guidance available, helping organisations consider AI-enabled systems within their technology environments. The framework includes overview publications and supplemental publications alongside the chapters.

Who Should Pay Attention

The guidance is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium-sized businesses that do not operate at enterprise scale can still apply it where relevant. ASD says the framework remains consistent with its best-practice advice and the Australian Government Information Security Manual. Industry consultation played a central role in its development, and ASD plans to keep engaging with industry, government and critical infrastructure stakeholders as technologies and threats change.

What ASD Essentials Means for Compliance Today

For now, nothing changes on the compliance front. Organisations should continue meeting their current regulatory obligations until regulators communicate any associated changes. ASD is in discussions with regulatory bodies about the impact and expected timeframes of the transition and says it will advise on expectations in due course. During the transition period, both the Essential Eight and ASD Essentials will remain available on cyber.gov.au, along with supporting resources and implementation guidance. For security teams, the practical takeaway is to start reviewing the new chapters now, map current Essential Eight controls against the new principles, and identify which critical business functions and systems would sit at the top of a phased priority plan.