Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years. The latest Annual Cyber Threat Report shows that phishing, compromised accounts, unpatched systems, ransomware and data theft remain the main operational pressures.

Artificial intelligence is increasing the speed and scale of many established techniques, but the report’s central message is practical: organisations need to patch faster, protect identities, improve logging, manage supplier access and prepare to continue operating during an incident. The Australian Signals Directorate’s Australian Cyber Security Centre also expanded proactive warning activity, issuing more than 4,400 notifications about potential malicious activity during the year.

What Did Australia Record in 2025-26?

These figures come from different reporting and response channels. Cybercrime reports, incidents handled and proactive notifications should not be added together as if they represent unique victims. Read together, however, they show both high public reporting volume and a larger operational workload for government responders.

What Changed in Australia’s Threat Picture?

The incident count increased, but the more important shift was in impact. Extensive compromises rose from 26 to 40, even though only one Category 2 (C2) incident, the second-highest severity level, was recorded. Ransomware and distributed denial-of-service activity also produced more extensive compromises despite stable or falling overall volumes.

Improved visibility also contributed to the rise. ASD’s ACSC identified 362 incidents after proactively warning organisations about suspicious activity, while more than half of its individual notifications originated from declassified intelligence. The increase therefore reflects a combination of worsening risk, stronger detection and greater reporting awareness.

How Much Did Cybercrime Cost Australians?

More than 82,000 cybercrime reports were submitted through ReportCyber, or about one every six minutes. Identity fraud remained the most frequently reported cybercrime, although reports in that category fell 18%. The Australian Cyber Security Hotline received more than 37,500 calls, down 12% from the previous year.

The average self-reported cost for individuals remained A$33,000. The business average rose 16% to A$93,500 per report. Small businesses reported an average cost of A$55,400, medium businesses A$141,300 and large businesses A$148,100. The 45% rise for medium businesses stands out because these organisations may combine valuable data and connected systems with fewer specialist security resources than large enterprises.

Which States Reported the Most Cybercrime?

Victoria accounted for 27% of cybercrime reports, followed by Queensland at 26% and New South Wales at 22%. Western Australia represented 12%, South Australia 7%, while the Northern Territory, Australian Capital Territory and Tasmania each accounted for 2%. The report notes that Australia’s three most populous states continued to generate the highest reporting volumes, with disproportionately high reporting rates relative to their populations.

Which Attack Paths Appeared Most Often?

Phishing appeared in 39% of analysed incidents, followed by compromised accounts at 21%, user execution at 17%, valid accounts at 15%, and social engineering at 13%. These percentages overlap because one incident can involve several techniques. The pattern shows why email filtering alone is not enough: identity monitoring, secure recovery processes and post-login detection are also necessary.

Data exposure also became more prominent. ASD’s ACSC responded to 98 data breach incidents, up 66%, while the Office of the Australian Information Commissioner received 1,205 breach notifications during 2025, its highest annual total since the Notifiable Data Breaches scheme began. Stolen personal information can support identity fraud, targeted phishing and account recovery abuse long after the original breach.

Why Did Flat Ransomware Volume Still Matter?

ASD’s ACSC responded to 139 ransomware incidents, broadly consistent with the previous year. However, extensive ransomware incidents increased from 16 to 24. Health Care and Social Assistance, Professional, Scientific and Technical Services, and Manufacturing remained the three most affected industry divisions.

This distinction matters because a stable incident count can hide rising operational harm. Modern ransomware campaigns may combine service disruption, data theft and public extortion, while Ransomware-as-a-Service lowers the barrier for affiliates. Defenders should measure recovery time, systems affected and data exposure, not only the number of attacks.

How Quickly Are Vulnerabilities Being Exploited?

Publicly reported common vulnerabilities and exposures (CVEs) increased 30%. ASD’s ACSC says most vulnerability exploitation occurs within two weeks, while some flaws are exploited within 48 hours of patch or mitigation guidance. It also recorded successful exploitation of a vulnerability first identified in 2008, showing that organisations must address both newly disclosed flaws and unsupported legacy systems.

A useful lesson is that patch speed depends on preparation before a vulnerability is disclosed. Organisations need a current inventory of internet-facing systems, clear ownership, tested emergency change procedures and a way to verify that a fix reached the running service. A policy target has limited value if teams cannot identify the affected asset or confirm deployment.

How Did Proactive Warnings Reduce Risk?

The report provides two examples of threat intelligence changing outcomes. A collective notification about cPanel vulnerabilities was sent to 340 entities and resulted in more than 60 incidents being confirmed. In a separate Akira ransomware investigation, reports from multiple organisations helped ASD’s ACSC connect activity to exploitation of a known SonicWall vulnerability.

ASD’s ACSC then identified almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organisations, many in critical infrastructure, and issued targeted warnings. Similar reported incidents declined after the public alert. The practical insight is that reporting is not only a compliance task: shared evidence can reveal a campaign early enough to protect organisations that have not yet detected it.

Where Did Cyber Risk Concentrate?

Federal government accounted for 32% of incidents reported to ASD’s ACSC, followed by state and local government at 16%. The report cautions that government reporting obligations influence these totals. Health Care and Social Assistance was the leading non-government sector at 7%, while Manufacturing entered the top ten and recorded the largest increase in reports.

Critical infrastructure accounted for 154 incidents, or 10% of the total, down almost 7%. Phishing was the leading initial-access method in these incidents at 36%, followed by valid accounts at 16% and drive-by compromise at 10%. Financial and insurance services represented 30% of critical infrastructure incidents, ahead of public administration and safety at 21%, and electricity, gas, water and waste services at 17%.

State-sponsored actors continued to seek sensitive information and access that could support later espionage or disruption. The report specifically notes that China-nexus actors increasingly use covert networks built from compromised small-office/home-office routers, Internet of Things devices and smart devices to conceal the origin of malicious activity. This makes asset ownership and secure configuration important beyond conventional servers and employee endpoints.

How Is AI Changing the Operating Tempo?

The report does not present AI as a separate attack type. Instead, it describes AI as an accelerator for reconnaissance, vulnerability research, exploit development, phishing, impersonation, stolen-data analysis and malicious code adaptation. The immediate risk is less about an unfamiliar technique and more about familiar techniques becoming faster, cheaper and easier to personalise.

AI can also improve defence by analysing security data, identifying vulnerabilities, monitoring unusual behaviour and supporting incident response. Those benefits depend on governance. Organisations should limit the sensitive data available to AI systems, apply least privilege, retain audit records and require human review for consequential actions. Security teams should evaluate AI as both a new dependency and a defensive tool.

Why Are Supply Chains and Code Repositories a Priority?

Third-party access and software dependencies can spread one compromise across many organisations. ASD’s ACSC observed attackers using social engineering, stolen credentials and authentication tokens to enter code repositories, expose private source code, steal secrets and modify trusted software packages.

The report uses the self-replicating Shai-Hulud campaign as an example. After a maintainer account was compromised, malicious package versions harvested credentials and cloud metadata, exposed stolen secrets in public repositories and used captured access to compromise other packages. Organisations therefore need an accurate inventory of dependencies and deployed versions, tightly controlled maintainer privileges, secret scanning and rapid token revocation.

What Should Organisations Do Now?

• Accelerate patching. Prioritise internet-facing and actively exploited vulnerabilities, replace unsupported technology and verify remediation in production.
• Protect identities and sessions. Use phishing-resistant authentication, restrict privileges, secure recovery processes and monitor unusual token or session use.
• Improve event logging. Retain the identity, endpoint, cloud, application and network evidence needed to understand access, impact and data exposure.
• Reduce supplier and software risk. Map third-party access, dependencies, privileged integrations, code repositories and secrets, then test revocation and containment.
• Plan for disruption. Adopt an assumed-breach mindset, test incident response and recovery, and define how critical services will continue when systems are unavailable.
• Govern AI use. Limit data exposure, enforce least privilege, validate outputs and retain human oversight for actions that affect systems or customers.
• Report suspicious activity early. Technical details and indicators can help authorities identify a wider campaign and warn other potential targets.

What Is the Main Takeaway?

Australia’s 2025-26 threat data shows an environment moving faster without abandoning familiar weaknesses. AI is compressing response time, but credentials, phishing, unpatched systems, supplier access and recovery readiness continue to shape real-world outcomes.

The report’s most useful message is operational: proven controls need to work at greater speed and across the full environment. Organisations that know their assets, protect legitimate access, preserve evidence and practise recovery are better placed to contain both established attacks and AI-assisted variants.

Frequently Asked Questions

What Is the Annual Cyber Threat Report 2025-26?

It is the Australian Signals Directorate’s annual assessment of cyber threats affecting Australian individuals, businesses, government and critical infrastructure. It combines incidents handled by ASD’s ACSC, public cybercrime reports, threat intelligence, notifications and case studies from the 2025-26 financial year.

How Many Cyber Security Incidents Did Australia Record?

ASD’s ACSC responded to 1,524 incidents, up 20% from the previous year and 36% over five years. This is the number of incidents handled by the national cyber security authority, not a complete count of every incident that occurred in Australia.

What Is the Difference Between a Cybercrime Report, an Incident and a Notification?

A cybercrime report is submitted through ReportCyber by a member of the public or an organisation. A cyber security incident is activity that ASD’s ACSC assessed or assisted with, while a notification is a warning sent to an entity about potential malicious activity or exposure. The categories can overlap, so their totals should not be combined.

What Was the Most Common Attack Technique?

Phishing was the most prevalent MITRE ATT&CK technique, appearing in 39% of analysed incidents. Compromised accounts, user execution and valid accounts were also common, showing that attackers frequently combine social engineering with legitimate credentials or sessions.

How Much Did Cybercrime Cost Australian Victims?

The average self-reported cost was A$33,000 for individuals and A$93,500 for businesses. These are averages for reports that included a cost, not an estimate of Australia’s total economic cost, and the business figure varied substantially by organisation size.

Did Ransomware Increase in 2025-26?

The total remained broadly stable at 139 incidents, but extensive ransomware compromises increased from 16 to 24. This means the volume was flat while the number of more consequential incidents rose.

How Serious Was the Data Breach Trend?

ASD’s ACSC responded to 98 data breach incidents, a 66% increase. Stolen personal information can be reused for identity fraud, targeted social engineering and account recovery attacks, so the effects may continue well beyond the initial intrusion.

How Is AI Affecting Cyber Security?

AI is reducing the time and skill needed for reconnaissance, exploit development, phishing and data analysis. It can also help defenders find vulnerabilities, analyse events and respond faster. The report recommends using AI with controlled data access, auditability and human oversight.

How Fast Do Organisations Need to Patch?

There is no single safe deadline for every vulnerability. ASD’s ACSC has observed most exploitation within two weeks and some within 48 hours of patch or mitigation guidance, so internet-facing and actively exploited flaws require urgent action. Organisations should also identify and replace unsupported systems that cannot receive fixes.

Which Sectors Reported the Most Incidents?

Federal government reported the largest share at 32%, followed by state and local government at 16%. Health Care and Social Assistance led non-government sectors at 7%. These percentages reflect reporting to ASD’s ACSC and are influenced by sector-specific obligations and reporting maturity.

What Should Smaller Organisations Prioritise First?

Start with a small set of controls that reduce common attack paths: automatic updates, phishing-resistant authentication, protected backups, secure account recovery, basic event logging and a tested incident contact process. Choosing products that are secure by default can reduce the operational burden where specialist resources are limited.

Why Does Reporting an Incident Matter?

A single report may reveal infrastructure, indicators or techniques affecting other organisations. The Akira and cPanel examples show how combined evidence and proactive notifications can identify vulnerable entities and reduce further incidents. Australian organisations can report even when compromise has not yet been confirmed.

Source: SOCRadar · 2026-10-27

SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an open, unauthenticated directory listing. The files show an operator turning the PHP2Shell vulnerabilities into practical attack tooling: a full remote code execution (RCE) chain built and tested in a lab, plus scripts that screen live websites for the conditions that chain depends on. 

The screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.

Key Takeaways

• Working exploit chain: An exposed attacker server held a lab-tested PHP2Shell exploit for PHP 8.4.26 running as Apache mod_php, the last vulnerable 8.4 release.
• Live target screening: Companion scripts checked about 20 public websites for the PHP version, server setup, and session settings the exploit needs.
• No successful exploitation observed: None of the screened sites met the exploit’s preconditions, and the operator’s results show no shell access.
• Configuration matters, patching decides: Hardened production settings blocked this chain, but only updating to a fixed PHP release removes the risk. 

Our main FAQ blog, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covers the flaws, fixed versions, and remediation. To see whether a specific site still needs that fix, SOCRadar’s free PHP2Shell Checker flags its exposure in seconds, with no signup, agent, or exploitation.

How Did SOCRadar Find the Server?

The data comes from SOCRadar’s own platform. The server was one of the exposed hosts captured through SOCRadar Threat Hunting, and every file analyzed here was collected passively from its open directory listing.

What the Exposed Server Held

A Lab-Built PHP2Shell Exploit Chain

The central file, aslr_exploit.py, is a Python exploit the operator labels a “one-click” PHP2Shell exploit for PHP 8.4.26 under Apache mod_php. It works entirely over ordinary HTTP requests in three broad steps: it recycles the target’s PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP’s session upload progress handling to run a shell command.

The script ships with two calibration profiles, one for the official PHP 8.4.26 Apache container image and one for a custom lab build, and it defaults to a local target. That points to an operator who has tested the chain against containers they control.

What Conditions Does the Exploit Need?

The chain depends on a debug-style setup that hardened production servers rarely use:

• Visible errors: PHP errors displayed to visitors.
• Weak session settings: Session upload progress on and session strict mode off.
• Tight resource limits: A very low memory limit and a single Apache worker.

Even when those conditions are met, the payload can run only a very short command, so a real attack would need a second-stage script. The mod_php focus matches PHP’s own advisory, which rates mod_php deployments as the highest risk.

How Did the Operator Screen Live Websites?

Three companion scripts take the work from the lab to real websites. All of them send traffic through a rotating proxy pool hosted on the same server, switching proxies between targets.

Fingerprinting PHP Versions and Server Setups

The first script, php2shell_fp.py, works through a list of about 20 websites. It reads each site’s PHP version from the X-Powered-By and Server headers and guesses whether the site runs mod_php based on how those headers appear together. It then sends a small multipart request with an upload-progress field and a random session ID to see whether the site echoes the session back.

Probing for Exploit Preconditions

The second script, deep_probe.py, examines 11 of those sites more closely. It requests a page designed to trigger a PHP warning to see whether errors are shown, and tries six common phpinfo paths to read settings such as the memory limit and upload progress state. It also tests 11 common parameters for file inclusion and sends an upload with a unique MARKER_ filename to test session injection.

What Do the Results Show?

The saved results cover those 11 sites, which include a university, nonprofits, and small businesses across Europe, North America, and Asia. Six ran PHP 8.4 releases older than the fix, four of them on 8.4.26 itself, while the rest reported 8.3, 8.2, or end-of-life 5.6. None displayed errors, exposed a phpinfo page, revealed a file inclusion flaw, or echoed the test session, so none met the exploit’s preconditions.

This finding concerns the operator’s PHP2Shell tooling specifically. Other files on the same server point to unrelated intrusion activity against financial and Web3 targets.

WordPress Follow-Up Reconnaissance

A third script, wp_attack.py, turns to five of the WordPress sites. It enumerates users through the REST API and author redirects, checks for about two dozen popular plugins, lists XML-RPC methods and tests pingback, and looks for exposed debug logs.

Assessment

• Target CVE: We assess with moderate confidence that the tooling targets CVE-2026-109618, based on its use of the session upload progress path and its focus on PHP 8.4.26.
• Capability: The operator shows strong exploit development skills, but as of October 22, 2026, we have seen no evidence of shell access on any screened site.
• Attribution and motivation: The operator remains unattributed. Other files on the same server target cryptocurrency and Web3 platforms, which points to financial motivation. 

The Operator’s Wider Toolset

PHP2Shell is one part of a broader operation here. As previously mentioned, other tools recovered from the same server show an operator working well beyond PHP exploitation:

• Secret harvesting: Pulling API keys and backend URLs out of websites’ client-side JavaScript.
• Endpoint sweeping: Testing web and API routes, including admin paths, for unauthenticated access.
• Proxy rotation: A pool of rotating proxies to spread traffic and evade rate limits and blocking.

Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving. Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets. This activity is separate from the PHP2Shell screening.

What Should Defenders Do?

• Update PHP: Move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Hardened settings stopped this chain, but they will not stop every variant.
• Block and hunt the server: Block 206.188.197[.]105 at the perimeter and search web and proxy logs for past connections.
• Look for screening traffic: Flag multipart POST requests with a PHP_SESSION_UPLOAD_PROGRESS field from unfamiliar sources, especially uploads named MARKER_ followed by eight hex characters.
• Harden until patched: Keep display_errors off, set session.use_strict_mode=1, disable session.upload_progress.enabled, and remove any public phpinfo pages.
• Stop advertising versions: Set expose_php=Off so the X-Powered-By header no longer reveals the PHP version scanners look for.

Indicators of Compromise

MITRE ATT&CK Mapping

Source: SOCRadar · 2026-10-22