Tech Talks With Kinsoft

About Tech Talks With Kinsoft

Tech Talks with Kinsoft is your insider pass to the ever-evolving world of technology. We break down the latest in tech news, cybersecurity trends, and emerging innovations shaping our digital future. Whether you’re a seasoned IT pro, a curious techie, or a business leader navigating digital transformation, our conversations are packed with insights, real-world takeaways, and a healthy dose of tech-savvy clarity. Hosted by the Kinsoft team with decades of industry expertise—because in tech, staying ahead isn’t optional.

Publisher

Steven Kinnas

Category

news · technology

Language

en

Explicit

No

First episode

26 Jun 2025

Latest episode

11 Oct 2026

Latest episodes

132 episodes in the feed.

1. 

   11 Oct 2026

   Last Week in Tech - NetScaler's Patch Needs a Patch, Atlassian Servers Attacked Within Hours, and 86,000 Firewalls Already Owned

   Last Week in Tech for Monday 12 October 2026, covering the week from 3 October. Citrix NetScaler — two more bulletins. CVE-2026-88779 (3 Oct US): memory overflow causing DoS on appliances configured as SAML SP or IdP; CVSS v4.0 8.7; exploited in the wild (Citrix; CISA KEV 4 Oct). CVE-2026-107406 (8 Oct): memory overflow leading to RCE or DoS; CVSS v4.0 9.5; no known exploitation at publication. Builds 14.1-73.37 to -73.41 and 13.1-64.23 to -64.28 (including the 88779 fixes) are vulnerable when configured as SAML IdP; older builds as SAML SP or IdP. Fixed: 14.1-73.46, 13.1-64.29 and FIPS/NDcPP equivalents. Atlassian CVE-2026-21589 (5 Oct). Unauthenticated file read in Data Center editions of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye; CVSS v4.0 9.3. Cloud already patched. watchTowr's 6 Oct analysis showed Crowd credentials readable in plaintext and usable to create a Jira admin. Exploitation attempts reported by security firms from 6 Oct. Patch, restrict internet access, rotate Crowd credentials. FortiBleed (FBI/USSS advisory, 6 Oct). No CVE: credential stuffing, password spraying and cracking of legacy SHA-256 admin hashes on FortiGate. 86,644 compromised devices in 194 countries (SOCRadar figure cited by the advisory). Attackers delete or change original admin accounts; access sold to INC/Lynx and Payload ransomware groups. Check for rogue admins, reset credentials, enforce MFA, remove internet-facing admin, audit API keys, use PBKDF2 (FortiOS 7.2.11, 7.4.8, 7.6.1+). FortiMail CVE-2026-104286 fixes (8.0.2, 7.6.7, 7.4.9) have shipped; 7.2 must migrate. Integrity Technology Group advisory (8 Oct). FBI-led, seven-nation advisory co-sealed by ASD's ACSC: sanctioned Beijing firm stealing email since 2021 (overlaps Flax Typhoon); password-spraying Exchange/M365 endpoints, OAuth-app persistence, a portal for third parties to browse stolen mail. CISA added five old CVEs to KEV. OpenAI agents (5 Oct). Wikimedia reports edits, attempted proxy abuse and a failed exploit attempt by agents it believes were operated by OpenAI; no compromise found. ABC/iTnews (2 and 4 Oct): an OpenAI agent accessed a NSW NPWS fire-data web app in June, reported to NSW on 1 Oct; no personal information accessed identified. AI business. Firmus shelves its planned US$5bn ASX IPO (implied US$30.6bn valuation, per Reuters). Schneider Electric to buy PTC for US$205/share cash, about US$22.6bn. OVIC report (iTnews, 7 Oct). Victorian student data breach traced to an unpatched school server despite an ASD alert and department directive; central vulnerability management promised by end-2028. Coming up: Wednesday, St Andrew's Hospital, Adelaide. Friday, ASOS. Visit www.kinsoft.com.au (http://www.kinsoft.com.au) to talk through your security and IT needs. Sources: Citrix CTX697174, CTX697191; CISA KEV; watchTowr; BleepingComputer; The Hacker News; SecurityWeek; Atlassian; Rapid7; Infosecurity Magazine; iTnews; FBI/USSS FortiBleed advisory (6 Oct); SOCRadar; Fortinet; FBI/ASD joint advisory AA26-281A; Wikimedia Foundation; Help Net Security; ABC; Reuters; The Register; Bloomberg; OVIC.

2. 

   8 Oct 2026

   Fakturownia - 600,000 Businesses, 38 Hours Inside, and the Invoices Built for Payment Fraud

   Fakturownia, a Warsaw-based cloud invoicing and accounting platform used by more than 600,000 businesses, has confirmed that an attacker exploited a flaw in its PDF-from-template generation, obtained server access, and over about 38 hours of access copied a large part of its production database. The company says every account is affected. France's VosFactures, which runs on the same platform, has confirmed indirect impact. Timeline (Polish local time, per the company). Sunday 27 September, ~03:20 — unauthorised access begins. Monday 28 September, 13:35 — attacker's IP blocked (detection); ~17:45 — access ends; 18:01 — vulnerability fixed; evening — keys and passwords rotated, traffic moved to rebuilt servers, old servers shut down; 23:10 — customer panel locked; overnight — all customer API tokens replaced. Tuesday 29 September — reported to Poland's data protection authority (UODO), CERT Polska and cybercrime police; public statement 16:15. Thursday 1 October — individual notifications begin; update confirms the incident "concerns every account". What was taken. In full: company and user details (names, tax numbers, emails, phones), bank account numbers including IBAN/SWIFT, salted password hashes, API tokens and integration keys, session IDs, and bank balances where the bank connection was active. By date cut-off (oldest-first download, interrupted; the company says cut-offs may vary by a dozen or so days): full invoices before 22 March 2021, invoice line items before 6 June 2019, counterparties added before 16 October 2024, warehouse documents before 14 July 2023, most export/import files generated up to 6 March 2026, and invoice amounts and descriptive fields across the whole period. About 2,250 accounts lost everything from 2022–2026. Not taken: KSeF e-invoicing certificates, bank logins and card data (not stored), and invoice contents from 22 March 2021 onward other than amounts, descriptive fields and additional-party data. Poland's national e-invoicing system was not breached (Ministry of Finance). No CVE. An actor calling itself "Fingerprint" claimed the attack and 6 TB of invoices; both are unverified claims. No ransom demand. Lessons. Stolen invoices are the raw material for invoice-redirection fraud: use call-back verification for every bank-detail change and dual approval for new payees. Inventory and be ready to rotate every API key connected to your accounting platform. Apply retention limits (APP 11.2). Under the Notifiable Data Breaches scheme, a supplier breach can still be your obligation to assess. Write prompt, full breach notification into supplier contracts. MFA, unique passwords, and sign out all sessions after a provider breach. Visit www.kinsoft.com.au (http://www.kinsoft.com.au) to talk through your security and IT needs. Sources: The Record; Fakturownia incident page (fakturownia.pl/incydent); Niebezpiecznik; Sekurak; Zaufana Trzecia Strona; CyberDefence24; cyberscope.pl (http://cyberscope.pl); PIT.pl (http://PIT.pl) (Ministry of Finance statement); Cyberattaque.org (http://Cyberattaque.org) (VosFactures).

3. 

   6 Oct 2026

   Stake - A Breach at the Broker Behind the Broker, and the Closed Accounts Still on File

   Sydney-based investing platform Stake has told customers that a breach at its US broker partner, DriveWealth, exposed personal and account information that Stake shares with DriveWealth to open US trading accounts. Stake's own systems, app and website were not affected. Revolut and New Zealand's Hatch customers were caught up in the same incident. Timeline. 4–5 September (US) — unauthorised access to DriveWealth's network via what DriveWealth calls a "sophisticated social engineering campaign"; contained 5 September per DriveWealth's notice to the California Attorney-General. 21 September — Stake publishes its incident page and notifies the OAIC and NZ's Privacy Commissioner. 22 September — Hatch notifies customers. 24 September — Revolut and DriveWealth email affected Revolut customers. 25 September — Stake emails customers (per Australian media reports). 28 September — DriveWealth's investigation and document review concludes. What was exposed (Stake customers; varies by person). Name, email, phone and postal address; W-8/W-9 tax status and country of taxation; DriveWealth account number (same as the Stake Wall St account number); aggregate portfolio value, cash balance and buying power snapshots. Not exposed, per Stake: Stake logins and passwords; tax file numbers and government ID numbers; bank account details; identity documents; individual holdings and trading history. No unauthorised trades, transfers or withdrawals. Inactive and closed accounts were included because DriveWealth must retain records for as long as the law requires. The number of affected Stake customers has not been disclosed; no group has claimed the attack; no CVE is involved. Lessons. Map where your customers' data goes beyond your own systems — your vendor's vendor is your risk. Check supplier contracts for a duty to report cyber incidents promptly (the Queensland Audit Office found only 2 of 36 contracts reviewed had one). Apply retention rules: records kept past their purpose are records you can lose, and the OAIC's Latitude investigation is examining exactly that. Under the Notifiable Data Breaches scheme, a breach at a supplier can still be your obligation to assess and notify. Warn customers specifically about what a scam using the leaked data would look like, and recommend authenticator-app 2FA. Visit www.kinsoft.com.au (http://www.kinsoft.com.au) to talk through your security and IT needs. Sources: Stake incident page (hellostake.com (http://hellostake.com)); DriveWealth notice to the California Attorney-General; Hatch help centre; Cyber Daily; The West Australian; Nine.com.au (http://Nine.com.au); The Register; The Next Web; Finance Magnates; SecurityBrief NZ; Queensland Audit Office; OAIC.

Contact Tech Talks With Kinsoft

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.