Operations | Monitoring | ITSM | DevOps | Cloud

The Australian Medicare AI agent incident highlights a broader shift in cybersecurity. AI does not need to create new vulnerabilities to increase risk. Its ability to continuously discover, test, and pursue existing weaknesses places greater emphasis on maintaining secure configurations over time, not just fixing issues once. Security teams are used to the idea that determined attackers will keep looking for a way in.

CVE-2026-74580 is a high-severity Linux kernel bug in vhost, the subsystem that accelerates I/O for virtual machines. It gives a local user a reliable path to root on the host, and in some VM setups it lets a guest write into host memory. The CVE record has existed since August 21, 2026, but the full technical write-up, nicknamed "Vghost", only went public on October 12. It came with working exploit demos for both a local root escalation and a VM escape.

Renewing a certificate is the easy part. Getting it onto the server is where automation breaks. Somebody rotates the API token on the firewall. A service account password expires. A VM gets rebuilt and the agent never comes back. The certificate renews right on schedule, the deployment fails, and the server keeps serving the old certificate until it expires. Renewed and deployed are not the same thing.

On 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high (CVE-2026-92392), while the others have a low or medium severity. The curl maintainer has coordinated with downstream vendors, including Ubuntu, under embargo and the vulnerabilities have been publicly disclosed on the planned date.

Avantra monitors SAP security patch status across entire landscapes, checking each newly published SAP HotNews note against every managed system and tracking which systems still need it. It covers the patch side of SAP vulnerability management, which is a different job from code-level vulnerability scanning.

Avantra handles RISE with SAP security monitoring for the layer that stays with the customer under the RISE with SAP shared responsibility model. SAP operates the infrastructure, network, database, and operating system, while the customer still owns application configuration, users and authorizations, custom code, and requesting the SAP Security Notes that SAP doesn’t apply proactively.

In short, automating the AI agent lifecycle is this year’s pitch: Google Cloud’s walkthrough of 30th July 2026 turns the whole thing into a conversation with a coding agent.