AI doomerism and adversarial risk get lumped together under “AI danger.” They aren’t the same thing.
Doomerism is the claim that once we build AI smarter than us, it will ignore human goals and wipe us out or lock us in. The usual picture is a system that improves itself, treats our rules as obstacles, and can’t be controlled because we never figured out how to specify what we actually want. It’s almost entirely theoretical. No one has built the thing yet, so the argument rests on thought experiments about intelligence explosions and value alignment. The recommended response is usually some form of slowdown or hard restriction on research.
Adversarial risk is simpler and already here: people using current AI to do bad things better. Phishing emails that sound real, malware that gets generated faster, deepfakes for fraud, automated bug hunting, model jailbreaks, data poisoning. The actors are the same ones we’ve always had, criminals, spies, ideologues. The tools just got cheaper and more capable. Fixing it looks like normal security work: monitoring, access controls, red-teaming, attribution, and liability, plus whatever model-level defences actually hold up under attack.
One is a bet on a future system that doesn’t exist. The other is measurable misuse of systems that do. Treating every jailbreak as proof of looming extinction wastes attention. Treating speculative extinction risk as the main reason to ignore present-day attacks does the same. They need different tools and different priorities. Mixing them up just makes both problems harder to handle.
The distinction matters because it decides where effort goes. Doomerism asks us to prepare for a system that does not yet exist, while adversarial risk asks us to defend against misuse that is already happening. Taking the second seriously does not mean ignoring the first, but it does mean starting with the threats in front of us and applying the security practices we already know.
What we read this week
Qilin Ransomware Claims Multiple Australian Victims Including Bathurst RSL - The Qilin ransomware-as-a-service group listed four Australian organisations in rapid succession, including Bathurst RSL Club, Melbourne-based Creative Universe, CDG Chartered Accounting and the deregistered Race Trakka entity. Bathurst RSL confirmed it had responded to a cyber incident, engaged specialist experts, contained the activity and verified that gaming and membership management systems were unaffected. The group published sample documents and passport-related files linked to the club. Qilin remains one of the most active ransomware operators globally and continues to target Australian mid-market and hospitality organisations. Entities should prioritise offline backups, multi-factor authentication, rapid incident response readiness and dark-web monitoring for early detection of extortion claims.
Critical PHP2Shell Flaws Confirmed Exploited and Added to CISA KEV - CISA has added the two critical PHP remote code execution vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue after researchers confirmed successful unauthenticated exploitation in the wild. Honeypots recorded working shells, and a separate campaign chained the flaws with the Linux kernel privilege-escalation bug Fragnesia (CVE-2026-46300) to root at least 24 firewalls, including systems linked to a US government-affiliated organisation. Federal agencies face a short remediation deadline. All organisations running PHP should upgrade immediately to the fixed versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35), restart workers, review logs for compromise and isolate any internet-facing instances that cannot be patched promptly.
RMS Cloud Third-Party Breach Triggers Targeted Phishing Against Australian Holiday Parks and Hotels - A security incident at booking-platform provider RMS Cloud has led to sophisticated phishing campaigns targeting guests of Australian operators including Reflections Holidays, G’Day Parks, BIG4 and properties linked to Rottnest Island. Attackers are sending emails, SMS and WhatsApp messages that reference genuine booking details and urge recipients to “update” payment information. RMS Cloud states that payment-card data was not accessed, but guest names, contact details and booking information were exposed. Operators are warning customers to ignore the messages and report any that appear legitimate. The incident underscores third-party supply-chain risk in the tourism sector and the value of rapid guest communication when booking data is involved.
Veeam Patches Critical Unauthenticated Authorization Bypass in Backup & Replication - Veeam has released fixes for CVE-2026-108142, a critical (CVSS 9.1) vulnerability allowing an unauthenticated attacker on the network to bypass authorization on the CDP Coordinator Service of Backup & Replication servers. The flaw affects both Windows installations and the Veeam Software Appliance in the 13.0 and 13.1 branches. Fixed builds are 13.1.2 and 13.0.3. The same advisory addresses additional path-traversal and privilege-escalation issues. Organisations running affected versions should prioritise the update, restrict network exposure of backup infrastructure where possible, and treat backup servers as high-value targets requiring strong segmentation and monitoring.
ASD Annual Cyber Threat Report 2025-26 Highlights Rising Incident Volume - The Australian Signals Directorate’s Australian Cyber Security Centre released its Annual Cyber Threat Report for 2025-26, recording more than 1,500 cyber security incidents (a 20 per cent year-on-year increase) and issuing over 4,400 notifications of potential malicious activity (almost 80 per cent higher). Ransomware incidents remained broadly stable at 139, while data-breach responses rose sharply. The report emphasises the growing role of AI in both offensive and defensive operations and the continued pressure on critical infrastructure and mid-market organisations. Australian entities are urged to focus on resilience, timely patching, identity security and the adoption of the Essential Eight maturity model.