ASD’s ACSC alert first published 28 September 2026 · Summary updated 8 October 2026
ACSC updates critical Citrix NetScaler security alert
ASD’s Australian Cyber Security Centre updated its Citrix NetScaler ADC and Gateway alert on 30 September to confirm exploitation reported by Australian organisations. It recommends checking for compromise back to 4 September. A separate 3 October update describes a SAML authentication issue, possible crashes or denial of service, and impacts in Australia. Citrix says that issue depends on the Gateway or AAA configuration and is independent of the original eight vulnerabilities.
Scope: These advisories concern NetScaler gateways. Relevance to CCTV depends on whether that gateway provides access to video management; the sources do not identify a camera or recorder vulnerability.
Practical takeaway
Ask the organisation’s network administrator to identify the appliance, version and SAML configuration, follow the applicable Citrix bulletin and fixed-build guidance, and review logs for compromise. Include any NetScaler path used for CCTV remote access in that review. Camera firmware updates do not address these gateway issues.
Cyber.gov.au: Critical vulnerabilities in Citrix NetScaler ADC and Gateway products ↗
Citrix: Guidance for NetScaler SAML authentication deployments ↗
Citrix security bulletin CTX697096 ↗
ASD’s Australian Cyber Security Centre advisory published 28 September 2026
ACSC advises organisations to secure access to AI services
The Australian Cyber Security Centre says malicious actors are accessing some organisations’ AI services through compromised API keys, authentication tokens, user sessions, vulnerable applications and third-party arrangements. The advisory says this can enable unauthorised use, disruption or exposure of data. It is an organisation-focused AI security advisory, not a report of a CCTV camera vulnerability or a compromise of a camera manufacturer.
Scope: The guidance may matter to businesses that connect AI services with CCTV analytics or other security platforms. It does not say that camera systems are affected; check the actual services, credentials and integrations used in each deployment.
Practical takeaway
For a commercial security system that uses connected AI or video analytics, keep an inventory of service accounts and API keys, assign an owner, grant only the access required, enable phishing-resistant multi-factor authentication where available, store secrets in an approved secrets manager, and review supplier access and audit logs. Apply these controls to the organisation’s AI services and integrations; do not assume a camera firmware update addresses account or token security.
Cyber.gov.au: Protect your organisations’ AI services ↗
Victoria Police release published 25 September 2026 · Summary updated 27 September 2026
Victoria Police investigate a series of offences across bayside and south-east Melbourne
Victoria Police said detectives were investigating a series of 21 offences across Melbourne’s bayside and south-eastern suburbs over five days. The release says two vehicles were stolen in Glen Waverley and later used in offences across the region. Police listed robberies, aggravated burglaries, a burglary, number-plate theft and petrol drive-offs, and asked anyone with information or relevant footage to contact Crime Stoppers. The incidents remain under investigation; the release does not identify Lynbrook as a location or provide a suburb-level risk estimate.
Scope: This is a police appeal about alleged offending across multiple bayside and south-eastern locations, not a crime-rate assessment for any one suburb. CCTV may help provide footage for an investigation, but no camera system can guarantee prevention or identify a person in every condition.
Possible relevance for security contractors
Victoria Police recommends basic vehicle-security steps such as locking doors, securing keys and parking in a well-lit area; where suitable, it also suggests a sensor light and CCTV for a driveway. If your home security camera system records an incident, preserve the original footage and its date and time, provide it to police, and do not follow or confront anyone. When planning a security camera installation, check the driveway view, night lighting, camera clock and neighbours’ privacy.
Victoria Police: Police investigate series of offending in Melbourne’s bayside and south-eastern suburbs ↗
Victoria Police: Preventing motor vehicle theft ↗
Victoria Police: Installing CCTV ↗
Victoria Police crime-statistics release published 24 September 2026 · Summary added 26 September 2026
Crime statistics for Victoria: burglaries fell in the year to June 2026
Victoria Police’s 24 September release of Crime Statistics Agency data reports that recorded burglary offences fell by 19.9% in the year ending June 2026, while residential aggravated burglaries fell by 27%. Theft from motor vehicles decreased by 10.4% and theft of motor vehicles by 5.2%. The release says total recorded offences fell 2.1% year-on-year, but remain 13.2% above the level three years earlier. These are statewide figures, not a measure of risk for any particular suburb or household.
Practical takeaway
Use statewide crime figures as context, not as a prediction about an individual property. Victoria Police recommends layered home security, including securing doors and windows, sensor lighting, alarms and cameras. When planning a home security camera system or security camera installation, identify the entry points and driveway views you need, check night lighting and consider neighbours’ privacy before choosing camera locations.
Victoria Police: Crime Statistics Agency data, year ending June 2026 ↗
Victoria Police: Prevent home burglaries ↗
Dahua release published 24 September 2026 · Summary added 26 September 2026
Dahua presents Xinghan AI models at its Smart City Summit
At a summit held in Shanghai on 23 September, Dahua described city-scale operations that bring video, data and services together. In its 24 September company release, Dahua said its Xinghan system combines visual, multimodal and language intelligence, supported by more than 1,600 algorithms and computing from edge devices through cloud services. Examples it listed included video analytics, missing-person searches, traffic-signal optimisation, highway-incident analysis and disaster response. The company also said it has delivered more than 900 smart-city solutions across 70 countries and regions.
Scope: These figures and examples are claims in Dahua’s own release. They describe integrated smart-city solutions, not features guaranteed on every standalone Dahua camera, recorder or installation. Confirm capabilities against the exact models, software, licences and project design.
Practical takeaway
For a commercial CCTV or security-system brief, describe the job the system must do before choosing equipment: what staff need to find or respond to, who may view footage, where recordings are stored, how networks are separated, and what support is required. Check compatibility, licensing, privacy requirements and lifecycle costs across the cameras, recorder, analytics, access control, alarms, intercom and network. For a home security camera installation, choose by viewing area, lighting, recording needs and network conditions; do not assume city-platform AI functions are included.
Dahua: Smart City Summit at Tomorrow.City Shanghai ↗
Updated 23 September 2026
Australia’s smart-device security standards are now in force
Australia’s Cyber Security (Security Standards for Smart Devices) Rules 2025 commenced on 4 March 2026 after a transition period. The rules introduce baseline obligations for many consumer smart devices, including requirements around unique passwords, reporting security issues and publishing a support period. Whether a particular camera or recorder is covered depends on the product and its manufacture and supply details.
Practical takeaway
When comparing a connected home security camera, ask for the exact model, its security-update support period, the manufacturer’s vulnerability-reporting process and the statement of compliance where applicable. Change default credentials, use strong unique passwords and keep the recorder, cameras and network equipment updated.
Australian Government: Security Standards for Smart Devices ↗
Source report 21 September 2026 · BYD response reported 23 September 2026
Dahua camera components raise new questions about connected-vehicle security
ABC Four Corners reported that some cameras in Leapmotor C10 vehicles sold in Australia were supplied through a Dahua subsidiary, drawing attention to the difference between connected-vehicle systems and fixed CCTV. The report revisits the removal of Dahua equipment from some federal and Defence locations, but it does not announce a general Australian prohibition on Dahua cameras used in private commercial installations. In separate follow-up reporting, BYD disputed that the broadcast demonstrated a remote-attack vulnerability and said it was reviewing the claims.
Scope: This is connected-vehicle reporting about particular components and sensitive-site concerns. It does not establish that private commercial Dahua CCTV installations are generally prohibited in Australia.
Practical takeaway
For commercial CCTV projects, especially where procurement rules apply, record the exact manufacturer and model, firmware support, network path, storage location, access controls and any required approvals. Ask the customer to confirm their procurement and cybersecurity requirements early. Where a policy excludes a product, document suitable alternatives; no camera brand should be described as universally safe or unsafe without evidence.
ABC News / Four Corners: Dahua cameras in Leapmotor vehicles ↗
CarsGuide: BYD response and review of the claims ↗
Government plan released 22 September 2026 · Summary added 24 September 2026
Victoria releases its Sustainable Data Centre Action Plan
Victoria released its Sustainable Data Centre Action Plan on 22 September 2026, setting expectations for energy, water and planning as the state develops data-centre infrastructure. The government says new developments are expected to match added demand with new renewable generation and storage, meet connection and network-upgrade costs, use recycled or other non-drinking water for cooling, and maintain a 150-metre separation from homes. The plan also addresses residential zoning, schools and childcare sites. ABC reported that planning-regulation changes were still to come and would not apply retrospectively to already approved applications.
Possible relevance for security contractors
For security and technology contractors, this may create future opportunities to tender for data-centre infrastructure work such as access control, CCTV, perimeter detection, intercoms, structured cabling and maintenance. That is a market implication, not a confirmed project pipeline: follow formal tenders and project specifications, and prepare a capability statement that documents system scope, resilience, cybersecurity and support.
Victorian Government: Sustainable Data Centre Action Plan ↗
Premier of Victoria: policy details ↗
ABC News: planning changes and transition details ↗
Related security advice
