A serious security problem was found in a widely used piece of software. The Lumary system you use is not affected, and we have updated the internal tools that were. Your information is not affected and you do not need to do anything.
Status: Resolved
Last updated: 28/10/2027
What happened
Many computer systems shrink data before sending it so it travels faster. Brotli, a popular tool made by Google, does this job, and it is built into many other programs, including one called Node.js.
A serious weakness was found in Brotli. It is known as Node2Shell (and also HTTP2Shell). By sending specially made data, a criminal could crash a system, see information it was handling, or in some cases take control of it. Fixes were released on 21 October 2026.
Was Lumary affected?
No. The Lumary system you log in to, and the connections other systems use to talk to it, are not affected.
Some tools our engineering team uses behind the scenes did use the affected software. These tools do not hold any customer or client information, and we have installed the fix on all of them.
What we did
- Found every internal tool that used the affected software.
- Installed the fix on those tools, starting with the ones that receive information from the internet.
- Replaced older versions of the software that no longer receive security fixes.
- Checked those tools' activity records for anything unusual, as a precaution.
- Continuous monitoring for advice from technology companies and the Australian Cyber Security Centre.
What you need to do
No action required on your end. You can keep using Lumary as normal. If your organisation builds or runs its own software, ask your IT team or IT provider to check they have installed the latest updates.