Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
CISA has added CVE-2025-68686 (Fortinet FortiOS information exposure) and CVE-2026-16812 (Arista VeloCloud Orchestrator command injection) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, reinforcing BOD 26-04 requirements for federal agencies and urging all organizations to prioritize patching. Read more
A Practical Workflow for How to triage a JPCERT/CC alert in 10 minutes — 29 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
Attackers are actively exploiting CVE-2026-16812, a critical command injection vulnerability in on-premises Arista VeloCloud Orchestrator (VCO) versions, enabling arbitrary code execution and potential compromise of managed SD-WAN infrastructure. CISA has added the flaw to its KEV catalog with a July 30, 2026 patch deadline for federal agencies. Read more
OpenAI has released the command-line interface and TypeScript SDK for Codex Security as open-source software, enabling developers to scan local code and Git changes for vulnerabilities and integrate checks into pre-commit and CI workflows, though actual analysis relies on OpenAI cloud services and requires authentication via ChatGPT login or API key. Read more
A Practical Workflow for Create a weekly East Asia cyber risk brief for executives — 27 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
A Practical Workflow for A Taiwan supplier appears in a security advisory; how should operations teams assess exposure? — 27 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
A vulnerability in ABB's KNX Update Tool allows attackers with physical bus access to compromise legacy KNX devices lacking integrity checks, rendering them unusable or altering behavior, with no software fix possible due to outdated protocol design. Read more
A Practical Workflow for Hong Kong finance and cloud security signals worth escalating — 27 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
A Practical Workflow for Turn East Asia ransomware reports into a watchlist without panic — 27 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
A Practical Workflow for Taiwan semiconductor and manufacturing supplier cyber risk review — 28 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more