Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
Attackers are actively exploiting CVE-2026-16812, a critical command injection vulnerability in on-premises Arista VeloCloud Orchestrator (VCO) versions, enabling arbitrary code execution and potential compromise of managed SD-WAN infrastructure. CISA has added the flaw to its KEV catalog with a July 30, 2026 patch deadline for federal agencies. Read more
OpenAI has released the command-line interface and TypeScript SDK for Codex Security as open-source software, enabling developers to scan local code and Git changes for vulnerabilities and integrate checks into pre-commit and CI workflows, though actual analysis relies on OpenAI cloud services and requires authentication via ChatGPT login or API key. Read more
A new large language model framework integrates hierarchical, tree-based, and tokenization-based retrieval to improve accuracy and traceability in China's Multi-Level Protection Scheme (MLPS) compliance analysis, addressing limitations of general-purpose LLMs in standards-intensive cybersecurity governance. Read more
AhnLab ASEC details a four-stage in-memory loader chain for AtlasRAT, a Windows RAT using Delphi-based Flash Player lures, TLS-ChaCha20 C2, offline keylogging, and WeChat.exe DLL injection, with evidence pointing to a builder-based framework rather than a single operator, highlighting implications for regional threat monitoring. Read more
A Chinese national AI agent identity system launching in Q3 2026 uses split-knowledge binding to link agents to verified legal principals without revealing identities to business participants, requiring dual-agency compulsion for re-identification by legal authorities. Read more
AWS DevOps Agent reduces AWS Network Firewall troubleshooting time from hours to minutes by automatically correlating CloudWatch alarms, firewall logs, route tables, and CloudTrail API calls to identify rule changes causing connectivity drops, demonstrated through three failure scenarios including domain deny lists, stateless rule misconfigurations, and asymmetric AZ routing. Read more
Ransomware activity is accelerating due to the fragmentation of cybercriminal groups, emergence of new attackers via RaaS platforms, and expanded targeting of under-defended organizations—not AI-driven automation—according to researchers cited in a Dark Reading global priority pick. The trend reflects operational evolution in cybercrime rather than technological innovation in malware capabilities. Read more
A Practical Workflow for Track 'fix availability' across Taiwan, Japan, and Korea advisories — 25 July 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
Aikido Security's AI pentest agents uncovered eight high-severity flaws in NodeBB forum software, enabling admin takeover, private message access, and stored XSS via federation code; all patched in version 4.14.2, with administrators urged to upgrade immediately. Read more
Russian state-supported cyber actors (LAUNDRY BEAR) have exploited a zero-day XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite since July 2025 to exfiltrate 90 days of email, GAL, and authentication data via a view-only phishing technique, requiring only that victims open a malicious email in a vulnerable web client. Read more