Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
iThome reports that CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP connection handling, affects kernels from 4.4 onward. Remote attackers can reportedly run arbitrary commands as root on servers with MPTCP listeners enabled. Distributions, appliance makers and cloud providers have mixed patch status, with several still investigating or waiting on upstream fixes. Read more
The UK National Cyber Security Centre assessed that attackers will very likely deploy AI-driven malware for ransomware attacks against UK critical infrastructure by 2028. AI will accelerate exploitation of known vulnerabilities in legacy systems and expand attack surface through newly deployed AI tools, making existing attacks more efficient rather than introducing entirely new methods. Read more
South Korean cybersecurity vendor AhnLab reported that advanced persistent threat groups in September 2026 shifted focus toward developer ecosystems, cloud credentials, supply chains, and network trust infrastructure. Attackers exploited legitimate software installers, GitHub, Microsoft 365, OneDrive, Nostr, routers, and TACACS authentication servers across multi-stage attack chains. Read more
The FBI, CISA, the USSS, and allied German and U.K. authorities released a joint cybersecurity advisory on SafePay ransomware. Active since August 2024, the group has impacted at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia using credential theft, edge-device exploits, living-off-the-land tools, and hybrid encryption. Read more
AhnLab identified a new Rust-based information theft malware disguised as illegal programs that first emerged in mid-August and spread widely in September. The malware steals browser, remote access, cloud, and credential data, features sophisticated anti-analysis techniques, and functions as a dropper for additional payloads. Read more
A Practical Workflow for Taiwan semiconductor and manufacturing supplier cyber risk review — 1 September 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims. Read more
CISA’s Vulnerability Review for FY2024–2025 shows most compromises stem from basic security failures and known vulnerabilities, not advanced tools, urging organizations to prioritize fixes using risk-based frameworks and Secure by Design principles. Read more
GovCERT.HK issued a High Threat Security Alert for multiple vulnerabilities in F5 Products, including a denial-of-service flaw (CVE-2026-39979) with publicly available proof-of-concept exploit code, affecting specific versions of F5OS, F5OS-A, and F5OS-C, with potential for DoS or information disclosure. Read more
CISA warns of active exploitation of CVE-2026-60004 (CVSS 9.8) in Gitea, allowing repository write access to execute arbitrary commands via the diffpatch endpoint. Attackers leverage default open registration to gain access and deploy miner-like payloads, with U.S. federal agencies required to patch by August 28, 2026. Read more
GovCERT.HK published Security Alert A26-08-44 on August 26, 2026, detailing an information disclosure vulnerability (CVE-2026-58070) in Veeam Backup & Replication version 13.0.2.29 and all earlier 13.x builds. The flaw, which could allow unauthorized data access if exploited, has been patched by Veeam via KB4902, with no evidence of active exploitation cited in the alert. The advisory underscores the risk posed by vulnerabilities in backup infrastructure, which may expose sensitive metadata and facilitate follow-on attacks even without direct system compromise. Read more