Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
Mend has launched a Taiwan cloud region for its application security SaaS on AWS's Asia Pacific (Taipei) region, iThome reports. Distributor Systex says scan and analysis information can stay in Taiwan, with lower latency. The source offers no measured performance data or specifics on data scope. Read more
The company says it has not been notified of similar access and is still assessing its exposure. Read more
JVN#42011956 reports a DLL loading vulnerability, CVE-2026-59781, in Zabbix agent from Zabbix LLC. Versions before 6.0.48, 7.0.29 and 7.4.13 are listed. The advisory says improper installation permissions may let an unauthorized DLL load and code run with administrator privileges. It advises updating to the latest version. Read more
iThome reports that CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP connection handling, affects kernels from 4.4 onward. Remote attackers can reportedly run arbitrary commands as root on servers with MPTCP listeners enabled. Distributions, appliance makers and cloud providers have mixed patch status, with several still investigating or waiting on upstream fixes. Read more
Siemens has addressed an authentication bypass vulnerability, tracked as CVE-2026-89209, in its Mendix SAML module. The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens and CISA advise updating affected versions or applying mitigations across Critical Manufacturing and Information Technology environments deployed worldwide. Read more
AhnLab ASEC published an analysis detailing how attackers exploit the Suo5 HTTP and HTTPS tunneling tool for network pivoting and lateral movement. The report documents real-world file deployment on Windows IIS web servers and fileless memory injection within Java-based Jenkins environments, outlining specific execution artifacts and defensive recommendations. Read more
AhnLab identified a new Rust-based information theft malware disguised as illegal programs that first emerged in mid-August and spread widely in September. The malware steals browser, remote access, cloud, and credential data, features sophisticated anti-analysis techniques, and functions as a dropper for additional payloads. Read more
CISA issued advisory ICSA-26-288-02 regarding three vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware, which could allow an attacker to gain control over affected IP cameras. The vendor did not respond to CISA's coordination attempts, and the flaws include a critical hard-coded credential vulnerability that allows an attacker to log in to EseeCloud devices across worldwide deployments. Read more
CISA’s Vulnerability Review for FY2024–2025 shows most compromises stem from basic security failures and known vulnerabilities, not advanced tools, urging organizations to prioritize fixes using risk-based frameworks and Secure by Design principles. Read more
GovCERT.HK issued a High Threat Security Alert for multiple vulnerabilities in F5 Products, including a denial-of-service flaw (CVE-2026-39979) with publicly available proof-of-concept exploit code, affecting specific versions of F5OS, F5OS-A, and F5OS-C, with potential for DoS or information disclosure. Read more