Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
Oracle has issued its April 2026 Critical Patch Update, delivering 481 security fixes across its product portfolio. The update addresses several high-risk vulnerabilities in Java SE and GraalVM, some of which allow unauthenticated network-based attacks. Organizations are urged to apply these patches immediately to mitigate risks of unauthorized code execution and service disruptions. Read more
Microsoft has released urgent security updates for ASP.NET Core to address CVE-2026-40372, a critical elevation of privilege vulnerability. Flaws in cryptographic signature validation allow unauthenticated attackers to forge authentication cookies and gain SYSTEM-level access. The vulnerability primarily impacts non-Windows environments using the Data Protection package, requiring immediate patching of affected container and server deployments. Read more
Okta's 'Businesses at Work 2026' report reveals a massive 1,140% surge in access requests over two years, driven primarily by autonomous AI agents. This shift is forcing global enterprises to move beyond traditional user-centric security, prioritizing non-human identity (NHI) governance and phishing-resistant multi-factor authentication to secure modern cloud and hybrid infrastructure environments. Read more
CrowdStrike has established Project QuiltWorks, an industry-wide coalition including OpenAI and IBM, to address the rapid discovery of software vulnerabilities by generative AI. The initiative integrates expert-led red teaming with frontier AI models to help organizations prioritize and remediate risks faster than automated exploitation tools can identify them, moving beyond traditional periodic security scanning. Read more
CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: a high-severity path traversal flaw in ConnectWise ScreenConnect and a Windows Shell spoofing vulnerability. Both flaws have confirmed active exploitation in the wild, requiring federal agencies and private organizations to prioritize patching to prevent unauthorized remote access and network-based identity spoofing. Read more
A new study by Kaspersky analyzing 231 million leaked passwords shows that 48% can be cracked in under a minute. Rapid advancements in consumer GPU hardware, specifically the shift to the NVIDIA RTX 5090, have dramatically reduced the time required to break simple hashes, rendering traditional eight-character passwords virtually useless against modern brute-force and AI-assisted attacks. Read more
Japan is implementing a new Supply Chain Cybersecurity (SCS) Evaluation System that prioritizes continuous operational maintenance over one-time audits, requiring organizations to integrate annual inspections and specialized personnel frameworks into their core business processes. Read more
At the 2026 CYBERSEC Taiwan conference, high-tech manufacturer Wistron revealed how its security operations center (SOC) successfully integrated generative AI to reduce incident analysis time from 15 minutes to 1 minute and overall response times from hours to under 10 minutes, achieving a 97.5% accuracy rate in threat detection. Read more
Microsoft has released significant updates for three core Sysinternals tools—ProcDump, Autoruns, and ZoomIt—enhancing forensic memory capture, startup persistence analysis, and technical presentation capabilities for IT professionals and security researchers. Read more
Broadcom has announced VCF 9.1, introducing a zero-trust architecture for private AI workloads, significant throughput gains for lateral threat detection, and expanded ransomware recovery options through new integration with CrowdStrike Falcon. Read more