Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
JVN#42011956 reports a DLL loading vulnerability, CVE-2026-59781, in Zabbix agent from Zabbix LLC. Versions before 6.0.48, 7.0.29 and 7.4.13 are listed. The advisory says improper installation permissions may let an unauthorized DLL load and code run with administrator privileges. It advises updating to the latest version. Read more
iThome reports that CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP connection handling, affects kernels from 4.4 onward. Remote attackers can reportedly run arbitrary commands as root on servers with MPTCP listeners enabled. Distributions, appliance makers and cloud providers have mixed patch status, with several still investigating or waiting on upstream fixes. Read more
The UK National Cyber Security Centre assessed that attackers will very likely deploy AI-driven malware for ransomware attacks against UK critical infrastructure by 2028. AI will accelerate exploitation of known vulnerabilities in legacy systems and expand attack surface through newly deployed AI tools, making existing attacks more efficient rather than introducing entirely new methods. Read more
Google released its November Android security update on November 2, patching 216 vulnerabilities: 119 in Android core components and 97 in third-party elements. The update includes 23 critical-severity and 193 high-risk flaws, with the most dangerous vulnerability in the Framework component allowing remote code execution without user interaction. Read more
CISA released an ICS advisory warning of four vulnerabilities in EPICS Base release 7.0.10 and prior. Successful exploitation could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code across worldwide critical manufacturing deployments. Users are advised to update to release 7.0.11. Read more
South Korean cybersecurity vendor AhnLab reported that advanced persistent threat groups in September 2026 shifted focus toward developer ecosystems, cloud credentials, supply chains, and network trust infrastructure. Attackers exploited legitimate software installers, GitHub, Microsoft 365, OneDrive, Nostr, routers, and TACACS authentication servers across multi-stage attack chains. Read more
Siemens has addressed an authentication bypass vulnerability, tracked as CVE-2026-89209, in its Mendix SAML module. The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens and CISA advise updating affected versions or applying mitigations across Critical Manufacturing and Information Technology environments deployed worldwide. Read more
The FBI, CISA, the USSS, and allied German and U.K. authorities released a joint cybersecurity advisory on SafePay ransomware. Active since August 2024, the group has impacted at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia using credential theft, edge-device exploits, living-off-the-land tools, and hybrid encryption. Read more
AhnLab ASEC published an analysis detailing how attackers exploit the Suo5 HTTP and HTTPS tunneling tool for network pivoting and lateral movement. The report documents real-world file deployment on Windows IIS web servers and fileless memory injection within Java-based Jenkins environments, outlining specific execution artifacts and defensive recommendations. Read more
CISA issued advisory ICSA-26-288-02 regarding three vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware, which could allow an attacker to gain control over affected IP cameras. The vendor did not respond to CISA's coordination attempts, and the flaws include a critical hard-coded credential vulnerability that allows an attacker to log in to EseeCloud devices across worldwide deployments. Read more