Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
A security bypass vulnerability (CVE-2026-24498) in EFM-Networks ipTIME wireless routers allows unauthorized actors to extract Wi-Fi passwords in plaintext. Impacting multiple models including the T5008 and AX-series, the flaw bypasses internal security controls. Users must update to firmware version 15.27.2 or higher to remediate the risk of local credential theft. Read more
Cisco has released urgent security updates to address significant vulnerabilities in its networking and security product lines. The advisories cover denial-of-service risks in the Crosswork Network Controller and Network Services Orchestrator (NSO), as well as long-standing resource management issues in Cisco Email Security Appliance (ESA) running legacy AsyncOS software. Read more
Palo Alto Networks has released critical security updates addressing CVE-2026-0300, an out-of-bounds write vulnerability in its PAN-OS software. Affecting versions 10.2 through 12.1, the flaw poses significant risks to network infrastructure security. The Korea Internet & Security Agency (KISA) strongly recommends that organizations apply the specific hotfixes and maintenance releases provided to mitigate potential exploitation risks. Read more
Cisco has released critical security patches for Cisco Unity Connection to address vulnerabilities including Path Traversal (CVE-2026-20034) and Server-Side Request Forgery (CVE-2026-20035). These flaws affect versions 12.5 through 15.0, potentially allowing unauthorized system access. Organizations are advised to upgrade to version 15SU4 or 14SU5 to mitigate these infrastructure risks. Read more
Ollama has released a critical security update to address CVE-2026-7482, an out-of-bounds read vulnerability. KISA has issued an advisory recommending that users upgrade to version 0.17.1 or higher. The flaw could allow unauthorized memory access, necessitating immediate patching or temporary mitigation by restricting external API access and rotating keys. Read more
cPanel has released urgent security updates for cPanel & WHM and WP Squared to address three critical vulnerabilities: improper input validation, code injection, and symbolic link following. These flaws affect numerous legacy and current versions, potentially allowing unauthorized system access. Administrators should immediately verify their software versions and apply the recommended patches to mitigate the risk of server compromise. Read more
Oracle has issued its April 2026 Critical Patch Update, delivering 481 security fixes across its product portfolio. The update addresses several high-risk vulnerabilities in Java SE and GraalVM, some of which allow unauthenticated network-based attacks. Organizations are urged to apply these patches immediately to mitigate risks of unauthorized code execution and service disruptions. Read more
Modern cyber threats are shifting focus from breaking encryption to manipulating user behavior through psychological fatigue. New tactics target the friction between automated security tools and manual user intervention, specifically exploiting the 'MFA fatigue' phenomenon and the warning dialogs of password managers to trick users into authorizing unauthorized access or bypassing domain-matching security protocols. Read more
Microsoft has released urgent security updates for ASP.NET Core to address CVE-2026-40372, a critical elevation of privilege vulnerability. Flaws in cryptographic signature validation allow unauthenticated attackers to forge authentication cookies and gain SYSTEM-level access. The vulnerability primarily impacts non-Windows environments using the Data Protection package, requiring immediate patching of affected container and server deployments. Read more
CrowdStrike has established Project QuiltWorks, an industry-wide coalition including OpenAI and IBM, to address the rapid discovery of software vulnerabilities by generative AI. The initiative integrates expert-led red teaming with frontier AI models to help organizations prioritize and remediate risks faster than automated exploitation tools can identify them, moving beyond traditional periodic security scanning. Read more