Original: 代重要子公司正能量運動(股)公司發生網路資安事件說明
EMT (5348)Operation QUICSILVER Exploits Graduation Lures and QUIC Backdoor in Myanmar Cyber Espionage Campaign
Cybersecurity researchers have identified Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar’s government and IT sectors since April 2026. The attack uses fake graduation ceremony invitations to deliver QUICAgent, a Go-based backdoor that abuses legitimate Windows binaries and communicates via QUIC over UDP port 443 to evade detection.
Route Public Cyber Signals to the Right Team
A Practical Workflow for Route public cyber signals to the right team — 21 August 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims.
F5 Issues Advisory for Privilege Escalation Flaw in BIG-IP and F5OS Products
F5 has released a security advisory addressing a privilege escalation vulnerability (CVE-2025-20028) affecting multiple versions of BIG-IP and F5OS systems, with patches now available for immediate deployment.
GovCERT.HK Issues High-Threat Alert on Oracle CSPU August 2026 with Active PoC Exploits
GovCERT.HK has issued a High Threat Security Alert (A26-08-28) warning of multiple critical vulnerabilities in Oracle products with publicly available proof-of-concept exploit code, urging immediate patching across Java SE, Database, Fusion Applications, Middleware, MySQL, Linux, and Virtualization suites to prevent remote code execution, privilege escalation, and data exposure.
Research Digest: Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes in Political Domains
A new study evaluates how generative search engines (GSEs) are vulnerable to poisoning attacks by analyzing publisher authority and personalization effects, finding that ruling parties face broader attack surfaces than opposition parties in U.S. and Japan political domains, and that user profiles have minimal influence on citation behavior.
Build a Supplier-Risk Question Set from East Asia Public Records
A Practical Workflow for Build a supplier-risk question set from East Asia public records — 18 August 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims.
Maintain a No-Hype CVE Watchlist for East Asia Suppliers
A Practical Workflow for Maintain a no-hype CVE watchlist for East Asia suppliers — 16 August 2026 Review helps security, cloud, and supplier-risk teams keep an East Asia cyber or AI-risk signal under review when there is no fresh publish-ready news item. It explains how to preserve the original link, separate visible evidence from assumptions, and route unclear findings without inventing unsupported claims.
Critical OS Command Injection in Siemens Siveillance Video Management Servers Enables Remote Code Execution
A critical OS command injection vulnerability (CVE-2026-3014, CVSS 9.1) in Siemens Siveillance Video Management Servers allows authenticated users with edit permissions to execute arbitrary code. Siemens has released patched versions for V2023 R3, V2024 R1, and V2025 product lines. CISA urges network isolation and VPN use for remote access.
Lazarus Group Exploits Windows Zero-Day to Deploy Troy Backdoor via Trojanized PDF Viewer
Lazarus Group exploited CVE-2026-68820, a Windows AFD.sys privilege escalation flaw, to deploy the Troy backdoor via trojanized PDF viewers and DLL side-loading, targeting defense and aerospace sectors globally using compromised legitimate infrastructure for C2.
Siemens Desigo DXR and PXC Controllers Vulnerable to BACnet Packet DoS
A medium-severity denial-of-service vulnerability (CVE-2026-59693) in Siemens Desigo DXR and PXC controllers allows attackers to disrupt building automation systems via malformed BACnet packets, requiring device reset for recovery. Siemens has released patched versions and recommends network segmentation and VPN use for mitigation.